Storage device, information processing system, and information processing method

Abstract

Provided is a storage device in an information processing system provided with the storage device and a processing device, wherein the storage device comprises: a storage unit for storing a tree structure in which data is held on a path corresponding to a randomized address value; a conversion unit for converting a data-search key value to the address value; and a transfer unit for transferring data on the path corresponding to the address value, said data being read from the storage unit, to the processing device.

Description

Storage device, information processing system, and information processing method

[0001] The present invention relates to a countermeasure against side channel attacks that applies Oblivious RAM (hereinafter referred to as ORAM).

[0002] In a typical conventional computer model, the CPU is responsible for controlling all program instructions. In contrast, a technology called the Memory Centric Model is being studied, in which memory is the main driver for controlling program instructions without the intervention of the CPU. While this technology is expected to significantly improve computational speed compared to the conventional computer model, it has the drawback of effectively enabling side-channel attacks by externally observing the timing of memory reads and writes and the positions of cells (Non-Patent Document 1).

[0003] ZiyuWang, Fan hsuan Meng, Yongmo Park, Jason K. Eshraghian, and Wei D.Lu. Side-channel attack analysis on in-memory computing architectures. IEEE Transactions on Emerging Topics in Computing, pp. 1-13, 2023.

[0004] As described above, side channel attacks are effective in the Memory Centric Model. However, Non-Patent Document 1 does not disclose a specific method for implementing countermeasures against side channel attacks.

[0005] The present invention has been made in view of the above points, and aims to provide a technique for implementing countermeasures against side channel attacks in a memory-centric model.

[0006] According to the disclosed technology, there is provided a storage device in an information processing system comprising a storage device and a processing device, the storage device comprising: a storage unit that stores a tree structure that holds data on a path corresponding to a randomized address value; a conversion unit that converts a key value for data search into the address value; and a transfer unit that transfers the data on the path corresponding to the address value read from the storage unit to the processing device.

[0007] According to the disclosed technology, it is possible to implement countermeasures against side channel attacks in a memory-centric model.

[0008] 1 is a diagram showing a terminal configuration comprising a CPU, a GPU, and a memory. FIG. 2 is a diagram showing a terminal configuration comprising a CPU, a GPU, and a memory. FIG. 3 is a diagram for explaining an overview of a side channel attack. FIG. 4 is a diagram for explaining a tree-based ORAM. FIG. 5 is a diagram showing an example of the configuration of an information processing system. FIG. 6 is a diagram showing an example of the configuration of a memory 100 in an embodiment. FIG. 7 is a flowchart for explaining the operation in an embodiment. FIG. 8 is a diagram showing an example of the functional configuration of a storage device 100. FIG. 9 is a diagram showing an example of the hardware configuration of a device.

[0009] Hereinafter, an embodiment of the present invention will be described with reference to the drawings. The embodiment described below is merely an example, and the embodiment to which the present invention is applied is not limited to the following embodiment.

[0010] In this embodiment, ORAM is used as a method for randomizing access patterns to data, but the technology according to the present invention can also be applied to methods for randomizing access patterns to data other than ORAM.

[0011] In the following, first, the conventional technology and its problems will be described in more detail, and then the technology according to the present embodiment will be described using examples.

[0012] (Regarding the Prior Art) A computational model (or architecture) known as the Memory Centric Model is disclosed, for example, in "Anteneh Gebregiorgis, Hoang Anh Du Nguyen, Jintao Yu, Rajendra Bishnoi, Mottaqiallah Taouil, Francky Catthoor, and Said Hamdioui. A survey on memory-centric computer architectures. Vol. 18, No. 4, 2022."

[0013] The Memory Centric Model differs from conventional computer architectures in which all processing and information transmission is controlled by the CPU. Instead, memory is at the center of processing, reducing the time required for data transfer and reducing the load on the CPU, thereby improving calculation speed.

[0014] For example, in a terminal configuration consisting of a CPU, a GPU, and a memory as shown in Figure 1, in a conventional CPU-centric architecture, even when executing a calculation using the GPU, the CPU first obtains a program instruction related to data transfer from the memory (S1 in Figure 1), and then performs processing to transfer the data in the memory to the GPU based on this instruction (S2). In this way, in a conventional CPU-centric architecture, the CPU is responsible for controlling all program instructions.

[0015] In contrast, in the Memory Centric Model, memory is the main body that controls these transfer commands. For example, as shown in Figure 2, program commands that use the GPU are sent directly to the GPU without going through the CPU, thereby reducing the load on the CPU. While this technology is expected to significantly improve the calculation speed compared to conventional computers, there is also a concern that side-channel attacks, which involve externally observing the timing of memory reads and writes and the position of cells, could be effectively carried out to steal data from within the computer. For example, as disclosed in Non-Patent Document 1, a side-channel attack that can extract machine learning models is known in the Memory Centric Model.

[0016] An example of a method for extracting a machine learning model will be described with reference to Fig. 3. For example, as shown in Fig. 3, it is assumed that parameter values ​​of layer 1 (e.g., convolutional layer) of a machine learning model are stored in area 1 of a memory, parameter values ​​(neuron weights, etc.) of layer 2 (e.g., pooling layer) are stored in area 2, and parameter values ​​of layer 3 (e.g., FC layer) are stored in area 3.

[0017] In inference using a machine learning model, parameter values ​​are read from memory and processing proceeds. In this case, an attacker who does not know the structure of the machine learning model can observe changes in power consumption in each area of ​​the memory and infer from the period of these changes that the machine learning model is a model consisting of layers 1, 2, and 3.

[0018] On the other hand, ORAM is an algorithm that allows a client, who is the owner of data, to securely access a storage server where the data is stored, and is realized, for example, by the method shown in "Oded Goldreich and Rafail Ostrovsky. Software protection and simulation on oblivious rams. J. ACM, Vol. 43, No. 3, pp. 431-473, 1996."

[0019] One of the applications of ORAM is to counter side-channel attacks by concealing access patterns, which stems from the fact that ORAM is a secure computing technology that safely simulates a computational model called a RAM (Random Access Machine) and allows RAM program execution between a client and a server.

[0020] RAM is a computer model that can be said to be the basis of the CPU-centric architecture mentioned above, in which the CPU that executes instructions (programs) accesses the memory that stores the instructions as appropriate to read and write data and execute instructions.

[0021] ORAM replaces the CPU with the client (the data owner / program executor) and the memory with the server (the data recipient), and uses an algorithm that conceals access patterns to make the data read / write locations appear random to an attacker (server), while still ensuring that the client can correctly load the desired data. This property of concealing access patterns can be used not only in client-server bilateral protocols, but also in data transfers between the CPU and memory on a single computer, making it a countermeasure against side-channel attacks.

[0022] (Regarding the Issues) As described above, Non-Patent Document 1 discloses that side-channel attacks are effective in the Memory Centric Model, and also lists countermeasures such as randomizing the timing and number of memory references and randomizing the data reference location. However, the document does not describe specific methods in detail, and does not mention a technique for providing provable security. In other words, the conventional technology disclosed in Non-Patent Document 1 has the issue of not being able to implement countermeasures against side-channel attacks in the Memory Centric Model.

[0023] (Outline of the embodiment) In order to solve the above problem, in this embodiment, among the ORAM algorithms, a method of modifying the tree-based ORAM algorithm in particular for the Memory Centric Model and preventing side channel attacks by randomizing the access pattern and the number of memory references will be described.

[0024] The side channel attacks to be prevented are not limited to specific attacks, but include, for example, attacks listed in Non-Patent Document 1. First, the tree-based ORAM that is the basis of the processing according to this embodiment will be described below.

[0025] (Tree-based ORAM) Tree-based ORAM is disclosed, for example, in "Emil Stefanov, Marten van Dijk, Elaine Shi, Christopher Fletcher, Ling Ren, XiangyaoYu, and Srinivas Devadas. Path oram: An extremely simple oblivious ram protocol. In CCS, pp. 299-310, 2013."

[0026] In a tree-based ORAM, each piece of data is distributed in a binary tree-like data structure. Note that the use of a binary tree is just an example. Tree structures other than a binary tree may also be used.

[0027] Each node in a binary tree can store O(1) pieces of data, and the number of leaf nodes is equal to or greater than the total number of stored data. Each piece of data is associated with a randomly selected leaf node, and the algorithm ensures that the data associated with the leaf always exists on the path from the root to the leaf.

[0028] When reading or writing data, the path where the desired data exists is searched from the root to the leaves to obtain the data. To prevent the access pattern from being leaked on a second access, once accessed data is linked to a new random leaf and re-stored in the binary tree so that it exists "on the path from the root to the corresponding leaf." At this time, a table (called a Position Map) is created that stores pairs of the logical address k of each piece of data and the leaf l associated with that logical address k, thereby retaining information so that the appropriate path can be traced when retrieving any data. The leaf identifier l may also be called the leaf address value.

[0029] Furthermore, in many tree-based ORAMs, a data backup area called a stash is prepared as a temporary data storage area when the capacity of a binary tree or some of its nodes exceeds the capacity.

[0030] 4 shows an example of a binary tree and a position map. In the example of FIG. 4, data v at logical address k has an address value l ｋ The data is linked to the leaf identified by ｋ It is stored at one of the nodes on the path to

[0031] In a conventional tree-based ORAM, a client (a data owner / program executor) has a Position Map and a stash, and a server (a data entrusted party) has a binary tree. When a conventional tree-based ORAM is applied inside a computer, the client is a CPU and the server is a memory.

[0032] (Recursive Tree-Based ORAM) As a variation of the tree-based ORAM, a technique for recursively storing the above-mentioned position map in a tree-based ORAM is known (e.g., "Emil Stefanov, Marten van Dijk, Elaine Shi, Christopher Fletcher, Ling Ren, XiangyaoYu, and Srinivas Devadas. Path oram: An extremely simple oblivious ram protocol. In CCS, pp. 299-310, 2013."). Specifically, each pair (k, l) stored in the position map is grouped into a set of multiple pairs and stored in a binary tree smaller than the original tree. Then, for a new position map, a new pair is created and stored in the smaller binary tree. By recursively storing the position map in the tree-based ORAM in this manner, the space and time computational complexity required for storing and searching the position map is reduced.

[0033] The technology according to this embodiment will be described below using examples.

[0034] Example In this example, an information processing system will be described in which the framework of a tree-based ORAM is modified to fit the Memory Centric Model, and the access pattern and the number of accesses are randomized to prevent side channel attacks.

[0035] Fig. 5 shows an example of the configuration of an information processing system in this embodiment. As shown in Fig. 5, this information processing system has a memory 100 and a GPU 200. The memory 100 and the GPU 200 are connected by a communication line, allowing communication between the memory 100 and the GPU 200. Furthermore, this information processing system may be provided with a plurality of memories 100, or a plurality of GPUs 200. Note that an instruction processing circuit other than a GPU (e.g., a CPU) may be used instead of the GPU 200.

[0036] The configuration having the memory 100 and the GPU 200 is, for example, the internal configuration of one computer. However, this is not limiting, and the memory 100 may be the memory of one computer and the GPU 200 may be a GPU in another computer. Also, the memory 100 may be a server and the GPU 200 may be a client.

[0037] The memory 100 may be referred to as the "storage device 100" and the GPU 200 may be referred to as the "processing device 200."

[0038] In this example, similar to the problem setting in Non-Patent Document 1, it is assumed that neural network calculations are performed between the GPU 200 and the memory 100. In this example, the binary tree structure of the tree-based ORAM stores a pair of a parameter value v of each neuron in the neural network and an identifier k of each neuron. Furthermore, the identifiers (sets of) required neurons in each layer of the neural network are unique and are shared information by both the memory 100 and the GPU 200.

[0039] In an existing tree-based ORAM (non-recursive variation), the client has a position map and a stash, and the server has a binary tree. In contrast, in this embodiment, as shown in FIG. 6, memory 100 has a position map, a stash, and a binary tree.

[0040] (Processing Procedure) The processing procedure for transferring parameter values ​​of neurons from the memory 100 to the GPU 200 in the information processing system of this embodiment will be described with reference to the flowchart of FIG.

[0041] <S101> In S101, the GPU 200 specifies to the memory 100 an identifier k of a parameter value of a neuron that has not yet been read out from among the parameter values ​​of neurons in the network layer currently being processed.

[0042] <S102> In S102, in the case of a non-recursive variation, the memory 100 checks all data in the Position Map against k and obtains the leaf address value 1 associated with it. In the case of a recursive variation, the memory 100 searches using k in order from the smallest binary trees and similarly obtains the leaf address value 1 of the largest tree.

[0043] <S103> In S103, the memory 100 transfers all data in all nodes and stashes on the path from the root to the leaf l (the leaf whose address value is l) to the GPU 200. The GPU 200 acquires all data required in the network layer during processing from the received data group, copies the data to a local storage area, and stores the data.

[0044] The GPU 200 also removes the data (k, v) from the path or stash, and returns the remaining path and stash, as well as the data (k, v), to the memory 100 .

[0045] For example, if data (k, v) exists at any node on the path from the root to leaf l, data (k, v) is removed from that node. In this case, all data on the path from which data (k, v) was removed, all data in the stash, and data (k, v) are returned to memory 100.

[0046] If data (k, v) exists in the stash, the data (k, v) is removed from the stash. In this case, all data in the stash from which data (k, v) was removed, all data on the path from the root to leaf l, and data (k, v) are returned to memory 100.

[0047] <S104> In S104, the memory 100 stores the path data and stash data returned from the GPU 200, generates a new random leaf address value l' corresponding to k, and updates the Position Map.

[0048] That is, the memory 100 saves the data of each node in the path from the root to leaf l returned from the GPU 200 in each node of the path in the binary tree, and stores the stash data returned from the GPU 200 in the stash area. Note that data already stored in the path / stash in the memory 100 is replaced with the data returned from the GPU 200.

[0049] By updating the Position Map as described above, the address value l of the leaf corresponding to k in the Position Map is updated to l'.

[0050] <S105> In S105, the memory 100 restores the data (k, v) to a binary tree in accordance with the tree-based ORAM algorithm. Specifically, the memory 100 restores the data (k, v) to a path from the root to a leaf l' (a leaf identified by an address value l').

[0051] Note that either or both of the full search of the Position Map in S102 and the series of processes in S104 and S105 can be outsourced to the GPU 200 instead of being processed in the memory 100.

[0052] By the above process, accesses to the binary tree are randomized in the memory 100, so that the access pattern and number of accesses to the binary tree can be kept secret.

[0053] (Example of Functional Configuration of Storage Device 100) As described above, the memory 100 may be called the storage device 100. Furthermore, the storage device 100 is not limited to a component within a computer, but may be one or more computers. An example of the functional configuration of the storage device 100 is shown in FIG. 8.

[0054] 8, the storage device 100 includes a storage unit 110, a conversion unit 120, a transfer unit 130, and a processing unit 140. The storage device 100 may further include a memory area for storing a stash. The storage unit 110 may include an area for the stash.

[0055] The storage unit 110 stores a tree structure that holds data on paths corresponding to randomized address values.

[0056] The conversion unit 120 converts the key value for data search into an address value in the tree structure. In the above-described embodiment, the conversion unit 120 includes a position map and converts the key value into an address value using the position map.

[0057] The transfer unit 130 transfers the data on the path corresponding to the address value read from the storage unit 110 to the processing device 200 .

[0058] The processing unit 140 receives from the processing device 200 the data on the path from which the pair of the key value and the parameter value corresponding to the key value has been removed, and the pair, and stores the data on the path in the storage unit 110. The processing unit 110 also re-stores the pair on the path corresponding to a randomly selected leaf in the tree structure.

[0059] It should be noted that in each of the conversion unit 120, the transfer unit 130, and the processing unit 140, all or part of the processing may be outsourced to the processing device 200. Even in such cases where outsourcing is performed, the function of the processing device 200 to execute the outsourced processing may be interpreted as being included in the storage device 100.

[0060] (Hardware Configuration Example) Any of the devices described in this embodiment (memory, storage device, GPU, instruction processing circuit, processing device, information processing system, etc.) can be realized, for example, by causing a computer to execute a program. This computer may be a physical computer or a virtual machine on the cloud.

[0061] That is, the device can be realized by executing a program corresponding to the processing performed by the device using hardware resources such as a CPU and memory built into a computer. The program can be recorded on a computer-readable recording medium (such as a portable memory) and stored or distributed. The program can also be provided via a network such as the Internet or email.

[0062] 9 is a diagram showing an example of the hardware configuration of the computer. The computer in Fig. 9 includes a drive device 1000, an auxiliary storage device 1002, a memory device 1003, a CPU 1004, an interface device 1005, a display device 1006, an input device 1007, an output device 1008, a GPU 1009, and the like, all of which are interconnected via a bus B.

[0063] The program that realizes the processing on the computer is provided by a recording medium 1001, such as a CD-ROM or a memory card. When the recording medium 1001 storing the program is set in the drive device 1000, the program is installed from the recording medium 1001 to the auxiliary storage device 1002 via the drive device 1000. However, the program does not necessarily have to be installed from the recording medium 1001, but may be downloaded from another computer via a network. The auxiliary storage device 1002 stores the installed program as well as necessary files, data, etc.

[0064] The memory device 1003 reads and stores the program from the auxiliary storage device 1002 when an instruction to start the program is received. The CPU 1004, memory device 1003, etc. realizes the functions related to the device in accordance with the program. The interface device 1005 is used as an interface for connecting to a network, etc. The display device 1006 displays a GUI (Graphical User Interface) based on the program, etc. The input device 1007 is composed of a keyboard, mouse, buttons, touch panel, etc., and is used to input various operation instructions. The output device 1008 outputs the results of calculations.

[0065] The processing described in the embodiment is performed, for example, between a memory device 1003 and a GPU 1009 in a computer shown in Fig. 9. In this case, the memory device 1003 has the computing power to perform the processing described in the embodiment.

[0066] In addition, the computer shown in Figure 9 may perform the processing of memory 100 (also called storage device 100) in the embodiment, or the computer shown in Figure 9 may perform the processing of GPU 200 (also called processing device 200) described in the embodiment.

[0067] (Effects of the Embodiment) As described above, the technology described in the present embodiment makes it possible to implement countermeasures against side channel attacks in the Memory Centric Model.

[0068] The following additional notes are provided regarding the above-described embodiments.

[0069] <Supplementary Notes> (Supplementary Item 1) An information processing system including a storage device and a processing device, the storage device comprising: a storage unit that stores a tree structure that holds data on a path corresponding to a randomized address value; a conversion unit that converts a key value for data search into the address value; and a transfer unit that transfers data on the path corresponding to the address value, read from the storage unit, to the processing device. (Supplementary Item 2) The storage device according to Supplementary Item 1, further comprising: a processing unit that receives from the processing device the data on the path from which the pair of the key value and a parameter value corresponding to the key value has been removed, and the pair, and stores the data on the path in the storage unit. (Supplementary Item 3) The storage device according to Supplementary Item 2, wherein the processing unit re-stores the pair on a path corresponding to a randomly selected leaf in the tree structure. (Supplementary Item 4) The storage device according to Supplementary Item 2, wherein the parameter value is a parameter value of a neuron in a machine learning model. (Supplementary Item 5) An information processing system comprising the storage device according to any one of Supplementary Items 1 to 4, and a processing device to which data from the storage device is transferred. (Supplementary Item 6) An information processing method executed by a storage device in an information processing system comprising a storage device and a processing device, wherein the storage device comprises a storage unit that stores a tree structure that holds data on paths corresponding to randomized address values, and the information processing method comprises: a conversion step of converting a key value for data search into the address value, and a transfer step of transferring the data on the path corresponding to the address value, which has been read from the storage unit, to the processing device.

[0070] Although the present embodiment has been described above, the present invention is not limited to such a specific embodiment, and various modifications and changes are possible within the scope of the gist of the present invention described in the claims.

[0071] 100 Memory, storage device 110 Storage unit 120 Conversion unit 130 Transfer unit 140 Processing unit 200, 1009 GPU, processing device 1000 Drive device 1001 Recording medium 1002 Auxiliary storage device 1003 Memory device 1004 CPU 1005 Interface device 1006 Display device 1007 Input device 1008 Output device

Claims

1. A storage device in an information processing system including a storage device and a processing device, the storage device comprising: a storage unit that stores a tree structure for holding data on a path corresponding to a randomized address value; a conversion unit that converts a key value for data search into the address value; and a transfer unit that transfers the data on the path corresponding to the address value read from the storage unit to the processing device.

2. The storage device according to claim 1, further comprising a processing unit that receives, from the processing device, the data on the path from which a pair of the key value and a parameter value corresponding to the key value has been removed, and the pair, and stores the data on the path in the storage unit.

3. The storage device according to claim 2, wherein the processing unit stores the pair again on a path corresponding to a leaf randomly selected in the tree structure.

4. The storage device according to claim 2, wherein the parameter value is a parameter value of a neuron in a machine learning model.

5. An information processing system comprising the storage device according to any one of claims 1 to 4, and a processing device that is a transfer destination of data from the storage device.

6. An information processing method executed by the storage device in an information processing system including a storage device and a processing device, the storage device including a storage unit that stores a tree structure for holding data on a path corresponding to a randomized address value, the information processing method comprising: a conversion step of converting a key value for data search into the address value; and a transfer step of transferring the data on the path corresponding to the address value read from the storage unit to the processing device.

Images