Encrypted Computational Graphs for Secure Edge Model Deployment
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Deploying large neural networks on less secure client devices poses significant security risks due to the potential for theft and inspection of model parameters, as they are not easily protected in untrusted environments.
Innovation Solution
An encrypted computational graph is built for each client device, with machine-learning model components encrypted and executed within trusted execution environments at the hardware level, ensuring only the hardware can decrypt and execute the model, thus protecting it from the operating system and applications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If neural networks are deployed to client devices, then the model can be executed on edge computing devices, but the model parameters become vulnerable to theft and inspection
Solution Approach 1:
The patent introduces a Trusted Execution Environment (TEE) as an intermediary layer between the untrusted client device operating system and the neural network model. The TEE acts as a secure enclave that isolates and protects model parameters from inspection by the operating system and applications, while still allowing the model to execute on the edge device. This mediator resolves the contradiction by enabling deployment to untrusted environments without exposing sensitive parameters.
Solution Approach 2:
The patent segments the execution environment into two distinct parts: a trusted execution environment where model parameters are stored and processed, and an untrusted operating system environment. By separating the sensitive model data into a dedicated secure enclave, the system allows the model to run on client devices while preventing the operating system from accessing or stealing the parameters, thus resolving the security vulnerability.
2Reliability
If model data is encrypted and executed in trusted execution environments, then security is protected, but device complexity increases
Solution Approach 1:
The patent leverages the existing TEE hardware architecture already present in modern processors (such as Intel SGX, ARM TrustZone, or Google Project Shield) rather than designing a completely new security mechanism. By utilizing these pre-existing hardware copies of trusted execution environments that are becoming standard in the industry, the system achieves secure model execution without requiring custom complex hardware designs, thus managing the complexity trade-off.
Solution Approach 2:
The patent changes the state of model parameters from unencrypted plaintext to encrypted form within the TEE, and modifies the execution paradigm from direct CPU execution to secure enclave execution. This transformation of parameters and execution context enables security protection while leveraging existing hardware capabilities, thereby managing the complexity increase through cryptographic abstraction rather than hardware redesign.
Data Source
AI summary
The technology described herein builds an encrypted computational graph for deployment to a client device. The encrypted computational graph includes a machine-learning model's components (e.g., weights and biases) with instructions to perform various operations to allow the particular machine learning model to make an inference. A runtime environment operating on the client device may help execute the encrypted computational graph. The runtime environment may be able to facilitate execution without being able to decrypt the encrypted machine model data. Instead, the model data is only descripted within trusted execution environments of processors at the hardware level. The encrypted computational graph may be built on a client-by-client basis to create a unique computational graph for a specific client device. At the very least, the encryption may be specific to a trusted execution environment of a specific device.