Accelerator Key Distribution via Trusted Server Certificates
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
There is a need for secure key distribution and exchange mechanisms for data processing accelerators to protect sensitive information from unauthorized access, especially in environments where AI training data, models, and inference outputs are not adequately protected.
Innovation Solution
A computer-implemented method for key distribution in data processing accelerators involves receiving an accelerator identifier from the accelerator, transmitting this ID to a trusted server, obtaining a certificate verifying the accelerator, and using a public root key from the certificate to establish a secure channel for data exchange between the host system and the accelerator.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a stateless hardware security module is used to secure communication channels, then secure key distribution is achieved, but the system complexity increases due to additional hardware components
Solution Approach 1:
The patent introduces a certificate authority (CA) as an intermediary that issues digital certificates to data processing accelerators. This CA-based intermediary system enables secure key distribution without requiring complex stateless hardware security modules, resolving the contradiction by providing security through software-based certificate verification rather than hardware security hardware
2Object-affected harmful factors
If cryptographic information is stored exclusively within the hardware accelerator, then access security is improved, but key distribution capability deteriorates
Solution Approach 1:
The patent segments the cryptographic system into separate components: a certificate authority (CA) that issues certificates, data processing accelerators that store private keys exclusively, and a host system that verifies certificates. This segmentation allows secure key distribution through the CA while maintaining exclusive storage of cryptographic information within accelerators, preventing unauthorized access
3Reliability
If a certificate chain verification process is implemented, then trust verification is improved, but the time required for key distribution increases
Solution Approach 1:
The patent implements preliminary action by having the certificate authority (CA) pre-issue and sign digital certificates for data processing accelerators before they are deployed. The host system stores these pre-signed certificates in a trusted database, enabling rapid verification without time-consuming real-time authentication processes, thus reducing verification time while maintaining trust
Data Source
Figure 1
Figure 2
Figure 3
AI summary
According to one embodiment, a system receives, at a host system from a data processing (DP) accelerator, an accelerator identifier (ID) that uniquely identifies the DP accelerator), wherein the host system is coupled to the DP accelerator over a bus. The system transmits the accelerator ID to a predetermined trusted server over a network. The system receives a certificate from the predetermined trusted server over the network, the certificate certifying the DP accelerator. The system extracts a public root key (PK_RK) from the certificate for verification, the PK_RK corresponding to a private root key (SK_RK) associated with the DP accelerator. The system establishes a secure channel with the DP accelerator using the PK_RK based on the verification to exchange data securely between the host system and the DP accelerator.