Computing system, information processing method, and information processing program

Abstract

To reduce a time required for reading encrypted data to a trusted area and decrypting the data in secret information processing to increase the speed of the secret information processing .SOLUTION: A computing system comprises a processor and a memory. The processor has an execution environment for setting a trusted area in the memory, and the execution environment has a plurality of isolated execution processes which are logically isolated. The computing system executes preparatory processing which includes a plurality of pieces of block processing having an execution order determined and receives an execution request of processing on encrypted data and reads out the encrypted data for use in block processing to the trusted area to decrypt the encrypted data, and then executes the block processing using the trusted area and executes, in parallel, the block processing and preparatory processing for block processing later than that block processing in the execution order.SELECTED DRAWING: Figure 7

Description

[Technical Field]

[0001] The present invention relates to a computer system, an information processing method, and an information processing program. [Background technology]

[0002] In recent years, CPUs (Central Processing Units) have been equipped with TEEs (Trusted Execution Environments). TEEs are considered to be effective for processing confidential information. TEEs are environments that provide a trusted area where information cannot be read even if the administrator privileges of the OS (Operating System) running on the computer are stolen. Decryption and processing of encrypted data within the trusted area enables secure and advanced processing.

[0003] Japanese Patent Application Laid-Open Publication No. 2023-70519 (Patent Document 1) discloses a technology for using the trust region of a TEE in machine learning. Patent Document 1 discloses a computer system and method for preventing paging processing from occurring when the required memory usage exceeds the capacity of the trust region and for speeding up processing when multilayer processing such as a convolutional neural network (CNN) is performed using the trust region of a TEE while keeping data confidential.

[0004] Specifically, the computer system in the technology described in Patent Document 1 includes a computer having a processor in memory that ensures security and has a function for setting a logically isolated trusted area. The computer system includes a plurality of block processes, and receives a request to execute a process on encrypted data in which data including confidential information is encrypted. When executing one block process, the computer system determines whether or not decryption of the encrypted data is necessary, and if decryption of the encrypted data is not necessary, executes the block process using an area different from the trusted area, and if decryption of the encrypted data is necessary, executes the block process using the trusted area. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] Japanese Patent Application Publication No. 2023-70519 Summary of the Invention [Problem to be solved by the invention]

[0006] The technology described in Patent Document 1 leaves room for improvement in the length of time required to read encrypted data into a trusted region and decrypt it in secret information processing. Therefore, one aspect of the present invention shortens the time required to read encrypted data into a trusted region and decrypt it in secret information processing, thereby speeding up secret information processing. [Means for solving the problem]

[0007] In order to solve the above problem, one aspect of the present invention employs the following configuration: A computer system includes one or more computers, each of which has one or more processors and a memory connected to the processor, the one or more processors having an execution environment for setting a secure and logically isolated trusted region in the memory connected to the processor, the execution environment having a plurality of logically isolated isolated execution processes, the one or more computers including a plurality of block processes having a predetermined execution order, accepting a request to execute processing on encrypted data, generating, for each of the plurality of block processes, an isolated execution process in the trusted region in which the block process is executed, and reading encrypted data to be used for the block process into the trusted region and decrypting the encrypted data, executing the block process using the trusted region after the preparatory process and a block process that precedes the block process in the execution order have been completed, and executing the block process and the preparatory process for a block process that follows the block process in the execution order in parallel. [Effects of the Invention]

[0008] According to one aspect of the present invention, in secret information processing, it is possible to shorten the time required to read encrypted data into a trusted region and decrypt it, thereby speeding up secret information processing.

[0009] Problems, configurations, and effects other than those described above will become apparent from the following description of the embodiments. [Brief explanation of the drawings]

[0010] [Figure 1] 1 is a block diagram illustrating an example of the configuration of a secret information processing system according to a first embodiment. [Figure 2] 1 is a block diagram illustrating an example of a hardware configuration of a secret information processing system according to a first embodiment. [Figure 3] FIG. 2 is a sequence diagram illustrating an example of a flow of providing a secret information processing service in the secret information processing system according to the first embodiment. [Figure 4A] FIG. 2 is a block diagram illustrating an example of a functional configuration of a secret information processing server according to the first embodiment. [Figure 4B] 10 is a table illustrating an example of a data structure of enclave-tier allocation information according to the first embodiment. [Figure 5] 10 is a flowchart illustrating an example of an enclave preparation process executed by the secret information processing server according to the first embodiment. [Figure 6] 10 is a flowchart illustrating an example of an enclave preparation process executed by the secret information processing server according to the first embodiment. [Figure 7] 10 is a flowchart illustrating an example of an AI request process executed by the secret information processing server according to the first embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0011] In recent years, there has been progress in schemes for utilizing personal data through collaboration between the public and private sectors. For example, new value is being created by linking diverse information, such as through collaboration between public and private services. Statistical analysis such as regression analysis and machine learning with multi-layer processing models such as deep neural networks (DNNs) and generative artificial intelligence (AI) are considered effective in creating new value by linking diverse information. Statistical analysis and machine learning can be easily implemented by various organizations and individuals using public clouds, which require less initial investment than building their own systems.

[0012] Meanwhile, regulations aimed at protecting privacy are becoming stricter. Furthermore, the AI ​​parameters that make up AI processing models contain personal information, confidential corporate information, and intellectual property, and these must be protected. Therefore, there is a need for technology that allows confidential information and AI parameters held by data holders, such as hospitals and banks, to be utilized while remaining confidential.

[0013] Conventional technologies enable specific processing of encrypted data, thereby enabling the use of confidential information in a confidential state. However, the processing that can be performed with conventional technologies is limited to basic processing such as search and order comparison, and the flexibility of processing is limited. Therefore, there is a demand for technology that can handle advanced statistical processing, which requires a high degree of processing flexibility, and machine learning with multi-layer processing models such as DNN (Deep Neural Network) and generative AI.

[0014] AI processing using large-scale, multi-layered machine learning models such as LLMs (Large Language Models) in generative AI uses a large number of AI parameters. For example, a typical generative AI application today consists of 1.7 trillion (1.7 trillion) AI parameters, and if each parameter is expanded in memory as an 8-byte variable, the total size of the AI ​​parameters is approximately 12.3 terabytes.

[0015] In contrast, the size of the trusted region of Intel (registered trademark, hereinafter the same) SGX (Software Guard Extensions), one of the current representative TEEs, is 256 GB per VM (Virtual Machine), 512 GB per CPU (Central Processing Unit), or 1 terabyte per server (2 CPUs).

[0016] As a result, a typical generative AI application today requires approximately 50 loads of AI parameters when run on one VM, approximately 25 loads when run on one CPU, and approximately 12 loads when run on one server (two CPUs). Furthermore, when data is deployed into the TEE's trusted domain, the CPU adds decryption processing time when the loaded encrypted data is deployed to the CPU's cache before operation. These times increase the AI ​​processing time.

[0017] Therefore, in AI processing using a large-scale multi-layer machine learning model in secret information processing using a TEE, the secret information processing server of this embodiment loads and decrypts parameters of early layers before starting the AI ​​processing, and further loads and decrypts AI parameters required for later processing while the earlier layer is being processed. As a result, the secret information processing server starts processing of later layers without requiring time for loading and decrypting after the earlier processing is completed, thereby preventing the load and decryption time of a large number of AI parameters from increasing the AI ​​processing time, and ultimately speeding up the AI ​​processing.

[0018] Hereinafter, embodiments of the present invention will be described with reference to the drawings. However, the present invention should not be construed as being limited to the description of the embodiments shown below. Those skilled in the art will readily understand that the specific configuration can be changed without departing from the spirit or intent of the present invention.

[0019] In the configuration of the invention described below, the same or similar configurations or functions are denoted by the same reference numerals, and redundant explanations will be omitted.

[0020] In this specification, the terms "first," "second," "third," etc. are used to identify components and do not necessarily limit the number or order. [Example]

[0021] (1-1) Example of confidential information processing system configuration 1 is a block diagram showing an example of the configuration of a confidential information processing system according to a first embodiment. The confidential information processing system 1 acquires data including encrypted confidential information from a service user (data holder) who holds confidential information such as personal information and trade secrets, processes the received data in a state in which the confidential information is kept confidential from the outside, and provides the result of the processing to the service user. Here, the term "external" is a concept that includes a cloud administrator and a service administrator.

[0022] The confidential information processing system 1 includes, for example, a user terminal 10, a confidential information processing server 30, and a service administrator terminal 20. The user terminal 10, the confidential information processing server 30, and the service administrator terminal 20 are connected to one another via a network 40. Here, the network 40 is, for example, the Internet via wired or wireless communication, an intranet such as an in-house network, or a communication network such as a satellite line.

[0023] The user terminal 10 is a terminal used by a service user who uses the confidential information processing service or a data holder who provides data. Note that the service user and the data holder may be the same person. The data holder uses the user terminal 10 to encrypt data and transmit it to the confidential information processing server 30. The service user uses the user terminal 10 to apply for use of the confidential information processing service and transmit a request to execute processing.

[0024] The service administrator terminal 20 is a terminal used by a service administrator who provides a confidential information processing service. The service administrator uses the service administrator terminal 20 to accept applications for use of the confidential information processing service from the user terminal 10, and also to build, operate, and manage the environment of the confidential information processing server 30. When the confidential information processing server 30 receives a request to execute processing using data received from the user terminal 10, it executes the processing while keeping the data confidential from the outside, and transmits the results of the processing to the user terminal 10.

[0025] The confidential information processing system 1 may include a plurality of user terminals 10, a plurality of service administrator terminals 20, or a plurality of confidential information processing servers 30. When the confidential information processing system 1 includes a plurality of user terminals 10, the user terminal 10 that transmits confidential information and the user terminal 10 that uses the processing results may be separate.

[0026] 2 is a block diagram showing an example of the hardware configuration of the secret information processing system 1. Using FIG. 2, the hardware configurations of the user terminal 10, the service administrator terminal 20, and the secret information processing server 30 will be described.

[0027] The user terminal 10 is, for example, a computer such as a personal computer, a smartphone, or a server device. The user terminal 10 includes a CPU 11, a memory 12, an auxiliary storage device 13, a network interface 14, a display device 15, and an input device 16, which are connected to each other by, for example, an internal communication line.

[0028] The CPU 11 is an example of a computing device (processor) and executes programs stored in the memory 12. The memory 12 includes a ROM (Read Only Memory), which is a non-volatile storage element, and a RAM (Random Access Memory), which is a volatile storage element. The ROM stores unchanging programs such as a BIOS (Basic Input / Output System). The RAM is a high-speed, volatile storage element such as a DRAM (Dynamic Random Access Memory), and temporarily stores programs executed by the CPU 11 and data used when the programs are executed.

[0029] The CPU 11 of this embodiment has a TEE (Trusted Execution Environment), i.e., the CPU 11 is a TEE-compatible CPU. The CPU 11 uses the TEE to generate a trusted area 17 in the memory 12, which is a hardware storage area isolated from other areas. The trusted area 17 has a small capacity (e.g., 128 MB, 256 GB, etc.) relative to the total storage area of ​​the memory 12. If the memory usage required to execute a process is greater than the capacity of the trusted area 17, paging processing occurs, reducing the processing speed of the process using the trusted area 17. The trusted area 17 stores data to be processed by the confidential information processing service, including confidential information. Note that, as the confidential information processing service, for example, AI processing using a multi-layer machine learning model (hereinafter simply referred to as multi-layer AI processing) is executed on the processing target data.

[0030] The CPU 11 may not have a TEE. In this case, the memory 12 does not include the trusted region 17, and the processing described below, which is to be executed using the trusted region 17, is executed using the normal region in the memory 12. The trusted region 17 may be generated when the processing is executed, or may be generated before the processing starts. There may be no particular limit on the capacity of the trusted region 17.

[0031] The auxiliary storage device 13 is a large-capacity, non-volatile storage device such as a magnetic storage device (HDD (Hard Disk Drive)) or a flash memory (SSD (Solid State Drive)), and stores programs executed by the CPU 11 (arithmetic unit) and data used when the programs are executed. That is, the programs are read from the auxiliary storage device 13, loaded into the memory 12, and executed by the CPU 11. The relationship between the programs, arithmetic unit, memory, and auxiliary storage device is the same in the service administrator terminal 20 and the confidential information processing server 30.

[0032] The display device 15 is a device such as a display or printer that outputs the results of program execution in a format that can be viewed by the user. The input device 16 is a device such as a keyboard or mouse that accepts input from the user. The network interface 14 controls communication with other devices according to a predetermined protocol. The network interface 14 may also include a serial interface such as a USB (Universal Serial Bus).

[0033] The program executed by the CPU 11 may be stored in advance in the non-volatile auxiliary storage device 13, which is a computer-readable non-transitory storage medium, or may be provided to the user terminal 10 via a network from a removable medium (CD-ROM, flash memory, etc.) which is a non-transitory storage medium, or from a non-transitory storage device of another device, and then stored in the auxiliary storage device 13. For this reason, the user terminal 10 may have an interface for reading data from removable media. This also applies to the service administrator terminal 20 and the confidential information processing server 30.

[0034] The service administrator terminal 20 is, for example, a computer such as a personal computer, a smartphone, or a server device. The service administrator terminal 20 includes, for example, a CPU 21, a memory 22, an auxiliary storage device 23, a network interface 24, a display device 25, and an input device 26, which are connected to each other via an internal communication line.

[0035] The hardware descriptions of the CPU 21, memory 22, auxiliary storage device 23, network interface 24, display device 25, and input device 26 are the same as the hardware descriptions of the CPU 11, memory 12, auxiliary storage device 13, network interface 14, display device 15, and input device 16, respectively. However, the CPU 21 does not need to have a TEE. Therefore, it is not necessary to generate a trust region in the memory 22.

[0036] The confidential information processing server 30 is a computer such as a personal computer, a smartphone, a server device, etc. The confidential information processing server 30 includes a CPU 31, a memory 32, an auxiliary storage device 33, a network interface 34, a display device 35, an input device 36, and a GPU (Graphics Processing Unit) 39, which are connected to each other by an internal communication line such as a bus.

[0037] The hardware descriptions of the CPU 31, memory 32, auxiliary storage device 33, network interface 34, display device 35, and input device 36 are the same as the hardware descriptions of the CPU 11, memory 12, auxiliary storage device 13, network interface 14, display device 15, and input device 16. However, the CPU 31 of the confidential information processing server 30 has a TEE and can generate a trusted region 38 in the memory 32.

[0038] The GPU 39 is an example of a computing device (processor), and executes a program stored in the memory 32 at high speed by using an area (normal area) different from the trusted area 38 of the memory 32. Note that the confidential information processing server 30 does not necessarily have to have the GPU 39. When the confidential information processing server 30 has a plurality of computing devices, the plurality of computing devices may share the processing load.

[0039] Furthermore, the GPU 39 may have a TEE. In this case, the GPU 39 may generate a trust region separate from the trust region 38 in the memory 32 and execute processing using the separate trust region. Processing executed by the CPU 31 using the trust region 38 will be described later, but part or all of the processing may be executed by the GPU 39 using the separate trust region.

[0040] In this embodiment, a TEE is used as an environment for realizing processing in a secure area isolated on memory, but a method other than a TEE may also be used.

[0041] Note that some or all of the processes executed by the CPU 11, CPU 21, CPU 31, and GPU 39 may be executed by hardware such as an ASIC (Application Specific Integrated Circuit) or an FPGA (Field-Programmable Gate Array).

[0042] The user terminal 10, the service administrator terminal 20, and the confidential information processing server 30 may be realized as a computer system configured on multiple logically or physically configured computers. Also, the user terminal 10, the service administrator terminal 20, and the confidential information processing server 30 may be realized as separate threads on the same computer, or may be realized as a virtual computer constructed using multiple physical computer resources.

[0043] In this embodiment, the information used by the confidential information processing system 1 can be expressed in any data structure independent of the data structure, and for example, the information can be stored in a data structure appropriately selected from a list, a table, a database, or a queue.

[0044] (1-2) Example of the confidential information processing service provided by the confidential information processing system FIG. 3 is a sequence diagram showing an example of a flow of providing a secret information processing service in the secret information processing system 1 according to the first embodiment.

[0045] First, a description will be given of the confidential information processing service provided by the confidential information processing system 1 of this embodiment. The confidential information processing service is a service in which a service administrator constructs and operates a confidential information processing server 30 on the cloud, and provides service users with an advanced and secure information processing function using the confidential information processing server 30.

[0046] The value provided by the confidential information processing service is that it allows service users to use inexpensive, high-performance computing resources on the cloud while keeping confidential information confidential. By using the confidential information processing service, service users do not need to purchase, build, or operate and manage expensive resources such as computers and software at their own site. This allows them to obtain the results of advanced information processing such as AI learning and AI inference without disclosing confidential information to cloud administrators and service administrators.

[0047] An example of the flow of providing the above-mentioned confidential information processing service will be described below with reference to FIG.

[0048] The user terminal 10 transmits an application for use of the confidential information processing service to the service administrator terminal 20 in accordance with an operation by the service user (step S301).

[0049] The service administrator terminal 20 constructs a service environment on the cloud in accordance with the operation of the service administrator (step S302).

[0050] Specifically, the service administrator terminal 20 constructs the confidential information processing server 30 and starts the confidential information processing service on the confidential information processing server 30. Here, the cloud administrator is a privileged user in the cloud data center and monitors the operation log of the service administrator on the cloud. The service administrator terminal 20 also analyzes the program that realizes the processing and embeds information into the program indicating whether or not encrypted data needs to be decrypted. The service administrator terminal 20 may also assign the above-mentioned information to each task included in the processing.

[0051] Next, the service administrator terminal 20 transmits a notice of the start of the confidential information processing service to the user terminal 10 in accordance with an operation by the service administrator (step S303).

[0052] The user terminal 10 transmits a request for issuing a key for encrypting confidential information to the confidential information processing server 30 in accordance with an operation by the service user (step S304).

[0053] When the secret information processing server 30 receives the issuance request, it generates a private key 331 and a public key 332, which are a key pair of public key cryptography, in the trusted area 38 (step S305). The secret information processing server 30 stores the private key 331 in the trusted area 38. The secret information processing server 30 transmits the public key 332 to the user terminal 10 (step S306).

[0054] The user terminal 10 generates, in accordance with an operation by the service user, a common key 301 used for encrypting / decrypting confidential information, processing contents, or processing results within the trusted region 17 (step S307).

[0055] In accordance with operations by the service user, the user terminal 10 encrypts the data to be processed by the confidential information processing service (i.e., data to be processed by multi-layer AI processing, including confidential information) within the trusted area 17 using the common key 301 (step S308).

[0056] The user terminal 10 encrypts the common key 301 using the public key 332 within the trusted region 17 in accordance with the operation of the service user (step S309). The user terminal 10 transmits an execution request including the encrypted data to be processed and the encrypted common key 301 to the secret information processing server 30 in accordance with the operation of the service user (step S310). Note that if the memory 12 does not include the trusted region 17, the user terminal 10 executes the processes of steps S307, S308, and S310 using the normal region of the memory 12.

[0057] The secret information processing server 30 executes secret information processing to decrypt confidential information included in the received data within the trusted area 38 and process the information (step S311), and transmits the processing result encrypted using the common key 301 to the user terminal 10 (step S312). In addition, the secret information processing server 30 transmits an execution log of the secret information processing, etc. to the service administrator terminal 20 (step S313).

[0058] The user terminal 10 decrypts the received processing result using the common key 301 in accordance with the operation of the service user (step S314), and obtains the processing result of the secret information processing on the data including the confidential information.

[0059] (1-3) Example of the functional configuration of the confidential information processing server and data processing example of confidential multi-layer AI processing FIG. 4A is a block diagram illustrating an example of a functional configuration of the secret information processing server 30 according to the first embodiment.

[0060] As an example of confidential information processing, the functional configuration of the confidential information processing server 30 that executes confidential multi-layer AI processing will be described with reference to FIG.

[0061] The memory 32 of the confidential information processing server 30 includes, for example, a normal area 410 for high-speed processing using a normal CPU 31, memory 32, and an acceleration chip such as a GPU 39, and a highly secure and isolated trusted area 38 generated by the TEE.

[0062] The normal area 410 stores, for example, an enclave preparation processing unit 411, an AI request processing unit 412, parameter information 413, enclave-tier allocation information 414, key information 415, and enclave setting information 416. The trusted area 38 stores, for example, one or more enclaves 420.

[0063] The enclave preparation processor 411 generates an enclave 420, which is a secure processing process, within the trust domain 38. The enclave 420 is an example of an isolated execution process. The enclave preparation processor 411 also initiates the execution of processing within the enclave 420. The AI ​​request processor 412 accepts input information for the multi-layer AI processing model (an AI processing request, which is an example of the execution request described above), initiates the execution of processing for each layer within the enclave 420, deletes the enclave 420 whose execution has completed, and initiates new enclave preparation processing.

[0064] The parameter information 413 includes information indicating the layer configuration of the multi-layer AI model, information indicating the type of computational processing for each layer, and a group of parameter files encrypted with a parameter key for each layer. The enclave-layer allocation information 414 includes the layer number of each layer of the multi-layer AI model, the parameter size, the parameter file name, and the enclave number to which the processing for each layer is assigned.

[0065] The key information 415 includes a public key 332 generated by or received by the secret information processing server 30 and a private key 331 encrypted with a unique key generated by the TEE of the CPU 31. The key information 415 includes a parameter key encrypted with the public key 332. The parameter key is a key obtained by encrypting parameters of a multi-layered AI, and is a common key (different from the common key 301) generated by a common key cryptosystem. Note that the parameter key may be a public key of a public key cryptosystem (in which case, the parameter key does not need to be encrypted); however, because encryption and decryption using a common key system has a faster processing speed than encryption and decryption using a public key cryptosystem, it is desirable that the parameter key be a common key.

[0066] The enclave setting information 416 includes the number of concurrent enclaves Pn, which is the number of enclaves to be generated in parallel during enclave preparation processing and AI request processing (which can also be said to be the maximum number of enclaves that are executed (exist) simultaneously). The log information 417 includes a log of successful enclave generation and a log of failed enclave generation.

[0067] The parameter information 413, enclave-layer allocation information 414, key information 415, enclave setting information 416, and log information 417 are stored in the auxiliary storage device 33 of the confidential information processing server 30, and are read out to the normal area 410 by the enclave preparation processing unit 411 and the AI ​​request processing unit 412 when necessary.

[0068] Each enclave 420 stores, for example, a decryption processing unit 421, a layer processing unit 422, an encryption processing unit 423, a common key 301, and a private key 331. The layer processing unit 422 executes arithmetic processing of a layer group of multi-layer AI processing. In this embodiment, a layer group is a group consisting of one or more consecutive layers. A layer process for one layer is an example of one block process. The layer processes have a set execution order, and the output from each layer process becomes the input to the next layer process in the execution order. In other words, before each layer process can start, the previous layer process must be completed.

[0069] The decryption processing unit 421 decrypts the common key 301 encrypted with the public key 332, using the private key 331 stored in the trusted area 38, and stores the decrypted common key 301 in the trusted area 38. The layer processing unit 422 executes layer processing for the layer assigned to the enclave 420. The encryption processing unit 423 encrypts the processing result output by the layer processing unit 422, using the common key 301 stored in the trusted area 38.

[0070] 4B shows an example of the data structure of the enclave-tier allocation information 414 in Example 1. The enclave-tier allocation information 414 includes, for example, a tier number column 4141, a parameter size column 4142, a parameter file name column 4143, and an allocated enclave number column 4144.

[0071] The layer number column 4141 indicates the identifier of each layer of multi-layer AI processing. The parameter size column 4142 indicates the size of the parameters used in the layer processing of the corresponding layer number. The parameter file name column 4143 indicates the file name in which the encryption parameters used in the layer processing of the corresponding layer number are stored. The assigned enclave number column 4144 indicates the enclave number (enclave identifier) ​​to which the layer processing of the corresponding layer number is assigned.

[0072] In the example of Figure 4B, record 4145 indicates that the parameter size of layer number "1" is "100MB", the parameter file name in which the encryption parameters are stored is "P1", and the assigned enclave number, which is the identifier of the enclave to which processing of that layer is assigned, is "1".

[0073] In records 4145 and 4146, the assigned enclave numbers are independent, and therefore it is shown that processing of one layer is assigned to one enclave 420. Specifically, in the example of Figure 4B, it is shown that only processing of the first layer is assigned to the first enclave 420 (the layer group assigned to the first enclave 420 consists only of the first layer), and it is shown that only processing of the second layer is assigned to the second enclave 420 (the layer group assigned to the second enclave 420 consists only of the second layer).

[0074] On the other hand, in records 4147 and 4148, since the assigned enclave number is the same, it is indicated that two layer processes are assigned to one enclave 420. Specifically, in the example of Figure 4B, it is indicated that the third enclave 420 is assigned the third and fourth layer processes (the layer group assigned to the third enclave 420 consists of the third and fourth layers).

[0075] Hereinafter, for any natural number i, the layer group assigned to the i-th enclave 420 in the enclave-layer allocation information 414 (i.e., the layer group processed by the i-th enclave 420) will also be referred to as the i-th layer group.

[0076] In this embodiment, an example is described in which processing of one layer is executed in only one enclave 420, but processing of one layer may be divided and executed in multiple enclaves 420 using the method described in Patent Document 1, etc.

[0077] In the examples of FIGS. 4A and 4B, all enclaves 420 are generated in one VM. However, each enclave 420 may be generated in a different VM, a different server, or a different accelerator. This allows for flexible design according to the resources, etc., of the confidential information processing server 30 owned by the cloud administrator. In this case, the enclave-layer allocation information 414 includes information indicating the VM, server, or accelerator in which each enclave indicated by the assigned enclave number is generated. Furthermore, when each enclave 420 is generated in a different resource, the encryption parameters of the layer corresponding to the enclave 420 in the parameter information 413 and the key information 415 may be stored in advance in the auxiliary storage device 33 corresponding to the resource.

[0078] The enclave-layer allocation information 414 (which resource each enclave 420 is created on and which layer is assigned to each enclave 420) is preferably determined so that loading and decoding of parameters for a layer assigned to an enclave 420 created on each resource is completed before the processing of the layer immediately preceding that layer is completed. This allows the preparation processing for the next layer to be completed before the processing of that layer is completed, so that when the output of that layer is input to the enclave 420 that executes the processing of the next layer, the subsequent processing can be started without waiting.

[0079] For example, the enclave-tier allocation information 414 may be determined so as to minimize the time required for AI request processing, as described below, by a cloud administrator simulating the time required for AI request processing (such as reading and decrypting parameters for each tier, reading and decrypting inputs to each tier, processing each tier, encrypting outputs from each tier, and communications between enclaves 420) for all patterns of resources allocated to each enclave 420 and tiers allocated to each enclave 420. However, in the simulation, there are constraints, such as the completion of the reading and decryption of encryption parameters for the tier processing and inputs to the tier processing, before each tier processing can be executed.

[0080] FIG. 5 is a flowchart showing an example of enclave preparation processing that the confidential information processing server 30 of the first embodiment executes before accepting an AI processing request (before step S310).

[0081] For example, when receiving a request to execute enclave pre-preparation processing, the enclave preparation processing unit 411 of the secret information processing server 30 reads the number of parallel enclaves Pn from the enclave setting information 416 (step S501). The request to execute enclave pre-preparation processing may be transmitted from the user terminal 10 or the service administrator terminal 20, or may be generated according to an input to the input device 36 of the secret information processing server 30.

[0082] The number of parallel enclaves Pn is determined by a service administrator, etc., taking into consideration, for example, the number of cores of the VM, CPU 31, accelerator, etc. of the confidential information processing server 30, as well as the maximum capacity and processing power of the trusted area 38, and the service administrator terminal 20 sets the determined number of parallel enclaves Pn in the enclave setting information 416 of the confidential information processing server 30 via the network 40 in accordance with the operation of the service administrator.

[0083] The enclave preparation processing unit 411 reads out the parameter file names of the layer groups allocated to the 1st to Pnth enclaves 420 from the enclave-layer allocation information 414 (S502).

[0084] For example, if the value of Pn is “2”, the enclave preparation processing unit 411 reads, from the example enclave-layer allocation information 414 of FIG. 4B, the parameter file name “P1” of all layers (layers with layer number “1”) that make up the layer group assigned to the enclave 420 with assigned enclave number “1”, and the parameter file name “P2” of all layers (layers with layer number “2”) that make up the layer group assigned to the enclave 420 with assigned enclave number “2”.

[0085] The enclave preparation processing unit 411 reads the encrypted parameter key from the key information 415 (step S503).

[0086] The enclave preparation processing unit 411 sets the value of the variable i to 1 (step S504).

[0087] The enclave preparation processing unit 411 receives the value of the variable i and executes the enclave preparation processing for the i-th enclave (step S505). The enclave preparation processing will be described later with reference to FIG.

[0088] The enclave preparation processing unit 411 adds 1 to the value of the variable i (step S506).

[0089] The enclave preparation processing unit 411 determines whether the variable i is greater than Pn (S507). If the enclave preparation processing unit 411 determines that the variable i is equal to or less than Pn (S507: NO), it executes the processes of steps S505 to S507 again. If the enclave preparation processing unit 411 determines that the variable i is greater than Pn (S507: YES), it ends the enclave preparation process (step S507).

[0090] FIG. 6 is a flowchart showing an example of enclave preparation processing in which the secret information processing server 30 of the first embodiment actually generates an enclave 420 and decrypts encrypted parameter information within the enclave 420 prior to layer processing.

[0091] When the enclave preparation processing unit 411 of the confidential information processing server 30 reaches step S505 or receives a notification of the start of enclave preparation processing from the AI ​​request processing unit 412 in step S712 described below, it reads out the layer number (Ln) included in the layer group corresponding to the enclave 420 that is the target of the enclave preparation processing (the i-th enclave 420 if step S505 is reached, or the i+Pn-th enclave 420 if a start notification is sent in step S712) from the enclave-layer allocation information 414 (step S601).

[0092] Next, the enclave preparation processor 411 reads the encrypted parameter key from the key information 415 (step S602). Note that if the enclave preparation process starts upon reaching step S505, the enclave preparation processor 411 has already read the encrypted parameter key in step S503, and therefore the process of step S602 may be omitted.

[0093] The enclave preparation processing unit 411 generates an enclave 420 (enclave 420 that is the target of the enclave preparation processing) that processes the layer group to be processed in the trusted domain (step S603). For example, when Intel SGX, a representative TEE, is used, the enclave preparation processing unit 411 generates the enclave 420 using a function called sgx_create_enclave.

[0094] The enclave preparation processing unit 411 determines whether the generation of the enclave 420 was successful in step S603 (S604). If the enclave preparation processing unit 411 determines that the generation of the enclave 420 was successful (S604: YES), it writes a log of the success of the enclave generation to the log information 417 and proceeds to step S606. If the enclave preparation processing unit 411 determines that the generation of the enclave 420 failed (S604: NO), it writes a log of the failure of the enclave generation to the log information 417 (step S605) and ends the enclave preparation processing.

[0095] For example, the generation of the enclave 420 fails when there is insufficient free space on the resources for generating the enclave 420. Therefore, when the enclave preparation processing unit 411 determines that the generation of the enclave 420 has failed, it may respond to the user terminal 10 indicating that it is in a busy state, or may issue an alarm on the display device 35 indicating that additional resources are required.

[0096] Also, for example, it is assumed that the secret information processing server 30 holds management information for managing the status of free resources available to the server 30 in real time. In this case, if the enclave preparation processing unit 411 determines that the creation of the enclave 420 has failed, it may refer to the management information to identify free resources in which the enclave 420 can be created, create the enclave 420 in the identified free resources, and update the information on the resources corresponding to the enclave 420 in the enclave-tier allocation information 414.

[0097] The enclave preparation processor 411 reads encrypted parameter files corresponding to each layer included in the target layer group from the parameter information 413 and inputs them to the target enclave 420 (the enclave 420 generated in the most recent step S603) (step S606). The enclave preparation processor 411 reads encrypted parameter keys from the key information 415 and inputs them to the target enclave 420 (step S607).

[0098] The enclave preparation processor 411 instructs the target enclave 420 to decrypt the parameter key within the enclave 420 using the decryption processor 421 and the private key 331 (step S608). The enclave preparation processor 411 instructs the target enclave 420 to decrypt the encrypted parameters within the enclave 420 using the decryption processor 421 and the parameter key decrypted in step S608 (step S609).

[0099] If the enclave preparation processing unit 411 determines that the previous step (steps S606 to S609) was successful, it outputs a log indicating that the enclave preparation was successful to the log information 417, and if it determines that the previous step was unsuccessful, it outputs a log indicating that the enclave preparation was unsuccessful to the log information 417 (step S610) and terminates the enclave preparation processing.

[0100] In this way, the enclave advance preparation process (and the enclave preparation process called in the enclave advance preparation process) generates the 1st to Pnth enclaves 420, and the parameters of the corresponding layer group are decrypted and placed in each of the enclaves 420. This allows the confidential information processing server 30 to prepare the parameters corresponding to the 1st to Pnth layer groups before receiving an execution request from the user terminal 10, thereby shortening the time required for AI processing.

[0101] FIG. 7 is a flowchart showing an example of AI request processing in which, when the secret information processing server 30 of the first embodiment receives an AI processing request from the user terminal 10, the secret information processing server 30 responds by executing multi-layer AI processing.

[0102] The AI ​​processing request is an example of an execution request sent in step S310. The AI ​​processing request includes an encrypted query, which is the data to be processed that was encrypted in step S308, and an encrypted query key, which is the common key 301 that was encrypted in step S309. The AI ​​processing request also includes a request to execute layer processing (an example of multiple block processing) in a multi-layer AI on the data to be processed, and decryption processing on the encrypted AI parameters and the encrypted query key.

[0103] An example of the AI ​​request processing executed by the confidential information processing server 30 will be described below with reference to FIG.

[0104] When the AI ​​request processor 412 of the confidential information processing server 30 receives an AI processing request, it first reads the number of parallel enclaves Pn from the enclave setting information 416 (step S701).

[0105] Next, the AI ​​request processing unit 412 reads the encrypted query from the AI ​​processing request and sets it as input 1 (step S702).

[0106] The AI ​​request processing unit 412 reads the encrypted query key from the AI ​​processing request (step S703).

[0107] The AI ​​request processing unit 412 sets the value of the variable i to "1" (step S704).

[0108] The AI ​​request processing unit 412 inputs the input i and the encrypted query key to the i-th enclave 420 (S705).

[0109] The AI ​​request processor 412 instructs the i-th enclave 420 to decrypt the encrypted query key within the i-th enclave 420 using the decryption processor 421 and the private key 331 (step S706).

[0110] The AI ​​request processing unit 412 instructs the i-th enclave 420 to decrypt the input 1 within the i-th enclave 420 using the decryption processing unit 421 and the decrypted query key (step S707).

[0111] The AI ​​request processing unit 412 instructs the i-th enclave 420 to execute layer processing of the i-th layer group within the i-th enclave 420 by the layer processing unit 422 (step S708).

[0112] The AI ​​request processing unit 412 instructs the i-th enclave 420 to encrypt the processing result of the layer processing using the encryption processing unit 423 and the query key within the i-th enclave 420 and output it to the normal area 410 as output i (step S709).

[0113] The AI ​​request processing unit 412 deletes the i-th enclave (step S710). For example, when Intel SGX, a representative TEE, is used, the AI ​​request processing unit 412 deletes the enclave using a function called sgx_destroy_enclave. By deleting the enclave, the AI ​​request processing unit 412 deletes AI parameters that will no longer be used from the trusted region 38, and can secure free space in the trusted region 38 for expanding AI parameters of subsequent layers.

[0114] The AI ​​request processing unit 412 determines whether the (i+Pn)th layer group exists by referring to the enclave-layer allocation information 414 (step S711).

[0115] If the AI ​​request processing unit 412 determines that the (i+Pn)th group of layers exists (S711: YES), it transmits to the enclave preparation processing unit 411 a notification of the start of enclave preparation processing for the enclave 420 that processes the (i+Pn)th group of layers (step S712). Upon receiving this start notification, the enclave preparation processing unit 411 executes enclave preparation processing for the (i+Pn)th enclave 420 according to the processing procedure in Fig. 6. By the processing of steps S710 to S712, the number of enclaves 420 does not exceed the number of parallel enclaves Pn.

[0116] If the AI ​​request processor 412 determines that the (i+Pn)th layer group does not exist (S711: NO), the AI ​​request processor 412 advances the process to step S713.

[0117] The AI ​​request processing unit 412 determines whether the final layer is included in the i-th layer group by referring to the enclave-layer allocation information 414 (step S713).

[0118] If the AI ​​request processing unit 412 determines that the final layer is not included in the i-th layer group (S713: NO), it sets the output i to the input i+1 (step S714), adds 1 to i (step S715), and returns to the processing of step S705.

[0119] If the AI ​​request processing unit 412 determines that the final layer is included in the i-th layer group (S713: YES), it outputs the output i as the AI ​​request processing result (an example of the processing result in step S312) to the user terminal 10 that sent the AI ​​processing request, and terminates the AI ​​request processing (step S716).

[0120] The processing of Figures 6 and 7 allows the processing time of the enclave preparation processing for the enclave 420 corresponding to the later layer executed by the enclave preparation processing unit 411 to overlap with the layer processing time of the earlier layer of the multi-layer AI processing in steps S705 to 710 executed by the AI ​​request processing unit 412.

[0121] (1-3) Effects of Example 1 As described above, the secret information processing system 1 of Example 1 performs AI processing using a large-scale multi-layered machine learning model in secret information processing using a TEE, generates an enclave in advance before the start of the AI ​​processing, and loads and decrypts AI parameters necessary for subsequent processing in parallel with the processing of the previous layer of the multi-layered AI processing.

[0122] As a result, the secret information processing system 1 can start processing of the subsequent layer without requiring the time to load and decode AI parameters after the previous processing is completed, thereby suppressing the increase in AI processing time due to the time required to load and decode a large amount of AI parameters, and ultimately speeding up AI processing.

[0123] That is, according to this embodiment, for example, when an LLM (consisting of 1.7 trillion (1.7 trillion) AI parameters) of a typical generative AI application is executed in the trusted domain (256 GB per VM) of Intel SGX, one of the typical TEEs, the increase in the request processing time of the generative AI due to the load time of AI parameters at least approximately 50 times can be suppressed, thereby realizing secure and high-speed large-scale AI processing.

[0124] Furthermore, the confidential information processing server 30 included in the confidential information processing system 1 in Example 1 decrypts and processes the confidential information and the contents of the processing request encrypted only in the trusted area 38, so that the confidential information and the contents of the processing request can be kept confidential from the service administrator, the cloud administrator, and other data holders.

[0125] In this way, the confidential information processing system 1 in Example 1 can provide a confidential information processing service to a service user that quickly performs confidential information processing combining data held by multiple service users, while keeping confidential information secret from the service administrator and the cloud administrator.

[0126] The present invention is not limited to the above-described embodiments, and includes various modifications and equivalent configurations within the spirit and scope of the appended claims. For example, the above-described embodiments have been described in detail to clearly explain the present invention, and the present invention is not necessarily limited to those including all of the described configurations. Furthermore, some configurations of a certain embodiment may be added to, deleted from, or replaced with other configurations.

[0127] Furthermore, the aforementioned configurations, functions, processing units, processing means, etc. may be realized in part or in whole in hardware, for example by designing them as integrated circuits, or may be realized in software by having a processor interpret and execute a program that realizes each function.

[0128] Furthermore, the above-described configurations, functions, processing units, processing means, etc. may be partially or entirely implemented in hardware, for example, by designing them as integrated circuits. The present invention can also be realized by software program code that implements the functions of the embodiments. In this case, a storage medium on which the program code is recorded is provided to a computer, and a processor included in the computer reads the program code stored in the storage medium. In this case, the program code itself read from the storage medium implements the functions of the above-described embodiments, and the program code itself and the storage medium on which it is stored constitute the present invention. Examples of storage media for providing such program code include flexible disks, CD-ROMs, DVD-ROMs, hard disks, solid-state drives (SSDs), optical disks, magneto-optical disks, CD-Rs, magnetic tapes, non-volatile memory cards, and ROMs.

[0129] Furthermore, the program code that realizes the functions described in this embodiment can be implemented in a wide range of program or script languages, such as assembler, C / C++, perl, Shell, PHP, Python, and Java (registered trademark).

[0130] Furthermore, the program code of the software that realizes the functions of the embodiments may be distributed via a network and stored in a storage means such as a computer's hard disk or memory, or in a storage medium such as a CD-RW or CD-R, and the processor of the computer may read and execute the program code stored in the storage means or storage medium.

[0131] In the above-described embodiment, the control lines and information lines are those that are considered necessary for the explanation, and not all control lines and information lines are necessarily shown in the product. All components may be interconnected.

[0132] In addition, the confidential information processing system 1 of this embodiment can achieve the same effect when concealing confidential information, such as trade secrets, in addition to personal information, and confidential information whose disclosure to outside the company is restricted by internal company rules, etc., and providing it to external organizations, etc.

[0133] Furthermore, the confidential information processing system 1 of this embodiment can improve the processing efficiency of advanced deep learning and the like while keeping personal information and confidential business information confidential in multiple organizations that handle personal information such as customer information and medical information, and confidential information such as trade secrets, and therefore can be widely applied to information processing systems for public / private services that link a variety of confidential information. [Explanation of symbols]

[0134] 1 Secret information processing system, 30 Secret information processing server, 31 CPU, 32 Memory, 33 Auxiliary storage device, 34 Network interface, 38 Trusted region, 39 GPU, 410 Normal region, 411 Enclave preparation processing unit, 412 AI request processing unit, 413 Parameter information, 414 Enclave-layer allocation information, 415 Key information, 416 Enclave setting information, 417 Log information, 420 Enclave, 421 Decryption processing unit, 422 Layer processing unit, 423 Encryption processing unit

Claims

1. A computer system comprising one or more computers, each of the one or more computers includes one or more processors and a memory connected to the processors; the one or more processors have an execution environment for establishing a secure and logically isolated trusted domain in a memory connected to the processor; the execution environment has a plurality of logically isolated execution processes; The one or more computers The method includes receiving a request to execute a plurality of block processes having a predetermined execution order and for the encrypted data; For each of the plurality of block processes, A preparation process is performed in which an isolated execution process in which the block processing is executed is generated in the trusted area, and encrypted data used in the block processing is read into the trusted area and decrypted; Executing the block process using the trust region after the preparation process and the block process preceding the block process in the execution order are completed; A computer system that executes, in parallel, the block process and the preparatory process for a block process that is later in the execution order than the block process in question.

2. 2. The computer system of claim 1, The one or more computers maintains information indicating the maximum number of quarantined execution processes that may be run in parallel, a computer system that executes, before receiving the execution request, the preparatory processes corresponding to the block processes whose orders in the execution order are from 1 to the maximum number among the plurality of block processes;

3. 3. The computer system according to claim 2, The one or more computers For each of the plurality of block processes, When the blocking process is completed, the isolation execution process that executed the blocking process is deleted; When it is determined that there exists a block process whose rank in the execution order is equal to the rank of the block process in question plus the maximum number, the computer system executes the preparation process for the existing block process.

4. 2. The computer system of claim 1, The one or more computers retaining allocation information indicating an isolated execution process to which each of the plurality of block processes is assigned; performing the preparatory process for each of the plurality of block processes and each of the plurality of block processes based on the allocation information; The allocation information specifies that the preparatory processing for each of the plurality of block processes is completed before the block process that precedes the block process in the execution order is completed.

5. 2. The computer system of claim 1, The one or more computers For each of the plurality of block processes, If there is a next block process in the execution order of the block process, Encrypt the processing result of the block processing and output it to the isolation execution process that will execute the next block processing; Decrypting the encrypted processing result in the isolation execution process; A computer system that executes the next block processing using the decrypted processing result.

6. 6. The computer system according to claim 5, Each of the plurality of block processes is a layer process corresponding to each layer in AI processing using a multi-layer machine learning model, The one or more computers holding encryption parameters in which parameters used in each of the layer processes are encrypted; In the preparatory processing, the computer system reads encryption parameters corresponding to the layer processing corresponding to the preparatory processing into the trusted region and decrypts them.

7. 2. The computer system of claim 1, One virtual machine runs on the one or more computers, A computer system, wherein the plurality of isolated execution processes are generated in the one virtual machine.

8. 2. The computer system of claim 1, a plurality of virtual machines are running on the one or more computers; A computer system, wherein each of the plurality of isolated execution processes is generated in a different one of the virtual machines.

9. 2. The computer system of claim 1, the one or more computers are a plurality of computers, A computer system, wherein each of the plurality of isolated execution processes is generated on a different computer.

10. An information processing method by a computer system having one or more computers, each of the one or more computers includes one or more processors and a memory connected to the processors; the one or more processors have an execution environment for establishing a secure and logically isolated trusted domain in a memory connected to the processor; the execution environment has a plurality of logically isolated execution processes; The information processing method includes: the one or more computers include a plurality of block processes having a predetermined execution order, and receive a request to execute a process on encrypted data; For each of the plurality of block processes, the one or more computers execute a preparation process to generate an isolated execution process in the trusted area in which the block processing is executed, and to read encrypted data used in the block processing into the trusted area and decrypt the encrypted data; the one or more computers execute the block processing using the trust region after the preparation processing and the block processing preceding the block processing in the execution order are completed; an information processing method, wherein the one or more computers execute the block processing and the preparatory processing for a block processing that is later in the execution order than the block processing in question, in parallel;

11. An information processing program that causes the computer system to execute the information processing method according to claim 10.

Images