Exception handling methods and artificial intelligence processors

Abstract

This application relates to an anomaly handling method and an artificial intelligence processor. The method is applied to an artificial intelligence chip, which includes a security component and a shielding layer. The method includes: determining whether an anomaly exists in the shielding layer; if no anomaly exists in the shielding layer, performing anomaly detection on the artificial intelligence chip based on the security component to obtain a chip detection result; performing anomaly handling on the artificial intelligence chip according to the anomaly level corresponding to the chip detection result; and if an anomaly exists in the shielding layer, performing anomaly handling on the artificial intelligence chip according to the highest anomaly level. This method can increase the accuracy of anomaly detection and perform differentiated anomaly handling using anomaly levels.

Description

Technical Field

[0001] This application relates to the field of chip security technology, and in particular to an anomaly handling method and an artificial intelligence processor. Background Technology

[0002] With the widespread application of artificial intelligence (AI) chips in security-critical fields such as high-performance computing, AI training and inference, autonomous driving, and confidential computing, AI chips are increasingly becoming a key target for attackers. To ensure the secure operation of AI chips, it is necessary not only to protect the confidentiality and integrity of the data itself, but also to ensure the security of its operating environment to effectively defend against security threats such as side-channel attacks.

[0003] In existing technologies, firmware periodic polling (FW Polling) is typically used to read sensor values ​​from fixed locations within the system chip to determine if the system is experiencing anomalies. However, this method is limited by the capabilities of the sensors themselves, resulting in insufficient security. Summary of the Invention

[0004] Therefore, it is necessary to provide an anomaly handling method and an artificial intelligence processor to address the aforementioned technical problems, thereby improving the accuracy of detection and enhancing the security of artificial intelligence chips.

[0005] In a first aspect, this application provides an anomaly handling method applied to an artificial intelligence chip, the artificial intelligence chip including a security component, the security component having a shielding layer, the method comprising:

[0006] Determine if the shielding layer is abnormal;

[0007] If there are no abnormalities in the shielding layer, the AI ​​chip is subjected to anomaly detection based on the security component to obtain the chip detection result; and the AI ​​chip is subjected to anomaly processing according to the anomaly level corresponding to the chip detection result.

[0008] In the event of an anomaly in the shielding layer, the AI ​​chip will be subjected to anomaly processing based on the highest anomaly level.

[0009] In one embodiment, the shielding layer includes a wire mesh for transmitting shielding layer signals;

[0010] The determination of whether the shielding layer is abnormal includes:

[0011] Determine whether the shielding layer signal exists;

[0012] If the shielding layer signal is present, then the shielding layer is not abnormal;

[0013] If the shielding layer signal is not present, then the shielding layer is abnormal.

[0014] In one embodiment, the artificial intelligence chip includes a signal transmitting end and a signal receiving end of the wire network;

[0015] The determination of whether the shielding layer signal exists includes:

[0016] When the signal transmitting end randomly generates a shielding layer signal and sends the shielding layer signal to the signal receiving end through the wire network, it is determined whether the signal receiving end receives the shielding layer signal.

[0017] If the shielding layer signal is received, then the shielding layer signal exists;

[0018] If the shielding layer signal is not received, then the shielding layer signal does not exist.

[0019] In one embodiment, the spacing between the wires in the wire mesh is consistent with the wiring spacing of the safety component.

[0020] In one embodiment, the security component includes multiple sensors;

[0021] The step of performing anomaly detection on the artificial intelligence chip based on the security component to obtain chip detection results includes:

[0022] Based on the sensor values ​​obtained from the various sensors, anomaly detection is performed on the artificial intelligence chip to obtain the chip detection results of each sensor.

[0023] Based on the chip detection results indicating anomalies in the artificial intelligence chip, the cumulative value of the anomaly results corresponding to each of the sensors is determined;

[0024] The step of handling anomalies in the artificial intelligence chip based on the anomaly level corresponding to the chip detection result includes:

[0025] Obtain the cumulative anomaly threshold for each of the aforementioned sensors;

[0026] The comparison result between the cumulative value of each abnormal result and the cumulative threshold of each abnormality is determined, and the abnormality is handled according to the abnormality level corresponding to the comparison result.

[0027] In one embodiment, obtaining the cumulative anomaly threshold for each of the sensors includes:

[0028] Based on the chip detection results indicating the abnormality of the artificial intelligence chip, the types of sensors that detected the chip abnormality are calculated to obtain the number of sensor types indicating the chip abnormality.

[0029] The cumulative anomaly threshold is determined based on the number of sensor types; the number of sensor types is negatively correlated with the cumulative anomaly threshold.

[0030] In one embodiment, the step of performing anomaly processing on the artificial intelligence chip based on the anomaly level corresponding to the comparison result includes:

[0031] If the comparison result corresponds to a first anomaly probability, update the cumulative value of the anomaly result;

[0032] If the comparison result corresponds to the second anomaly probability, update the cumulative value of the anomaly result and perform a logical reset on the artificial intelligence chip;

[0033] If the comparison result corresponds to the third anomaly probability, the AI ​​chip is cleaned of data.

[0034] The first abnormal probability, the second abnormal probability, and the third abnormal probability increase sequentially, representing an increasing level of abnormality.

[0035] In one embodiment, the step of performing anomaly detection on the artificial intelligence chip based on the security component to obtain chip detection results includes:

[0036] Obtain the power supply voltage of the artificial intelligence chip, divide the power supply voltage to obtain the divided voltage;

[0037] Determine the glitch voltage threshold corresponding to the reference voltage;

[0038] Determine the voltage comparison result between the voltage after voltage division and the glitch voltage threshold;

[0039] Based on the clock signal, the voltage comparison result is sampled on both sides to obtain the sampled value of the voltage comparison result; the frequency of the clock signal is negatively correlated with the delay of the glitch voltage detection;

[0040] The glitch voltage detection result of the artificial intelligence chip is determined based on the sampled values.

[0041] In one embodiment, the chip detection result includes at least one of temperature detection result, voltage detection result, and clock frequency detection result;

[0042] The temperature detection results are generated based on the temperature thresholds and temperature values ​​of each region of the artificial intelligence chip.

[0043] The voltage detection results include at least one of the continuous power supply voltage detection results and the glitch voltage detection results of the artificial intelligence chip;

[0044] The clock frequency detection result includes the reference clock frequency detection result of the artificial intelligence chip.

[0045] Secondly, this application also provides an artificial intelligence processor for use in an artificial intelligence chip, the artificial intelligence chip including a security component, the security component having a shielding layer, and the artificial intelligence processor including:

[0046] The physical detection module is configured to determine whether there is an abnormality in the shielding layer;

[0047] The security component detection module is configured to perform anomaly detection on the artificial intelligence chip based on the security component when there is no anomaly in the shielding layer, and obtain the chip detection result; and to perform anomaly processing on the artificial intelligence chip according to the anomaly level corresponding to the chip detection result.

[0048] The physical detection module is configured to perform anomaly processing on the artificial intelligence chip according to the highest anomaly level when an anomaly exists in the shielding layer.

[0049] The aforementioned anomaly handling method, along with the AI ​​processor, establishes a shielding layer to protect the corresponding security components and performs anomaly detection based on this shielding layer. When the shielding layer is free of anomalies, the security components have not suffered a physical attack, indicating that their detection capabilities are normal under these conditions. The anomaly level can be dynamically adjusted based on the chip detection results of the security components to quantify the degree of anomaly, dynamically handle corresponding needs, ensure accuracy, and perform differentiated anomaly handling based on the anomaly level. When anomalies exist in the shielding layer, it indicates that the security components of the AI ​​chip have suffered a physical attack. Anomaly handling is then performed based on the highest anomaly level to ensure the security of the corresponding chip. Attached Figure Description

[0050] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the drawings used in the description of the embodiments of this application or related technologies will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0051] Figure 1 This is a diagram illustrating the application environment of an exception handling method in one embodiment.

[0052] Figure 2 This is a flowchart illustrating an exception handling method in one embodiment;

[0053] Figure 3 This is a schematic diagram of the shielding layer anomaly detection process in one embodiment;

[0054] Figure 4 This is a flowchart illustrating the security component detection chip in one embodiment;

[0055] Figure 5 This is a circuit diagram for detecting glitch voltage anomalies in one embodiment;

[0056] Figure 6 This is a schematic diagram of the specific process of an exception handling method in one embodiment;

[0057] Figure 7 This is a structural block diagram of an exception handling device in one embodiment;

[0058] Figure 8 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0059] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0060] It should be noted that the terms "first," "second," etc., used in this application may be used to describe various elements or data, but these elements or data are not limited by these terms. These terms are only used to distinguish between the first type of element or data and the second type of element or data. The terms "comprising" and "having," and any variations thereof, used in this application, are intended to cover non-exclusive inclusion. The term "multiple" used in this application refers to two or more. The term "and / or" used in this application refers to one of the embodiments, or any combination of multiple embodiments.

[0061] The exception handling method provided in this application embodiment can be applied to artificial intelligence chips. The artificial intelligence chip can be any one of a GPU (Graphics Processing Unit), TPU (Tensor Processing Unit), NPU (Neural Network Processing Unit), DPU (Deep Learning Processing Unit), APU (Accelerated Processing Unit), and GPGPU (General-Purpose Graphics Processing Unit).

[0062] like Figure 1As shown, taking a GPU as an example, the GPU can be a GPGPU (General-Purpose GPU). The AI ​​chip includes security components. Security components are used to detect anomalies in the AI ​​chip. Each AI chip may include multiple security components. A security component can be, but is not limited to, a sensor, and a processor or security island for processing the sensor's detection results. Sensors can be used to detect various power supplies, including steady-state continuous voltage and spike voltage, to determine if there are voltage anomalies. Sensors can be used to detect cold and hot areas separately. Sensors can be used to detect the clock frequency (FS) of the AI ​​chip to determine if the clock frequency is abnormally high or low. The security island includes a key management module and a security CPU chip for outputting clock signals.

[0063] The safety component is equipped with a shielding layer. This shielding layer is used to detect physical attacks on the safety component; it is located on the outside of the safety component and can detect corresponding physical attacks to prevent damage to the safety component. Optionally, the shielding layer may have a mesh or planar structure, among others. Each safety component can have its own shielding layer, with each layer protecting a smaller area from physical attacks, reducing the risk of accidental activation and ensuring stability. Alternatively, multiple safety components can share a shielding layer to reduce construction difficulty; for example, multiple safety components may share a single shielding layer on their outer sides.

[0064] In one embodiment, one or more security components may be encapsulated on the AI ​​chip substrate, thereby decoupling the security components from the AI ​​chip substrate. In this case, the security component is positioned between its own shielding layer and the AI ​​chip substrate, with the shielding layer located above the security component, meaning it is on the side of the security component furthest from the AI ​​chip. Alternatively, one or more security components may be embedded within the AI ​​chip substrate, making the security component a part of the AI ​​chip substrate. In this case, the area where the security component is located is the security component area within the AI ​​chip substrate, and shielding layers may be provided on both sides of the security component area.

[0065] In some embodiments, such as Figure 2 As shown, an exception handling method is provided, which includes steps 202 to 206. Wherein:

[0066] Step 202: Determine if there is any abnormality in the shielding layer.

[0067] An anomaly in the shielding layer indicates that it has been subjected to a physical attack. If a physical attack is detected, the shielding layer is confirmed to be abnormal; if no physical attack is detected, the shielding layer is not abnormal. A physical attack can be a probe attack.

[0068] In some embodiments, when the shielding layer supports signal transmission, the presence of an anomaly in the shielding layer can be determined by the signal transmitted by the shielding layer itself, thus balancing detection efficiency and the space occupied by the shielding layer, thereby reducing the impact of the shielding layer on the area of ​​the artificial intelligence chip. Specifically, when the shielding layer is a conductor, it supports the transmission of electrical signals. If the transmission of these electrical signals is interrupted, it can be determined that the shielding layer is abnormal; otherwise, the shielding layer is not abnormal.

[0069] In some embodiments, when the shielding layer does not support signal transmission, a pressure sensor or deformation sensor can be installed on the shielding layer to determine whether there is an abnormality in the shielding layer, thereby reducing the structural complexity of the shielding layer and reducing the construction difficulty of the shielding layer.

[0070] Step 204: If there is no abnormality in the shielding layer, perform anomaly detection on the AI ​​chip based on the security component to obtain the chip detection result; and perform anomaly handling on the AI ​​chip according to the anomaly level corresponding to the chip detection result.

[0071] Chip detection results are anomaly detection results obtained by security components based on their own logic. Security components can be security islands or sensors; chip detection results can be determined by the security island based on sensor values, or by the individual sensor values ​​of each sensor. When an AI chip has multiple sensors, detection can be performed separately by each sensor to obtain individual chip detection results, forming a multi-dimensional chip detection result; alternatively, the individual chip detection results from each sensor can be weighted and mapped to obtain a comprehensive chip detection result.

[0072] Anomaly levels represent the different levels of anomaly handling methods employed by AI chips. Anomaly levels can be represented by different cumulative anomaly thresholds and the intervals defined by these thresholds, or by different confidence levels. Different anomaly levels can correspond to different types of handling methods. For example, confidence levels can be determined by using different cumulative anomaly thresholds and the intervals defined by them, and then different types of handling methods can be determined based on these confidence levels.

[0073] In some embodiments, detection is performed based on the region where each sensor is located to obtain sensor values; each sensor value is compared with its respective threshold to obtain a comparison result; and the comparison result is mapped to obtain the chip detection result. Each sensor includes one or more of a temperature sensor, a voltage sensor, and a clock frequency sensor.

[0074] In some embodiments, the detection results of each chip are mapped to obtain a mapping result with an anomaly level; an anomaly handling method is determined based on the mapping result with the anomaly level, and anomaly handling is performed on the artificial intelligence chip according to the anomaly handling method.

[0075] Because the security components can meticulously detect anomalies in AI chips, different anomaly levels can be applied to handle different anomalies, allowing for a more accurate assessment of AI chip abnormalities. Furthermore, each security component can be used to specifically detect the type of anomaly in the AI ​​chip based on its individual function. Using multiple security components can generate multi-dimensional chip detection results, leading to even more accurate detection of AI chip anomalies.

[0076] Step 206: If there is an anomaly in the shielding layer, perform anomaly processing on the artificial intelligence chip according to the highest anomaly level.

[0077] When the shielding layer is breached, it indicates that the AI ​​chip has suffered malicious damage to its security components, thus triggering the highest level of anomaly handling. Optionally, the highest level of anomaly can be used to disable the AI ​​chip to protect the data within it.

[0078] In some embodiments, when an anomaly exists in the shielding layer, the AI ​​chip is subjected to anomaly handling according to the anomaly handling method representing the highest anomaly level. Thus, the anomaly handling of the AI ​​chip is directly executed using the anomaly handling method.

[0079] In one embodiment, when an anomaly occurs in the shielding layer, a highest confidence level is determined. Based on the anomaly handling method corresponding to the highest confidence level, the AI ​​chip is subjected to anomaly handling. Thus, using the confidence level as intermediate data, the anomaly handling of the AI ​​chip is controlled, forming a specific and verifiable hierarchical protection system. For example, the data key of the AI ​​chip can be deleted, making the AI ​​chip's data unreadable; alternatively, all data in the AI ​​chip can be formatted, making the AI ​​chip's data unreadable. In the case of key deletion, the AI ​​chip is then logically reset to clear a smaller amount of data while ensuring security.

[0080] In the above anomaly handling method, a shielding layer is set to protect the corresponding security components, and anomaly detection is performed based on the shielding layer. When there is no anomaly in the shielding layer, the security components have not suffered a physical attack, indicating that the detection capability of the security components in this environment is normal. The anomaly level can be dynamically adjusted based on the chip detection results of the security components to quantify the degree of anomaly, dynamically handle corresponding needs, ensure accuracy, and perform differentiated anomaly handling based on the anomaly level. When there is an anomaly in the shielding layer, it indicates that the security components of the artificial intelligence chip have suffered a physical attack. Anomaly handling is performed based on the highest anomaly level to ensure the security of the corresponding chip.

[0081] In some embodiments, the shielding layer includes a wire mesh for transmitting shielding layer signals. The area of ​​the wire mesh is greater than or equal to the area of ​​the security component to determine physical attacks suffered by the security component at different locations. Using the wire mesh enables directional transmission of shielding layer signals, allowing monitoring of shielding layer anomalies through the signal conduction capability of the wire mesh itself. The wire mesh comprises multiple wires arranged in a mesh pattern, allowing directional transmission of corresponding shielding layer signals. The shielding layer signal is an electrical signal used to detect the presence of the shielding layer chip. The shielding layer signal can be transmitted periodically to determine whether anomalies exist in the shielding layer during each period; the period can be the clock cycle of the artificial intelligence chip or an externally input cycle.

[0082] Correspondingly, such as Figure 3 As shown, determining whether there is an anomaly in the shielding layer includes:

[0083] Step 302: Determine if the shielding layer signal exists.

[0084] In some embodiments, the presence of the shielding signal can be determined according to a preset period or time interval; the presence of the shielding signal can also be detected at the receiving end of the wire mesh or shielding signal. Specifically, the shielding signal can be detected in each clock cycle to determine whether the shielding signal exists in each clock cycle.

[0085] In some embodiments, when the shielding layer signal represents target data, if the target data is parsed from the shielding layer signal, then the shielding layer signal exists; otherwise, the shielding layer signal does not exist. When multiple shielding layer signals are used, if the data parsed from the multiple shielding layer signals is not the target data, then it is determined that the shielding layer signal does not exist.

[0086] Step 304: If a shielding layer signal is present, then there is no abnormality in the shielding layer.

[0087] In some embodiments, when the directional shielding signal is transmitted separately through each conductor, and each conductor transmits its own shielding signal, it can be determined that the shielding layer is not abnormal. When multiple conductors in a conductor network form a signal path, the shielding signal can be transmitted jointly through this signal path. In this case, if one conductor is disconnected but the signal path remains open, the signal in that signal path still exists.

[0088] If a shielding layer signal is present, the signal transmission function of the wire network is relatively normal. It may be affected by slight deformation or circuit interference due to environmental factors, which may cause fluctuations in the shielding layer signal. In this case, there is no need to determine whether there is an abnormality in the shielding layer.

[0089] Step 306: If there is no shielding signal, then there is an anomaly in the shielding layer.

[0090] In some embodiments, when the directional shielding signal is transmitted separately through each conductor, the shielding signal of that conductor is absent when any conductor malfunctions, thereby increasing accuracy. When multiple conductors in a conductor network form a signal path, the shielding signal can be transmitted jointly through this signal path. In this case, if one conductor breaks but the signal path remains open, the signal of that signal path still exists until the number of broken conductors causes the signal path to be completely broken, at which point the shielding signal of that signal path is absent.

[0091] In an exemplary embodiment, the wire mesh is a metal wire mesh set in the artificial intelligence chip. The side of the metal wire mesh close to the substrate of the artificial intelligence chip is a security component protected by the metal wire mesh, and the side of the metal wire mesh away from the substrate of the artificial intelligence chip is used to detect physical attacks, such as probes. When a probe touches the metal wire mesh, the shielding signal transmitted by the wire mesh will disappear, thereby identifying the corresponding anomaly.

[0092] In this embodiment, since both the AI ​​chip and the security components are based on wire-connected devices, similar to a wire mesh, the difficulty of identifying the wire mesh as a shielding layer can be reduced, thus facilitating more accurate detection of physical attacks and ensuring the security of the AI ​​chip. Through the signal transmission capabilities of the wire mesh itself, it can detect whether it is experiencing anomalies, forming a sensor specific to the wire mesh itself for more accurate detection of physical attacks.

[0093] In some embodiments, the artificial intelligence chip includes a signal transmitting end and a signal receiving end of a wire mesh. The signal transmitting end is a chip structure for generating and transmitting shielding layer signals, and the signal receiving end is a chip structure for receiving shielding layer signals; the signal transmitting end and the signal receiving end are respectively connected to the wire mesh to form a signal path. Optionally, the signal transmitting end and the signal receiving end respectively detect both ends of the wire mesh to form a shielding layer signal between the two ends; multiple signal transmitting ends and signal receiving ends are used to detect the signals transmitted by multiple wires of the wire mesh individually, or to detect the signal path of the wire mesh, to form an overall detection of the wire mesh.

[0094] Correspondingly, determining whether a shielding signal exists includes: when a shielding signal is randomly generated at the signal transmitting end and sent to the signal receiving end through a wire network, determining whether the signal receiving end receives the shielding signal; if the shielding signal is received, then a shielding signal exists; if the shielding signal is not received, then a shielding signal does not exist.

[0095] In some embodiments, the signal transmitter generates a shielding layer signal for each cycle according to a random rule, and transmits the shielding layer signal for each cycle to the signal receiver through a wire network. For example, the signal generated by the signal transmitter is an excitation signal, which can be randomly generated 0 or 1, or a combination of 0 and 1. In the current cycle, if the signal receiver detects that the excitation signal is normal, then a shielding layer signal exists, no physical attack is detected, and the device can be used normally. If the signal receiver detects that the excitation signal is disconnected, then a shielding layer signal does not exist, and a physical attack is detected.

[0096] In some embodiments, the signal transmitter and the signal receiver have a first path and a second path, which are two types of paths between the signal transmitter and the signal receiver. The first path is a wire mesh. When the signal transmitter randomly generates a shielding signal and sends it to the signal receiver through the wire mesh, the shielding signal transmitted to the signal receiver by the wire mesh is the shielding signal transmitted through the first path. The shielding signal transmitted through the first path is compared with the shielding signal transmitted through the second path. If they match, it is determined that the signal receiver has received the shielding signal through the wire mesh, no physical attack has been detected, and it can be used normally. If they do not match, there is no shielding signal transmitted through the first path, and a physical attack has been detected.

[0097] In this embodiment, a signal transmitting end and a receiving end are set up for the wire mesh to form a shielding signal path for the wire mesh, which helps to detect more accurately whether the wire mesh has been subjected to physical attacks. Since the shielding signal is randomly generated by the signal transmitting end, it is inherently random and not easily simulated or detected, which helps to identify physical attacks more accurately.

[0098] In some embodiments, the spacing between the conductors in the wiring network is consistent with the wiring spacing of the safety components.

[0099] The conductor spacing in a wire mesh refers to the distance between multiple conductors within the mesh. Wiring spacing serves as a reference value for the distance between lines in a security component, representing the conductor spacing of each component within the security component. This ensures that the security component's signals can be transmitted normally without interference between the conductors of different components. When the conductor spacing in the wire mesh matches the wiring spacing, the wiring structure of the wire mesh and the security component becomes more similar. Furthermore, because the wire mesh also has a corresponding shielding layer, it becomes difficult for a physical attacker's microscope and sensors to distinguish between the wire mesh and the security component, thus increasing the difficulty of destroying the wire mesh.

[0100] In some embodiments, when the wire spacing in the wiring network is exactly equal to the wiring spacing of the safety component, the wire spacing in the wiring network is consistent with the wiring spacing of the safety component; when the wire spacing in the wiring network is less than a preset value, the wire spacing in the wiring network is consistent with the wiring spacing of the safety component.

[0101] In some embodiments, the AI ​​chip includes multiple security components, each with its own wiring spacing; each security component has its own wire mesh on its outer side, and the wire spacing of each wire mesh is consistent with the wiring spacing of the security component detected by that wire mesh. For example, a security component includes a security island, and the wire mesh outside the security island includes a security island wire mesh, the wire spacing in the security island wire mesh being consistent with the wiring spacing of the security island; a security component includes a sensor, and the wire mesh outside the sensor includes a sensor wire mesh, the wire spacing in the sensor wire mesh being consistent with the wiring spacing of that sensor, and various sensors may have their own wiring spacing.

[0102] In this embodiment, since the spacing between multiple wires is consistent with the wiring spacing of the security component, it is difficult to distinguish the structure of the wire mesh and the security component even through a microscope, which increases the difficulty of the wire mesh being damaged and helps to more accurately detect whether there is a physical attack.

[0103] In some embodiments, such as Figure 4 As shown, the security component includes multiple sensors. Based on the security component, anomaly detection is performed on the AI ​​chip to obtain chip detection results, including steps 402 and 404; correspondingly, based on the anomaly level corresponding to the chip detection results, anomaly processing is performed on the AI ​​chip, including steps 406 and 408; wherein:

[0104] Step 402: Based on the sensor values ​​obtained from multiple sensors, perform anomaly detection on the artificial intelligence chip to obtain the chip detection results of each sensor.

[0105] Multiple sensors support data acquisition, and the acquired data can be used as individual sensor values ​​for each sensor. When multiple sensors of the same type exist, the chip detection results of each sensor can be determined based on the individual sensor values ​​of each sensor of the same type.

[0106] The chip detection results for each sensor are obtained based on the sensor values ​​of each sensor, which are implemented by the sensors themselves. Optionally, the chip detection results for each sensor can be determined based on their individual sensor values. When multiple sensors of the same type exist, multiple chip detection results of the same type can be obtained based on the individual sensor values ​​of each sensor of the same type, so that each sensor of the same type has its own chip detection result.

[0107] In some embodiments, the plurality of sensors include at least one of a temperature sensor, a voltage sensor, and a frequency sensor; correspondingly, the detection results of the plurality of sensors include at least one of a temperature detection result, a voltage detection result, and a clock frequency detection result.

[0108] In one embodiment, sensor values ​​acquired by a sensor of the same type are compared with a threshold value for that type of sensor to obtain a sensor value comparison result. This sensor value comparison result can be used as the chip detection result, or it can be based on the anomaly coefficient corresponding to the sensor value comparison result. For example, if the frequency value acquired by the frequency sensor is between a first frequency threshold and a second frequency threshold, the chip detection result of the frequency sensor indicates that the artificial intelligence chip is not abnormal; if the frequency value acquired by the frequency sensor is less than the first frequency threshold, or if the frequency value acquired by the frequency sensor is greater than the second frequency threshold, the chip detection result of the frequency sensor indicates that the artificial intelligence chip is abnormal.

[0109] Step 404: Based on the chip detection results indicating anomalies in the artificial intelligence chip, determine the cumulative value of the anomaly results corresponding to each sensor.

[0110] The chip detection results indicating anomalies in artificial intelligence chips are determined based on each type of sensor to identify the anomaly corresponding to that type of sensor. When multiple sensors exist for each type, multiple chip detection results of the same type can represent chip detection results for different regions to form a refined chip detection result.

[0111] The cumulative anomaly result value is a statistical value of chip detection results indicating anomalies in the AI ​​chip. The cumulative anomaly result value for each sensor can be obtained based on the chip detection results for each sensor, reducing the overall data volume. When multiple sensors exist for a given type, the chip detection result for each sensor of that type at its respective location can be determined based on the chip detection result for that location. The corresponding cumulative anomaly result value is then obtained based on the chip detection result at that location. In this case, the cumulative anomaly result value corresponds to each sensor. When the chip detection result for each sensor indicates an anomaly in the AI ​​chip, the cumulative anomaly result value for each sensor can be obtained.

[0112] Optionally, the cumulative value of abnormal results can be the number of abnormalities or the frequency of abnormalities. The number of abnormalities is the cumulative number of times the AI ​​chip has experienced abnormalities, as indicated by the sensor's chip detection results, since the AI ​​chip started running. The frequency of abnormalities is the cumulative number of times the AI ​​chip has experienced abnormalities, as indicated by the sensor's chip detection results, within a preset time period.

[0113] In some embodiments, since the chip detection results are obtained from the sensor, there is no need to rely on external firmware polling. An abnormal signal can be triggered when the normal operating range is exceeded to notify the safety island. The cumulative value of the abnormal results can be efficiently determined so as to respond to interrupts in real time and improve the efficiency of abnormal handling.

[0114] Step 406: Obtain the cumulative anomaly threshold for each sensor.

[0115] The anomaly accumulation threshold is a benchmark value for the degree of anomaly accumulation for each sensor. When the anomaly accumulation value of a sensor is accumulated according to the type of sensor, the anomaly accumulation threshold is determined according to the anomaly accumulation threshold of the same type of sensor; when the anomaly accumulation value of a sensor is accumulated according to the number of sensors, the anomaly accumulation threshold is determined according to the anomaly accumulation threshold of each individual sensor. There can be multiple anomaly accumulation thresholds; every two anomaly accumulation thresholds form an anomaly accumulation interval, and each anomaly accumulation interval is a comparison result.

[0116] In some embodiments, the cumulative anomaly threshold for each sensor can be determined based on the type of sensor or the location of the sensor. For example, the cumulative anomaly threshold for a frequency sensor can be determined based on a frequency sensor; the cumulative anomaly threshold for a cold spot region can be determined based on a temperature sensor in the cold spot region.

[0117] Step 408: Determine the comparison results between the cumulative value of each abnormal result and the cumulative threshold of each abnormality, and perform abnormal processing on the artificial intelligence chip according to the abnormality level corresponding to the comparison results.

[0118] The comparison result represents the relative magnitude between the cumulative value of abnormal results and the cumulative threshold for abnormal results. When the cumulative value of abnormal results and the cumulative threshold for abnormal results are determined according to the type of sensor, the comparison result is the comparison result for that type. When the cumulative value of abnormal results and the cumulative threshold for abnormal results are determined according to the number of sensors, the comparison result is the comparison result for each sensor.

[0119] In some embodiments, the comparison result is the interval where the cumulative values ​​of each abnormal result lie. Different intervals correspond to different abnormal levels, and different methods can be used for abnormal handling. Taking a frequency sensor as an example, when the cumulative value of the abnormal result of the frequency is less than a certain cumulative abnormal threshold of the frequency, one abnormal level is used to handle the abnormality of the artificial intelligence chip; when the cumulative value of the abnormal result of the frequency is greater than this cumulative abnormal threshold of the frequency, another abnormal level is used to handle the abnormality of the artificial intelligence chip.

[0120] In this embodiment, detection is performed using multiple sensors, forming a multi-dimensional detection system. Anomaly detection is conducted on the AI ​​chip based on the sensor values ​​acquired by these sensors, yielding chip detection results for each sensor. Based on these chip detection results, which indicate anomalies in the AI ​​chip, the cumulative anomaly value for each sensor is determined. Therefore, without relying on external firmware polling of the sensors, the chip detection results and cumulative anomaly values ​​are efficiently determined, facilitating real-time interrupt response and improving anomaly handling efficiency. Since occasional anomalies may be caused by environmental fluctuations and do not require processing to avoid affecting the normal operation of the AI ​​chip, while frequent anomalies require urgent attention, the cumulative anomaly thresholds for each sensor are obtained. The comparison results between the cumulative anomaly values ​​and these thresholds are then determined, and the AI ​​chip is processed according to the anomaly level corresponding to the comparison results, resulting in differentiated processing methods.

[0121] In some embodiments, obtaining the cumulative threshold for each sensor includes: calculating the number of sensor types that detect chip anomalies based on chip detection results that indicate anomalies in the artificial intelligence chip; determining the cumulative threshold for anomalies based on the number of sensor types; and the number of sensor types being negatively correlated with the cumulative threshold for anomalies.

[0122] The number of sensor types indicating chip anomalies represents the number of anomaly dimensions present in the chip. A larger number of sensor types indicates more dimensions of anomalies in the AI ​​chip, resulting in a lower cumulative threshold for each anomaly; conversely, a smaller number of sensor types indicates fewer dimensions of anomalies, resulting in a higher cumulative threshold for each anomaly. Optionally, both the number of sensor types indicating chip anomalies and the cumulative anomaly result are determined based on the chip detection results indicating AI chip anomalies. These can be determined by the same module or by different modules.

[0123] In some embodiments, within a preset time period, the chip detection results indicating anomalies in the artificial intelligence chip are statistically analyzed according to the sensor type to obtain the number of sensor types indicating chip anomalies; the number of sensor types is then mapped to a mapping table to obtain the cumulative threshold of anomalies that is negatively correlated with the number of sensor types.

[0124] In one embodiment, if the chip detection results indicating an abnormality of the AI ​​chip include temperature detection results, and the other chip detection results indicate that the AI ​​chip is not abnormal, it may be due to a special environment, and a basic abnormality accumulation threshold is used. If the chip detection results indicating an abnormality of the AI ​​chip include both temperature detection results and voltage detection results, the environment is more severe, and the abnormality accumulation threshold will be lowered, making it easier to trigger the processing methods corresponding to higher abnormality levels.

[0125] In this embodiment, the corresponding cumulative anomaly threshold is dynamically adjusted based on the number of sensor types that indicate anomalies in the AI ​​chip. Since the number of sensor types is negatively correlated with the cumulative anomaly threshold, when the number of sensor types that indicate anomalies in the AI ​​chip is small, a larger cumulative anomaly value is needed to obtain a higher anomaly level, ensuring the normal operation of the AI ​​chip. When the number of sensor types that indicate anomalies in the AI ​​chip is large, a higher anomaly level can be determined more quickly, and timely response measures can be taken to ensure processing efficiency and chip safety.

[0126] In some embodiments, anomaly processing is performed on the AI ​​chip according to the anomaly level corresponding to the comparison result, including: updating the cumulative value of the anomaly result when the comparison result corresponds to a first anomaly probability; updating the cumulative value of the anomaly result and performing a logical reset on the AI ​​chip when the comparison result corresponds to a second anomaly probability; and clearing the data of the AI ​​chip when the comparison result corresponds to a third anomaly probability; wherein the first anomaly probability, the second anomaly probability, and the third anomaly probability increase sequentially, representing anomaly levels that increase sequentially.

[0127] The first anomaly probability indicates a low confidence level in the occurrence of the anomaly, suggesting that the anomaly is triggered occasionally. In this case, it is highly likely that the anomaly is caused by fluctuations in the surrounding environment. The cumulative value of the anomaly results can be updated to avoid affecting the normal operation of the artificial intelligence chip. Updating the cumulative value of the anomaly results means executing step 404 to increase the cumulative value of the anomaly results based on the newly occurring anomaly, thus obtaining the updated cumulative value of the anomaly results.

[0128] The second anomaly probability indicates a potentially high confidence level in the occurrence of an anomaly, with a high frequency of anomalies. This suggests an abnormality in the AI ​​chip's operational logic, while environmental fluctuations are less likely to cause the anomaly. In this case, a logic reset of the AI ​​chip is necessary to overcome the anomalies within its built-in logic. The accumulated anomaly result value is then continuously updated to determine if the AI ​​chip is in a highly abnormal situation. A logic reset refers to either resetting the AI ​​chip or requesting a power-off from the power management chip. After the AI ​​chip is powered off, the power management chip will then re-energize it according to its own logic.

[0129] The third anomaly probability represents the highest confidence level in the occurrence of an anomaly. At this point, the anomaly frequency is too high, indicating that the AI ​​chip's operating logic is unrecoverable or that there is a malicious attack from the external environment. To prevent data leakage from the AI ​​chip, data erasure is performed to avoid leakage of the chip's built-in logic. Optionally, the AI ​​chip's key can be deleted to achieve data erasure while ensuring processing efficiency; alternatively, all data on the AI ​​chip can be erased to improve security. In the case of key deletion, the AI ​​chip's logic can be reset to erase a smaller amount of data while ensuring security.

[0130] In some embodiments, if the cumulative value of each abnormal result is less than the first abnormal cumulative threshold corresponding to the cumulative value of each abnormal result, the comparison result corresponds to the first abnormal probability, and the cumulative value of the abnormal result can be updated; if there is an abnormal result cumulative value of any kind between the first abnormal cumulative threshold and the second abnormal cumulative threshold, the comparison result corresponds to the second abnormal probability, and the AI ​​chip can be logically reset; if there is an abnormal result cumulative value of any kind between the second abnormal cumulative threshold and the third abnormal cumulative threshold, the comparison result corresponds to the third abnormal probability, and the AI ​​chip can be data cleared; the first abnormal threshold, the second abnormal threshold, and the third abnormal threshold corresponding to the same abnormal value increase sequentially.

[0131] In some embodiments, the number of alarms triggered by an anomaly can be determined within a preset time period; if it is triggered occasionally, it may be caused by fluctuations in the surrounding environment, which is a low confidence level; if it is triggered frequently, it is a continuous alarm, which is a high confidence level; the difference between medium confidence and high confidence lies in the range of the number of anomalies.

[0132] In this embodiment, different processing methods are formulated based on different comparison results to correspond to different anomaly probabilities. When the anomaly probability is low, the corresponding cumulative anomaly result value can be updated without performing logic resets to avoid affecting the normal operation of the AI ​​chip. When the anomaly probability is high, the cumulative anomaly result value can be updated, and a logic reset can be performed to overcome logical problems affecting the normal operation of the AI ​​chip. When the anomaly probability is highest, the data within the AI ​​chip is cleared to prevent data leakage. This forms a multi-level protection and response mechanism, ensuring the security of the AI ​​chip while minimizing disruption to its normal operation.

[0133] In some embodiments, based on a security component, anomaly detection is performed on the artificial intelligence chip to obtain a chip detection result, including: acquiring the power supply voltage of the artificial intelligence chip; dividing the power supply voltage to obtain a voltage after voltage division; acquiring a glitch voltage threshold corresponding to a reference voltage; determining a voltage comparison result between the voltage after voltage division and the glitch voltage threshold; performing bilateral sampling on the voltage comparison result according to a clock signal to obtain a sampled value of the voltage comparison result; the frequency of the clock signal is negatively correlated with the delay of glitch voltage detection; and determining the glitch voltage detection result of the artificial intelligence chip based on the sampled value.

[0134] The voltage after voltage division is the voltage obtained by dividing the power supply voltage. Since the voltage after voltage division is less than the power supply voltage, it becomes a signal that reflects voltage spikes. The reference voltage is a preset voltage value output by a reference voltage circuit. The reference voltage can be a bandgap voltage, which can be obtained by combining voltages with opposite characteristics to environmental factors in a specific ratio to reduce the influence of the environment on the reference voltage. Optionally, since the power supply voltage of the artificial intelligence chip has a large range of spike widths, possibly ranging from 10 nanoseconds (ns) to 1.5 microseconds (μs), a wide range is achieved by power supply voltage division to obtain VDD / K; VDD is the undivided voltage, and K is the divisor used for voltage division. If only resistor voltage division is used, the narrow spike width will be filtered out. In this case, capacitor voltage division is needed to divide the narrow spikes to obtain the voltage after voltage division.

[0135] The glitch voltage threshold is a voltage mapped from a reference voltage. The reference voltage can be converted to the glitch voltage threshold using a corresponding circuit. Optionally, multiple reference voltage levels can be selected or mapped using the same circuit to obtain the corresponding glitch voltage threshold. The voltage comparison result is a comparison between the voltage after voltage division and the glitch voltage threshold. A corresponding comparator compares the voltage after voltage division with the glitch voltage threshold to obtain the voltage comparison result. The reference voltage can be a calibrated reference voltage (Bandgap trimming), which can be 0.45 volts (V). The threshold voltage level has 6 bits, and the glitch voltage threshold can be adjusted as needed.

[0136] A clock signal is a signal that alternates between high and low levels. By controlling these alternating high and low levels, the sampling process for voltage comparison results can be controlled, allowing for a more accurate determination of which moments yield usable voltage comparison results. Bilateral sampling refers to sampling at both the rising and falling edges of the clock signal, obtaining the voltage comparison result based on these two samplings. The falling edge stage is the transition from high to low level, and the rising edge stage is the transition from low to high level. Since the clock signal is periodic, bilateral sampling can be performed based on clock signals within the same period. Because the edges of the clock signal are unknown, the clock signal frequency can be increased to reduce delay. The clock signal frequency represents the frequency of high-low level alternation and is negatively correlated with the delay in glitch voltage detection.

[0137] Based on this, bilateral sampling can control the corresponding error accuracy. Optionally, the accuracy of the delay unit can be determined based on the ratio of half the clock cycle length of the clock signal to the frequency of the clock signal, that is, 1 / (2*fckK), where 1 / 2 is the half clock cycle length of the clock signal and fckK is the frequency of the clock signal. For example, to achieve a 10-nanosecond (ns) delay, the frequency of the clock signal is selected as 400 MHz (M), and its clock cycle (Td) is 2.5 nanoseconds. After 4 delays, the total delay time is 10 nanoseconds, and the error accuracy of 10 nanoseconds is ±1.25 nanoseconds, that is, between 11.25 nanoseconds and 8.75 nanoseconds. Comparator errors and clock offsets will occur, so the corresponding delay error accuracy is controlled based on the voltage comparison results during sampling. The glitch voltage detection result indicates whether there is an abnormal glitch voltage in the power supply. This can be achieved by comparing the sampled value with a threshold value based on a latch to determine whether the glitch voltage is abnormal, thus obtaining a chip detection result indicating an anomaly in the artificial intelligence chip.

[0138] In one exemplary embodiment, such as Figure 5As shown, a reference signal is input to a glitch voltage threshold conversion circuit. The output of the glitch voltage threshold conversion circuit is connected to the first input of a comparator, so that the glitch voltage threshold is input to the comparator. A power supply is input to a voltage divider circuit, and the output of the voltage divider circuit is connected to the second input of the comparator, so that the divided voltage is input to the comparator. The output of the comparator is connected to a delay module, and a clock signal is also input to the delay module to perform bilateral sampling of the voltage comparison result output by the comparator, thereby obtaining the sampled value of the voltage comparison result. The sampled value of the voltage comparison result is the output result of the glitch voltage, which can be stored in a latch to obtain the corresponding chip detection result.

[0139] In this embodiment, because the power supply voltage of the AI ​​chip has a large range of timing glitches, a voltage divider is used to narrow this range, preventing it from being filtered out and allowing it to be compared with the AI ​​chip's glitch voltage threshold. To more accurately detect whether the voltage comparison result of the glitches is abnormal, bilateral sampling is performed on the voltage comparison result to obtain sampled values, thereby increasing accuracy. Furthermore, since the frequency of the clock signal is negatively correlated with the delay in glitch voltage detection, the bilateral sampling process of the AI ​​chip is controlled by the clock signal to control the response time of the glitches, enabling more timely detection of any abnormalities in the AI ​​chip. Thus, both the accuracy and timeliness of glitch voltage detection in the AI ​​chip are considered, and the timeliness is adjustable as needed, increasing the chip's reliability.

[0140] In some embodiments, the chip detection results include at least one of temperature detection results, voltage detection results, and clock frequency detection results; wherein the temperature detection results are generated based on the respective temperature thresholds and temperature values ​​of each region of the artificial intelligence chip; the voltage detection results include at least one of the continuous power supply voltage detection results and glitch voltage detection results of the artificial intelligence chip; and the clock frequency detection results include the reference clock frequency detection results of the artificial intelligence chip.

[0141] The temperature detection results include the chip detection results of the temperature sensors in each region of the AI ​​chip, which are generated based on the temperature threshold of each region; the voltage detection results include at least one of the continuous power supply voltage detection results of the AI ​​chip at the power source and the chip detection results of the glitch voltage sensor; and the clock frequency detection results include the reference clock frequency detection results of the AI ​​chip.

[0142] The temperature detection result is obtained by comparing the regional temperature values ​​detected by the temperature sensors with the corresponding temperature thresholds for each region. Each temperature sensor detects the temperature based on its own region's temperature threshold. Optionally, each region includes cold spot regions and hot spot regions. Cold spot regions and hot spot regions use their respective thresholds for temperature detection, forming their own temperature detection results. The temperature threshold for cold spot regions is lower than that for hot spot regions. Therefore, when the AI ​​chip is cooled down, the chip detection results for cold spot regions can be determined more accurately; when the AI ​​chip is heated up, the chip detection results for hot spot regions can be determined more accurately. Optionally, based on thermal simulation processing, the corresponding temperature sensors and corresponding temperature thresholds for each region can be determined to form a temperature detection method according to the temperature change patterns of the sensors, ensuring temperature accuracy.

[0143] The voltage detection results are the power supply voltage detection results of the artificial intelligence chip. These results include continuous power supply voltage detection results and glitches / spurious voltage detection results. The continuous power supply voltage detection result is based on voltage detection results where the duration exceeds a preset value. Both the continuous power supply voltage detection result and the glitches / spurious voltage sensor chip detection results show corresponding excessively high or low voltage. The continuous power supply voltage detection result can be determined by comparing the detected continuous power supply voltage with the continuous power supply voltage threshold; similarly, the glitches / spurious voltage detection result can be determined by comparing the detected glitches / spurious voltage with the glitches / spurious voltage threshold.

[0144] The clock frequency detection result is the anomaly detection result at the reference clock of the artificial intelligence chip; the clock frequency detection result is the detection result for the crystal oscillator frequency detection. If it is within the normal frequency range, there is no anomaly; if it is not within the abnormal frequency range, there is an anomaly.

[0145] In one embodiment, if there is an abnormal temperature rise, the sensor at the hot spot area of ​​the AI ​​chip will respond first, identify the high temperature attack, trigger a high temperature alarm, and the safety island will provide a tiered response; if there is an abnormal temperature drop, the sensor at the cold spot area of ​​the AI ​​chip will respond first, identify the low temperature attack, trigger a low temperature alarm, and the safety island will provide a tiered response; if the voltage detection result indicates a voltage anomaly, the voltage sensor at the power input of the AI ​​chip will trigger a corresponding alarm, and the safety island will provide a tiered response; if the reference clock frequency is incorrect, the frequency sensor at the reference clock of the AI ​​chip will trigger a frequency anomaly alarm, and the safety island will provide a tiered response.

[0146] In this embodiment, the monitoring items are diversified, and different temperature thresholds are used to identify the corresponding chip detection results in different areas. This adapts to the temperature variation patterns of the artificial intelligence chip in different areas, improving response speed. Thus, multi-dimensional real-time detection and graded protection against temperature attacks, voltage glitches, continuous voltage attacks, and clock attacks are achieved.

[0147] In some embodiments, such as Figure 6 As shown, this application provides a security detection method for artificial intelligence chips, including:

[0148] Step 601: Determine the temperature detection results of each region of the artificial intelligence chip at different temperatures.

[0149] Each region includes cold spot regions and hot spot regions. The cold spot regions and hot spot regions use their own thresholds for temperature detection, and generate their own temperature detection results.

[0150] Step 602: Determine the continuous detection result of the power supply voltage of the artificial intelligence chip, and determine the glitch voltage detection result of the power supply voltage of the artificial intelligence chip.

[0151] The process of determining the glitch voltage detection result of the power supply voltage of the AI ​​chip includes: acquiring the power supply voltage of the AI ​​chip, dividing the power supply voltage to obtain the divided voltage; acquiring the glitch detection reference voltage of the target level, and generating a voltage threshold based on the glitch detection reference voltage; comparing the voltage between the divided voltage and the voltage threshold; performing bilateral sampling on the voltage comparison result according to the clock signal to obtain the sampled value of the voltage comparison result; and determining whether a glitch voltage has occurred based on the detection result of the sampled value by the latch; wherein the frequency of the clock signal is negatively correlated with the delay of the glitch voltage detection.

[0152] Step 603: Determine the frequency detection result based on the frequency sensor deployed at the reference clock.

[0153] Among them, the detection results of steps 601-603 are all different types of chip detection results. The chip detection results are obtained by replacing firmware polling with an interrupt response mechanism based on hardware alarm threshold. Once the preset working range is exceeded, an interrupt is triggered and reported to the safety island in real time to obtain chip detection results indicating abnormality of the artificial intelligence chip.

[0154] Step 604: Determine the physical attack detection result based on the shielding layer sensor of the security component.

[0155] The security components include sensors for temperature, voltage, or frequency detection, and at least one of these components within the security island. Physical attack detection results include whether there are any anomalies in the shielding layer.

[0156] Step 605: If the physical attack detection results indicate that the artificial intelligence chip is abnormal, identify the high-confidence anomaly.

[0157] The metal wires are distributed across the safety island and other safety components such as sensors to ensure detection capability. These metal wires form a wire mesh, with the spacing between each wire matching the wiring spacing of the safety components within the mesh's protected area. For example, the spacing between the metal wires is equal to the wiring spacing of the power supply to prevent external visibility of the structure; in this case, some electron microscopes cannot see the mesh. Within the same clock cycle, the excitation signal is a randomly generated 0 or 1 from the generator. If the excitation signal is interrupted from the generator to the receiver, a physical attack is detected.

[0158] Step 606: If a chip detection result indicating an abnormality of the artificial intelligence chip is detected, an abnormality count threshold is determined based on the type of chip detection result indicating an abnormality of the artificial intelligence chip.

[0159] Among them, the types of chip detection results are negatively correlated with the size of the anomaly count threshold; the smaller the anomaly count threshold, the easier it is to trigger a higher anomaly confidence level.

[0160] Step 607: Determine the anomaly confidence level based on the comparison between the number of abnormal triggers and the anomaly threshold for each type of chip detection result; and perform security processing based on the anomaly confidence level.

[0161] Among them, the anomaly confidence level includes high confidence anomaly, medium confidence anomaly and low confidence anomaly;

[0162] If the anomaly is of low confidence level, update the corresponding anomaly count without further processing, as it may be due to environmental fluctuations.

[0163] If the anomaly is of medium confidence level, the AI ​​chip will be reset or request the power management chip to power off and then power on again.

[0164] If a high confidence level is abnormal, the security keys will be cleared first. After these keys are cleared, the AI ​​chip will be unusable.

[0165] Based on this, more granular attacks can be detected, reducing the likelihood of real attacks being ignored by the SoC. For example, attackers can launch attacks through minute temperature or voltage fluctuations, which the SoC will not detect at all. Moreover, due to the high accuracy of glitches in voltage detection, even if attackers seize the opportunity to launch a tidal attack, key leakage is unlikely. Furthermore, due to the graded control of anomalies, it effectively distinguishes between normal fluctuations and malicious attacks. When the temperature alarm can only obtain the temperature of a local area in the circuit, it will not shut down the power simply because the temperature exceeds the threshold once. If the temperature rises briefly during normal operation but can be quickly dissipated and recovered, it will not be mistakenly identified as an overheating power-off by the power control program, thus avoiding disruption to normal operation. Therefore, by modeling and analyzing the cold spots, hot spots, power fluctuations, and reference clock frequency during normal operation of the AI ​​chip, comprehensive detection of situations exceeding the normal operating range is achieved. At the same time, a shielding layer is added to the upper layer of these key sensors to ensure that the AI ​​chip can be alarmed in a timely manner when an abnormal operating environment occurs, and with the graded response mechanism, the security of the AI ​​chip is comprehensively guaranteed.

[0166] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0167] Based on the same inventive concept, this application also provides an exception handling apparatus for implementing the exception handling method described above. The solution provided by this apparatus is similar to the implementation scheme described in the above method; therefore, the specific limitations in one or more exception handling apparatus embodiments provided below can be found in the limitations of the exception handling method described above, and will not be repeated here.

[0168] In one exemplary embodiment, such as Figure 7 As shown, an anomaly handling device is provided, applied to an artificial intelligence chip. The artificial intelligence chip includes a security component, the security component having a shielding layer. The device includes:

[0169] The physical detection module 702 is configured to determine whether there is an abnormality in the shielding layer;

[0170] The security component detection module 704 is configured to perform anomaly detection on the artificial intelligence chip based on the security component when there is no anomaly in the shielding layer, and obtain a chip detection result; and to perform anomaly processing on the artificial intelligence chip according to the anomaly level corresponding to the chip detection result.

[0171] The physical detection module 702 is configured to perform anomaly processing on the artificial intelligence chip according to the highest anomaly level when an anomaly exists in the shielding layer.

[0172] In one embodiment, the shielding layer includes a wire mesh configured to transmit shielding layer signals;

[0173] The physical detection module 702 is configured as follows:

[0174] Determine whether the shielding layer signal exists;

[0175] If the shielding layer signal is present, then the shielding layer is not abnormal;

[0176] If the shielding layer signal is not present, then the shielding layer is abnormal.

[0177] In one embodiment, the artificial intelligence chip includes a signal transmitting end and a signal receiving end of the wire network;

[0178] The physical detection module 702 is configured as follows:

[0179] When the signal transmitting end randomly generates a shielding layer signal and sends the shielding layer signal to the signal receiving end through the wire network, it is determined whether the signal receiving end receives the shielding layer signal.

[0180] If the shielding layer signal is received, then the shielding layer signal exists;

[0181] If the shielding layer signal is not received, then the shielding layer signal does not exist.

[0182] In one embodiment, the spacing between the wires in the wire mesh is consistent with the wiring spacing of the safety component.

[0183] In one embodiment, the security component includes multiple sensors;

[0184] The security component detection module 704 is configured as follows:

[0185] Based on the sensor values ​​obtained from the various sensors, anomaly detection is performed on the artificial intelligence chip to obtain the chip detection results of each sensor.

[0186] Based on the chip detection results indicating anomalies in the artificial intelligence chip, the cumulative value of the anomaly results corresponding to each of the sensors is determined;

[0187] Obtain the cumulative anomaly threshold for each of the aforementioned sensors;

[0188] The comparison result between the cumulative value of each abnormal result and the cumulative threshold of each abnormality is determined, and the abnormality is handled according to the abnormality level corresponding to the comparison result.

[0189] In one embodiment, the security component detection module 704 is configured to:

[0190] Based on the chip detection results indicating the abnormality of the artificial intelligence chip, the types of sensors that detected the chip abnormality are calculated to obtain the number of sensor types indicating the chip abnormality.

[0191] The cumulative anomaly threshold is determined based on the number of sensor types; the number of sensor types is negatively correlated with the cumulative anomaly threshold.

[0192] In one embodiment, the security component detection module 704 is configured to:

[0193] If the comparison result corresponds to a first anomaly probability, update the cumulative value of the anomaly result;

[0194] If the comparison result corresponds to the second anomaly probability, update the cumulative value of the anomaly result and perform a logical reset on the artificial intelligence chip;

[0195] If the comparison result corresponds to the third anomaly probability, the AI ​​chip is cleaned of data.

[0196] The first abnormal probability, the second abnormal probability, and the third abnormal probability increase sequentially, representing an increasing level of abnormality.

[0197] In one embodiment, the security component detection module 704 is configured to:

[0198] Obtain the power supply voltage of the artificial intelligence chip, divide the power supply voltage to obtain the divided voltage;

[0199] Determine the glitch voltage threshold corresponding to the reference voltage;

[0200] Determine the voltage comparison result between the voltage after voltage division and the glitch voltage threshold;

[0201] Based on the clock signal, the voltage comparison result is sampled on both sides to obtain the sampled value of the voltage comparison result; the frequency of the clock signal is negatively correlated with the delay of the glitch voltage detection;

[0202] The glitch voltage detection result of the artificial intelligence chip is determined based on the sampled values.

[0203] In one embodiment, the chip detection result includes at least one of temperature detection result, voltage detection result, and clock frequency detection result;

[0204] The temperature detection results are generated based on the temperature thresholds and temperature values ​​of each region of the artificial intelligence chip.

[0205] The voltage detection results include at least one of the continuous power supply voltage detection results and the glitch voltage detection results of the artificial intelligence chip;

[0206] The clock frequency detection result includes the reference clock frequency detection result of the artificial intelligence chip.

[0207] Each module in the above-mentioned exception handling device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in the processor of a computer device in hardware form or independent of it, or stored in the memory of the computer device in software form, so that the processor can call and execute the operations corresponding to each module.

[0208] In one exemplary embodiment, a computer device is provided, which may be a server or a terminal, and its internal structure diagram may be as follows: Figure 8 As shown, this computer device includes an artificial intelligence chip, a processor, memory, input / output (I / O) interfaces, and a communication interface. The processor, memory, and I / O interfaces are connected via a system bus, and the communication interface is also connected to the system bus via the I / O interfaces. The processor provides computational and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and databases. The internal memory provides the environment for the operating system and computer programs stored in the non-volatile storage media to run. The I / O interfaces are used for exchanging information between the processor and external devices. The communication interface is used for communicating with external terminals via a network connection. When the computer program is executed by the processor, it implements an exception handling method.

[0209] Those skilled in the art will understand that Figure 8The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0210] In one embodiment, a computer device is also provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps in the above method embodiments.

[0211] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon that, when executed by a processor, implements the steps in the above method embodiments.

[0212] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps in the above method embodiments.

[0213] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, artificial intelligence (AI) processors, etc., and are not limited to these.

[0214] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0215] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. An abnormality processing method characterized by comprising: Applied to an artificial intelligence chip, the artificial intelligence chip including a security component, the security component having a shielding layer, the method includes: Determine if the shielding layer is abnormal; If there are no abnormalities in the shielding layer, the AI ​​chip is subjected to anomaly detection based on the security component to obtain the chip detection result; and the AI ​​chip is subjected to anomaly processing according to the anomaly level corresponding to the chip detection result. In the event of an anomaly in the shielding layer, the AI ​​chip will be subjected to anomaly processing based on the highest anomaly level.

2. The method of claim 1, wherein, The shielding layer includes a wire mesh, which is used to transmit shielding layer signals; The determination of whether the shielding layer is abnormal includes: Determine whether the shielding layer signal exists; If the shielding layer signal is present, then the shielding layer is not abnormal; If the shielding layer signal is not present, then the shielding layer is abnormal.

3. The method of claim 2, wherein, The artificial intelligence chip includes a signal transmitting end and a signal receiving end of the wire network; The determination of whether the shielding layer signal exists includes: When the signal transmitting end randomly generates a shielding layer signal and sends the shielding layer signal to the signal receiving end through the wire network, it is determined whether the signal receiving end receives the shielding layer signal. If the shielding layer signal is received, then the shielding layer signal exists; If the shielding layer signal is not received, then the shielding layer signal does not exist.

4. The method of claim 2, wherein, The spacing between the conductors in the wiring network is consistent with the wiring spacing of the safety component.

5. The method of claim 1, wherein, The safety components include a variety of sensors; The step of performing anomaly detection on the artificial intelligence chip based on the security component to obtain chip detection results includes: Based on the sensor values ​​obtained from the various sensors, anomaly detection is performed on the artificial intelligence chip to obtain the chip detection results of each sensor. Based on the chip detection results indicating anomalies in the artificial intelligence chip, the cumulative value of the anomaly results corresponding to each of the sensors is determined; The step of handling anomalies in the artificial intelligence chip based on the anomaly level corresponding to the chip detection result includes: Obtain the cumulative anomaly threshold for each of the aforementioned sensors; The comparison result between the cumulative value of each abnormal result and the cumulative threshold of each abnormality is determined, and the abnormality is handled according to the abnormality level corresponding to the comparison result.

6. The method of claim 5, wherein, The step of obtaining the cumulative anomaly threshold for each of the sensors includes: Based on the chip detection results indicating the abnormality of the artificial intelligence chip, the types of sensors that detected the chip abnormality are calculated to obtain the number of sensor types indicating the chip abnormality. The cumulative anomaly threshold is determined based on the number of sensor types; the number of sensor types is negatively correlated with the cumulative anomaly threshold.

7. The method of claim 5, wherein, The step of performing anomaly processing on the artificial intelligence chip based on the anomaly level corresponding to the comparison result includes: If the comparison result corresponds to a first anomaly probability, update the cumulative value of the anomaly result; If the comparison result corresponds to the second anomaly probability, update the cumulative value of the anomaly result and perform a logical reset on the artificial intelligence chip; If the comparison result corresponds to the third anomaly probability, the AI ​​chip is cleaned of data. The first abnormal probability, the second abnormal probability, and the third abnormal probability increase sequentially, representing an increasing level of abnormality.

8. The method of claim 1, wherein, The step of performing anomaly detection on the artificial intelligence chip based on the security component to obtain chip detection results includes: Obtain the power supply voltage of the artificial intelligence chip, divide the power supply voltage to obtain the divided voltage; Determine the glitch voltage threshold corresponding to the reference voltage; Determine the voltage comparison result between the voltage after voltage division and the glitch voltage threshold; Based on the clock signal, the voltage comparison result is sampled on both sides to obtain the sampled value of the voltage comparison result; the frequency of the clock signal is negatively correlated with the delay of the glitch voltage detection; The glitch voltage detection result of the artificial intelligence chip is determined based on the sampled values.

9. The method of claim 1, wherein, The chip detection results include at least one of temperature detection results, voltage detection results, and clock frequency detection results; The temperature detection results are generated based on the temperature thresholds and temperature values ​​of each region of the artificial intelligence chip. The voltage detection results include at least one of the continuous power supply voltage detection results and the glitch voltage detection results of the artificial intelligence chip; The clock frequency detection result includes the reference clock frequency detection result of the artificial intelligence chip.

10. An artificial intelligence processor, comprising: This is applied to an artificial intelligence chip, which includes a security component with a shielding layer. The artificial intelligence processor includes: The physical detection module is configured to determine whether there is an abnormality in the shielding layer; The security component detection module is configured to perform anomaly detection on the artificial intelligence chip based on the security component when there is no anomaly in the shielding layer, and obtain the chip detection result; and to perform anomaly processing on the artificial intelligence chip according to the anomaly level corresponding to the chip detection result. The physical detection module is configured to perform anomaly processing on the artificial intelligence chip according to the highest anomaly level when an anomaly exists in the shielding layer.

Images