Secure computing system, secure computing method, and secure computing program

Abstract

This invention provides a secure computing system, method, and program that combines the CPU's TEE (Trusted Execution Environment) function with a GPU-based TEE to enable the secure execution of machine learning models. [Solution] The secure computing system comprises a first secure computing device 1 equipped with a first TEE of the confidential process type, and a second secure computing device 2 equipped with a second TEE of the confidential virtual machine type and a third TEE of the confidential GPU type. The first and second TEEs execute pre-configured processes, and the third TEE executes inference processing using a machine learning model.

Description

TECHNICAL FIELD

[0001] The present invention relates to a secure computation system, a secure computation method, and a secure computation program. BACKGROUND ART

[0002] In recent years, various hardware-based secure computation technologies have been proposed. Non-Patent Document 1 introduces TEEs (Trusted Execution Environments) such as the confidential library type, confidential process type, confidential container type, and confidential virtual machine type. PRIOR ART DOCUMENTS NON-PATENT DOCUMENTS

[0003] Non-Patent Document 1 Confidential Computing Consortium, “Common Terminology for Confidential Computing”, 2022, <URL: https: / / confidentialcomputing.io / wp-content / uploads / sites / 10 / 2023 / 03 / Common-Terminology-for-Confidential-Computing.pdf> SUMMARY OF THE INVENTION PROBLEM TO BE SOLVED BY THE INVENTION

[0004] There is a need to securely run AI (Artificial Intelligence) models using TEE (Technical Execution Environment). However, it is difficult to run large-scale machine learning models using only the processing power of the CPU (Central Processing Unit) without using a GPU (Graphics Processing Unit). Although GPU-based TEEs such as NVIDIA Confidential Computing have been proposed, simply running machine learning models on this TEE is not sufficiently secure because it is vulnerable to attacks outside of the TEE.

[0005] This invention has been made in view of the above problems, and aims to realize a secure secure computing system that can safely execute machine learning models by combining the CPU's TEE function and a GPU-type TEE. [Means for solving the problem]

[0006] According to one embodiment, the secure computing system comprises a first secure computing device equipped with a first TEE (Trusted Execution Environment) of the confidential process type, a second secure computing device equipped with a second TEE of the confidential virtual machine type, and a third TEE of the confidential GPU type, wherein the first TEE and the second TEE execute pre-configured processes, and the third TEE executes inference processes using machine learning models. [Effects of the Invention]

[0007] According to one embodiment, a secure computing system capable of safely executing machine learning models can be realized by combining the CPU's TEE function and a GPU-type TEE. [Brief explanation of the drawing]

[0008] [Figure 1] This figure shows an example of the configuration of the secure computing device 100. [Figure 2]This figure shows an example of the hardware configuration of the secure computing device 1. [Figure 3] This figure shows an example of the hardware configuration of the secure computing device 2. [Figure 4] This figure shows an example of the hardware configuration of user terminal 3. [Figure 5] This flowchart shows an example of a secure computation method. [Figure 6] This is a schematic diagram illustrating the secure computing system 100. [Modes for carrying out the invention]

[0009] Hereinafter, embodiments of the present invention will be described with reference to the accompanying drawings. In the description and drawings of each embodiment, components having substantially the same functional configuration will be denoted by the same reference numerals, and redundant descriptions will be omitted.

[0010] <System Configuration> First, an overview of the secure computing device 100 according to this embodiment will be described. The secure computing device 100 is an information processing system that combines the TEE function of a CPU and a GPU-type TEE to securely execute machine learning models.

[0011] A TEE is a trusted execution environment generated by the CPU's TEE function, and consists of, for example, a trusted control unit (such as the CPU), a protected memory area generated by the control unit, and a communication path between the control unit and the protected area. The control unit can safely execute processing within the TEE.

[0012] The CPU's TEE function includes a CPU as a reliable control unit, and the internal processing of the TEE is executed by the CPU. Examples of CPU TEE functions include, but are not limited to, Intel SGX, AMD SEV, or Intel TDX.

[0013] A GPU-based TEE is equipped with a reliable GPU, and the internal processing of the TEE is performed by the GPU. Examples of GPU-based TEEs include, but are not limited to, NVIDIA Confidential Computing.

[0014] Figure 1 shows an example of the configuration of a secure computing device 100. As shown in Figure 1, the secure computing device 100 comprises a secure computing device 1, a secure computing device 2, and a user terminal 3, all of which are connected to each other via a network N so as to be able to communicate with each other. The network N is, for example, a wired LAN (Local Area Network), a wireless LAN, the Internet, a public telephone network, a mobile data communication network, or a combination thereof. In the example in Figure 1, the secure computing device 100 comprises one each of secure computing devices 1 and 2 and a user terminal 3, but it may also comprise multiple units of each.

[0015] The secure computing device 1 is a first secure computing device, which is an information processing device equipped with a first TEE. The secure computing device 1 functions as a gateway between the secure computing device 2 and the user terminal 3. The secure computing device 1 is, for example, a PC (Personal Computer), a smartphone, a tablet terminal, a server device, or a microcomputer, but is not limited to these.

[0016] The first type of TEE is a hardware-based confidential process type TEE. The first type of TEE can be implemented, for example, by Intel SGX, but is not limited to this. The first type of TEE is designed to execute only pre-configured processes. This prevents malicious programs from being executed by the first type of TEE through external attacks, thereby guaranteeing its security. The processes executed by the first type of TEE will be described later.

[0017] The secure computing apparatus 2 is a second secure computing apparatus, which is an information processing apparatus provided with a second TEE and a third TEE. The secure computing apparatus 2 executes inference processing using a machine learning model. The secure computing apparatus 2 is, for example but not limited to, a PC, a smartphone, a tablet terminal, a server apparatus, or a microcomputer.

[0018] The second TEE is a hardware-based confidential virtual machine type TEE. The second TEE is implemented by, for example but not limited to, AMD SEV or Intel TDX. The second TEE is designed to be capable of executing only preset processing. This prevents an unauthorized program from being executed in the second TEE due to an external attack, and guarantees the security of the second TEE. The processing executed by the second TEE will be described later.

[0019] The third TEE is a hardware-based confidential GPU type TEE. The third TEE is implemented by, for example but not limited to, NVIDIA Confidential Computing. The third TEE is designed to be capable of executing only inference processing of a pre-prepared machine learning model. This prevents an unauthorized program from being executed in the third TEE due to an external attack, and guarantees the security of the third TEE. The processing executed by the third TEE will be described later.

[0020] The user terminal 3 is an information processing apparatus used by a user of the secure computing system 100. The user terminal 3 is, for example but not limited to, a PC, a smartphone, or a tablet terminal.

[0021] <Hardware Configuration of Secure Computing Apparatus 1> Next, the hardware configuration of the secure computing apparatus 1 will be described. FIG. 2 is a diagram showing an example of the hardware configuration of the secure computing apparatus 1. As shown in FIG. 2, the secure computing apparatus 1 includes a control unit 11, a storage unit 12, and a communication unit 13, which are mutually connected via a bus B1.

[0022] The control unit 11 executes various programs stored in the memory unit 12, controls the entire secure computing device 1, and realizes the functions of the secure computing device 1. The control unit 11 is the CPU and realizes the first TEE.

[0023] The memory unit 12 is a computer-readable recording medium that stores various programs and data. The memory unit 12 is, for example, ROM (Read Only Memory), RAM (Random Access Memory), flash memory, HDD (Hard Disk Drive), SSD (Solid State Drive), SCM (Storage Class Memories), or a combination thereof. Part or all of the RAM of the memory unit 12 is used as a protection area for the first TEE.

[0024] The communication unit 13 controls communication between the secure computing device 1 and external devices via the network N. The communication unit 13 is, for example, a Bluetooth® module, a Wi-Fi® module, a ZigBee® module, an Ethernet® module, a mobile communication module, or a combination thereof.

[0025] In this embodiment, the program may be written to the storage unit 12 during the manufacturing stage of the secure computing device 1, provided to the secure computing device 1 via the network N, or provided to the secure computing device 1 via a non-temporary, computer-readable recording medium such as a recording medium. Examples of recording media include CD (Compact Disc), DVD (Digital Versatile Disc), FD (Floppy Disk), MO (Magneto-Optical disk), BD (Blu-ray® Disc), USB® memory, SD card, or a combination thereof.

[0026] <Hardware configuration of secure computing device 2> Next, the hardware configuration of the secure computing device 2 will be described. Figure 3 shows an example of the hardware configuration of the secure computing device 2. As shown in Figure 3, the secure computing device 2 comprises a control unit 21, a storage unit 22, a communication unit 23, a processing unit 24, and a storage unit 25, all interconnected via bus B2.

[0027] The control unit 21 executes various programs stored in the memory unit 22, controls the entire secure computing device 2, and realizes the functions of the secure computing device 2. The control unit 21 is the CPU and realizes the second TEE.

[0028] The storage unit 22 is a computer-readable recording medium that stores various programs and data. The storage unit 22 is, for example, ROM, RAM, flash memory, HDD, SSD, SCM, or a combination thereof. Part or all of the RAM of the storage unit 22 is used as a protection area for the second TEE.

[0029] The communication unit 13 controls communication between the secure computing device 1 and external devices via the network N. The communication unit 13 is, for example, a Bluetooth® module, a Wi-Fi® module, a ZigBee® module, an Ethernet® module, a mobile communication module, or a combination thereof.

[0030] The processing unit 24 executes inference processing of the machine learning model stored in the memory unit 25. The processing unit 24 is a GPU and realizes a third TEE.

[0031] The storage unit 25 is a computer-readable recording medium that stores various programs and data. The storage unit 25 is, for example, ROM, RAM, flash memory, HDD, SSD, SCM, or a combination thereof. Part or all of the RAM of the storage unit 25 is used as a protection area for the third TEE.

[0032] In this embodiment, the program may be written to the storage units 22 and 25 during the manufacturing stage of the secure computing device 2, or it may be provided to the secure computing device 2 via the network N, or it may be provided to the secure computing device 2 via a non-temporary, computer-readable recording medium such as a recording medium. Examples of recording media include CD (Compact Disc), DVD (Digital Versatile Disc), FD (Floppy Disk), MO (Magneto-Optical disk), BD (Blu-ray® Disc), USB® memory, SD card, or a combination thereof.

[0033] <Hardware configuration of user terminal 3> Next, the hardware configuration of user terminal 3 will be described. Figure 4 shows an example of the hardware configuration of user terminal 3. As shown in Figure 4, user terminal 3 comprises a control unit 31, a storage unit 32, a communication unit 33, an input unit 34, and an output unit 35, all interconnected via bus B3.

[0034] The control unit 31 executes various programs stored in the memory unit 32, controls the entire user terminal 3, and realizes the functions of the user terminal 3. The control unit 31 is, for example, a CPU, MPU, GPU, ASIC, DSP, or a combination thereof.

[0035] The storage unit 32 is a computer-readable recording medium that stores various programs and data. The storage unit 32 may be, for example, ROM, RAM, flash memory, HDD, SSD, SCM, or a combination thereof.

[0036] The communication unit 33 controls communication between the user terminal 3 and external devices via the network N. The communication unit 33 is, for example, a Bluetooth® module, a Wi-Fi® module, a ZigBee® module, an Ethernet® module, a mobile communication module, or a combination thereof.

[0037] The input unit 34 inputs information to the user terminal 3. The input unit 34 may be, for example, a mouse, keyboard, touch panel, microphone, scanner, camera, various sensors, operation buttons, or a combination thereof.

[0038] The output unit 35 outputs information from the user terminal 3. The output unit 35 is, for example, a display device (display), projector, printer, speaker, vibrator, or a combination thereof.

[0039] In this embodiment, the program may be written to the storage unit 32 during the manufacturing stage of the user terminal 3, provided to the user terminal 3 via the network N, or provided to the user terminal 3 via a non-temporary, computer-readable recording medium such as a recording medium. The recording medium may be, for example, a CD, DVD, FD, MO, BD, USB® memory, SD card, or a combination thereof.

[0040] <Secure calculation method> Next, the secure computing method performed by the secure computing device 100 will be described. Figure 5 is a flowchart showing an example of the secure computing method performed by the secure computing device 100. Figure 6 is a schematic diagram showing the secure computing system 100.

[0041] Hereinafter, the second TEE will consist of DBs (Databases) 26 and 27 and machine learning models 28 and 29. The machine learning models 28 and 29 are large-scale language models (LLMs), and DBs 26 and 27 are databases referenced by the machine learning models 28 and 29 for use in RAG (Retrieval-Augmented Generation). Note that DBs 26 and 27 and machine learning models 28 and 29 may each be located in different TEE instances, or two or more may be located in the same TEE instance.

[0042] (Step S101) First, the user operates the user terminal 3 to request the execution of the machine learning model's inference process. The control unit 31 of the user terminal 3 receives the execution request. At this time, the user inputs prompts to be used for the inference process. The user may also input information specifying the data to be used for the inference process, the machine learning model to execute the inference process, and the database to be referenced during the inference process.

[0043] (Step S102) When the control unit 31 receives an execution request, it performs an attestation between the user terminal 3 and the secure computing device 1 (first TEE). Attestation is a process that verifies the trustworthiness of each other between information processing devices. The attestation is a remote attestation, but is not limited to that.

[0044] (Step S103) If the attestation is successful, the control unit 31 sends an execution request to the secure computing device 1 (first TEE). The execution request includes prompts used for inference processing. The execution request may also include user information, data used for inference processing, and information specifying the machine learning model to execute the inference processing and the database to be referenced in the inference processing.

[0045] User information is information about a user, including user identification information and attribute information. User identification information includes information that uniquely identifies the user, such as an identifier, email address, telephone number, and name. User attribute information includes information that indicates the user's department, position, job title, team, age, gender, and address.

[0046] Furthermore, when the control unit 31 transmits an execution request, it may encrypt the execution request using a predetermined encryption method before transmitting it to the secure computing device 1.

[0047] (Step S104) When an execution request is received from user terminal 3, the control unit 11 of the secure computing device 1 (first TEE) selects the target to be used based on the execution request. The target to be used is the machine learning model that executes the inference process and the database that is referenced in the inference process.

[0048] If the execution request includes information specifying the targets to be used, the control unit 11 may select the targets specified in the execution request as they are. For example, if the execution request includes information specifying machine learning model 28 as the machine learning model to execute the inference process, and also includes information specifying DB26 as the DB to be referenced in the inference process, the control unit 11 will select DB26 and machine learning model 28 as the targets to be used.

[0049] This enables the realization of a secure computing system 100 that provides multiple machine learning models and databases available to the user, allowing the user to use the machine learning model and database of their choice. With such a secure computing system 100, for example, multiple machine learning models trained on different data (legal data, accounting data, etc.) and databases storing different data (legal data, accounting data, etc.) can be provided, allowing the user to use the machine learning model and database according to their needs.

[0050] Furthermore, if the execution request does not include information specifying the target of use, the control unit 11 selects the target of use based on the user attribute information included in the execution request. In the latter case, the first TEE is provided with a target of use DB that shows the relationship between the user's attribute information and the target of use that the user with those attributes is authorized to use, and the control unit 11 can refer to the target of use DB to select the target of use for the user.

[0051] For example, if the user is in the legal department, and the user's attribute information includes information indicating their department (legal department), and DB27 and machine learning model 29 are set as targets for use by the legal department in the target database, the control unit 11 will select DB27 and machine learning model 29 as targets for use.

[0052] This enables the realization of a secure computation system 100 that provides multiple machine learning models and databases available to the user, and automatically selects and makes available the models and databases to which the user has the necessary permissions. With such a secure computation system 100, for example, multiple machine learning models trained on different data (legal data, accounting data, etc.) and databases storing different data (legal data, accounting data, etc.) can be prepared, and the system can automatically select and use the machine learning models and databases to which the user has the necessary permissions according to the user's attributes.

[0053] Furthermore, if the third TEE has only one machine learning model and database to be used, step S104 can be omitted. Also, if the execution request received from the user terminal 3 is encrypted, the control unit 11 may decrypt the execution request using a predetermined encryption method before selecting the target.

[0054] (Step S105) When the control unit 11 selects the target device, it performs an attestation between the secure computing device 1 (first TEE) and the secure computing device 2 (second TEE). Attestation is a process that verifies the trustworthiness of each other between information processing devices. The attestation is a remote attestation, but is not limited to that.

[0055] (Step S106) If the attestation is successful, the control unit 11 sends an execution request to the secure computing device 2 (second TEE). The execution request includes prompts used for inference processing. The execution request may also include user information, data used for inference processing, and information specifying the target (machine learning model to execute the inference processing and the DB referenced in the inference processing).

[0056] Furthermore, when the control unit 11 transmits an execution request, it may encrypt the execution request using a predetermined encryption method before transmitting it to the secure computing device 2.

[0057] (Step S107) Upon receiving an execution request from the secure computing device 1, the control unit 21 of the secure computing device 2 causes the third TEE (processing unit 24) to execute an inference process using the specified target based on the execution request.

[0058] More specifically, the control unit 21 sends an execution request for inference processing to the third TEE (processing unit 24). The execution request includes a prompt to be used for inference processing and information on the target of use (a machine learning model to execute the inference processing and a database to be referenced in the inference processing) specified by the information specifying the target of use. The execution request may also include data to be used for inference processing.

[0059] When the third TEE (processing unit 24) receives an execution request from the second TEE (control unit 21), it executes the inference process using the prompts, data, and targets (the machine learning model that executes the inference process and the database referenced in the inference process). For example, if the targets are the database 26 and the machine learning model 28, the third TEE (processing unit 24) inputs the prompts and data entered by the user into the machine learning model 28, references the database 26, and executes the inference process using the machine learning model 28.

[0060] Subsequently, the third TEE (processing unit 24) transmits the result of the inference process to the second TEE (control unit 21).

[0061] Furthermore, if the execution request received from the first TEE (control unit 11) is encrypted, the control unit 21 may decrypt the execution request using a predetermined encryption method before having the third TEE (processing unit 24) perform the inference process.

[0062] (Step S108) Upon receiving the inference processing result from the third TEE (processing unit 24), the second TEE (control unit 21) transmits the inference processing result to the secure computing device 1. When transmitting the execution result, the control unit 21 may encrypt the execution result using a predetermined encryption method before transmitting it to the secure computing device 1.

[0063] (Step S109) When the inference processing result is received from the secure computing device 2, the control unit 11 (first TEE) of the secure computing device 1 transmits the inference processing result to the user terminal 3. If the execution result received from the secure computing device 2 is encrypted, the control unit 11 may decrypt the execution result using a predetermined encryption method before transmitting it to the user terminal 3. Alternatively, when transmitting the execution result, the control unit 11 may encrypt the execution result using a predetermined encryption method before transmitting it to the user terminal 3.

[0064] (Step S110) When the control unit 31 of the user terminal 3 receives the execution result of the inference process from the secure computing device 1, it displays the received execution result on the display device (output unit 35). If the execution result received from the secure computing device 1 is encrypted, the control unit 31 may decrypt the execution result using a predetermined encryption method before displaying it.

[0065] <Summary> As described above, according to this embodiment, a secure computing system 100 can be realized comprising a secure computing device 1 equipped with a first TEE (Trusted Execution Environment) of the confidential process type, a secure computing device 2 equipped with a second TEE of the confidential virtual machine type, and a third TEE of the confidential GPU type, wherein the first TEE and the second TEE execute pre-configured processes, and the third TEE executes inference processing using a machine learning model.

[0066] According to this embodiment, since the machine learning model is executed on the processing unit 24 (GPU), the secure computing system 100 can execute large-scale machine learning models that are difficult to execute on a CPU, such as large-scale language models.

[0067] Furthermore, since all processes related to the execution of the machine learning model are performed within the TEE, the secure computing system 100 can execute the machine learning model securely.

[0068] Furthermore, since the first TEE and the second TEE are designed to execute only pre-configured processes, the secure computing system 100 can prevent malicious programs from being executed in the first TEE and the second TEE due to external attacks, thereby guaranteeing the security of the first TEE and the second TEE. As a result, the secure computing system 100 can securely execute machine learning models.

[0069] Furthermore, by having a third TEE (a confidential GPU-type system) execute a machine learning model via a second TEE (a confidential virtual machine-type system), even if there is incompatibility between the first TEE (a confidential process-type system) and the third TEE, the highly secure first TEE can execute the inference processing in response to the execution request it received.

[0070] <Note> This embodiment includes the following disclosures.

[0071] (Note 1) A first confidential computing device equipped with a first confidential process type TEE (Trusted Execution Environment), A second confidential computing device comprising a second TEE of the confidential virtual machine type and a third TEE of the confidential GPU type, Equipped with, The first TEE and the second TEE execute pre-configured processes. The third TEE performs inference processing using a machine learning model. A secure computing system.

[0072] (Note 2) The first TEE receives an inference processing execution request from the user terminal, specifies a machine learning model to execute the inference processing, and transmits the inference processing execution request to the second TEE. The secure computing system described in Appendix 1.

[0073] (Note 3) The second TEE causes the specified machine learning model to perform the inference process based on the execution request received from the first TEE. The secure computing system described in Appendix 2.

[0074] (Note 4) The first TEE selects a machine learning model to perform the inference process based on the execution request from the user terminal. The secure computing system described in Appendix 2.

[0075] (Note 5) The execution request from the user terminal includes information specifying the machine learning model that will perform the inference process. The secure computing system described in Appendix 2.

[0076] (Note 6) The first TEE selects a database to be referenced by the machine learning model that performs the inference process, based on the execution request from the user terminal. The secure computing system described in Appendix 2.

[0077] (Note 7) The execution request from the user terminal includes information specifying the database referenced by the machine learning model that performs the inference process. The secure computing system described in Appendix 2.

[0078] (Note 8) The aforementioned machine learning model is a large-scale language model. The secure computing system described in Appendix 1.

[0079] (Note 9) The execution request from the user terminal includes a prompt to be executed by the large-scale language model. The secure computing system described in Appendix 8.

[0080] (Note 10) A first confidential computing device equipped with a first confidential process type TEE (Trusted Execution Environment), A second confidential computing device comprising a second TEE of the confidential virtual machine type and a third TEE of the confidential GPU type, A secure computation method performed by a secure computation system comprising: The first TEE and the second TEE execute pre-configured processes. The third TEE performs inference processing using a machine learning model. Secret computation method.

[0081] (Note 11) A first confidential computing device equipped with a first confidential process type TEE (Trusted Execution Environment), A second confidential computing device comprising a second TEE of the confidential virtual machine type and a third TEE of the confidential GPU type, A secure computing system equipped with The first TEE and the second TEE execute pre-configured processes. The third TEE performs inference processing using a machine learning model. A secure computation program that executes a secure computation method.

[0082] The embodiments disclosed herein should be considered in all respects to be illustrative and not restrictive. The scope of the present invention is indicated by the claims, not in the sense described above, and is intended to include all modifications in the sense and scope equivalent to the claims. Furthermore, the present invention is not limited to the embodiments described above, and various modifications are possible within the scope of the claims, and embodiments obtained by appropriately combining the technical means disclosed in different embodiments are also included in the technical scope of the present invention. [Explanation of Symbols]

[0083] 1,2:Secret computing device 3: User terminal 11,21,31: Control Unit 12,22,25,31: Storage part 13, 23, 31: Communications Department 24: Processing Unit

Claims

1. A first confidential computing device equipped with a first confidential process type TEE (Trusted Execution Environment), A second confidential computing device comprising a second TEE of the confidential virtual machine type and a third TEE of the confidential GPU type, Equipped with, The first TEE and the second TEE execute pre-configured processes. The third TEE performs inference processing using a machine learning model. A secure computing system.

2. The first TEE receives an inference processing execution request from the user terminal, specifies a machine learning model to execute the inference processing, and transmits the inference processing execution request to the second TEE. The secure computing system according to claim 1.

3. The second TEE causes the specified machine learning model to perform the inference process based on the execution request received from the first TEE. The secure computing system according to claim 2.

4. The first TEE selects a machine learning model to perform the inference process based on the execution request from the user terminal. The secure computing system according to claim 2.

5. The execution request from the user terminal includes information specifying the machine learning model that will perform the inference process. The secure computing system according to claim 2.

6. The first TEE selects a database to be referenced by the machine learning model that performs the inference process, based on the execution request from the user terminal. The secure computing system according to claim 2.

7. The execution request from the user terminal includes information specifying the database referenced by the machine learning model that performs the inference process. The secure computing system according to claim 2.

8. The aforementioned machine learning model is a large-scale language model. The secure computing system according to claim 1.

9. The execution request from the user terminal includes a prompt to be executed by the large-scale language model. The secure computing system according to claim 8.

10. A first confidential computing device equipped with a first confidential process type TEE (Trusted Execution Environment), A second confidential computing device comprising a second TEE of the confidential virtual machine type and a third TEE of the confidential GPU type, A secure computation method performed by a secure computation system comprising: The first TEE and the second TEE execute pre-configured processes. The third TEE performs inference processing using a machine learning model. Secret computation method.

11. A first confidential computing device equipped with a first confidential process type TEE (Trusted Execution Environment), A second confidential computing device comprising a second TEE of the confidential virtual machine type and a third TEE of the confidential GPU type, A secure computing system equipped with The first TEE and the second TEE execute pre-configured processes. The third TEE performs inference processing using a machine learning model. A secure computation program that executes a secure computation method.

Images