GPU Protected Execution Environment for Secure Workloads
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current security solutions for graphics processing units (GPUs) are inadequate in protecting workloads from malware, both on the GPU and central processing unit (CPU), and fail to provide strict access control and proof of secure execution for security-sensitive tasks.
Innovation Solution
A protected execution environment is established on GPUs using Secure Enclaves, where protected graphics modules are created and executed, ensuring secure execution and access control through hardware-based attestation and memory encryption, allowing remote patching and verification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If operating system-based security is used for graphics processing, then ease of operation is improved, but reliability deteriorates due to malware attacks
Solution Approach 1:
The patent segments the graphics processing system into trusted and untrusted execution environments. A trusted execution environment (TEE) is established within the GPU to isolate security-sensitive workloads from the untrusted host system and untrusted GPU code. This segmentation allows the system to maintain ease of operation through the operating system while ensuring reliability through hardware-enforced isolation boundaries that prevent malware from compromising protected workloads.
Solution Approach 2:
The patent introduces a trusted execution environment as an intermediary layer between the untrusted host system and the security-sensitive graphics workloads. This TEE acts as a mediator that verifies the integrity of code and data before execution, providing cryptographic proof of trustworthiness. The intermediary protects against malware attacks while maintaining compatibility with the existing operating system architecture.
2Reliability
If access control for graphics assets is implemented, then reliability is improved, but device complexity increases
Solution Approach 1:
The trusted execution environment implements self-service access control mechanisms where the TEE automatically manages its own security credentials and enforces access policies without requiring complex external security infrastructure. The TEE autonomously verifies the identity and authorization of entities seeking to access protected graphics assets, reducing the need for additional security hardware or complex software-based access control systems.
3Reliability
If proof of secure execution is provided, then reliability is improved, but device complexity increases
Solution Approach 1:
The trusted execution environment provides cryptographic feedback mechanisms that generate and transmit proof of secure execution to external parties. The TEE continuously monitors the integrity of code and data during execution and provides cryptographic attestations that verify the workload is running in a trusted environment. This feedback system enables remote verification of security without requiring complex inspection infrastructure on the client side.
Data Source
AI summary
In accordance with some embodiments, a protected execution environment may be defined for a graphics processing unit. This framework not only protects the workloads from malware running on the graphics processing unit but also protects those workloads from malware running on the central processing unit. In addition, the trust framework may facilitate proof of secure execution by measuring the code and data structures used to execute the workload. If a part of the trusted computing base of this framework or protected execution environment is compromised, that part can be patched remotely and the patching can be proven remotely throughout attestation in some embodiments.