AI PC GPU Protection With Encrypted Model Topology and Weights
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
There is a need to protect AI models running on personal computers from independent software vendors (ISVs), original equipment manufacturers (OEMs), and operating system vendors (OSVs) by securing model weights and topologies locally on the PC.
Innovation Solution
Implementing a Trusted Execution Environment (TEE)-I/O support in graphics processing units (GPUs) to enable secure I/O operations and trusted I/O virtualization, establishing a trust relationship between secure virtual environments and GPUs, and using encryption keys to secure data in memory on a per-partition basis.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If AI models are run locally on PCs for customer use, then model accessibility and performance are improved, but model security and protection from unauthorized access deteriorate
Solution Approach 1:
The system segments the GPU into multiple secure partitions, each capable of independently running AI models with isolated access controls. This segmentation allows multiple models to run locally on the PC while maintaining security boundaries, resolving the contradiction between accessibility and security by enabling local execution without compromising protection.
Solution Approach 2:
The patent implements a composite security architecture combining hardware-based secure enclaves, cryptographic key management, and software-based access control layers. This composite approach creates a multi-layered protection system that secures locally-run AI models while maintaining their accessibility, effectively addressing the security-risk contradiction.
2Productivity
If multiple AI models are executed simultaneously on the same GPU, then processing capability and productivity are improved, but security isolation and model protection deteriorate
Solution Approach 1:
The GPU is divided into multiple secure partitions that can simultaneously execute different AI models with strict access controls. Each partition operates independently with its own security context, enabling parallel processing while maintaining security isolation between models, thus resolving the contradiction between productivity and security.
Solution Approach 2:
A secure management layer acts as an intermediary between multiple AI models and the underlying GPU hardware. This intermediary enforces access policies, manages cryptographic keys, and coordinates resource allocation, allowing simultaneous model execution while preserving security boundaries through centralized control.
Data Source
AI summary
One embodiment provides a graphics processor comprising a base die including a plurality of chiplet sockets and a plurality of chiplets coupled with the plurality of chiplet sockets. At least one of the plurality of chiplets include a graphics processing cluster including a plurality of processing resources. The plurality of processing resources including a matrix accelerator having circuitry to perform operations for a neural network in which model topology and weights of the neural network are encrypted. The matrix accelerator configured to execute commands of a command buffer, the commands generated based on a decomposition of the model topology of the neural network and access encrypted weights in memory of the graphics processor via circuitry configured to decrypt the encrypted weights via a key that is programmed to the hardware of the circuitry.