Graphics Processor Kernel Encryption via Security Engine

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Current graphics processing systems face challenges in securely processing protected content, as unverified kernels can access encrypted content, compromising security, while also limiting the flexibility to perform additional processing on high dynamic range (HDR) and ultra-high definition (UHD) content.

Innovation Solution

Implementing a security engine that creates and shares a kernel security key to encrypt and decrypt kernels, forcing decryption of all kernels on the GPU pipe when protected content is accessed, ensuring only verified kernels can run on the render engine, thus maintaining security and flexibility.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If unverified kernels are allowed to access protected content, then processing flexibility is improved, but security is compromised

Engineering Contradiction:

Improveprocessing flexibilityVSAvoidsecurity

Core Design Contradiction:

Adaptability or versatilityVSReliability

Solution Approach 1:

The security engine performs preliminary verification and encryption of kernels before they are loaded onto the GPU. Kernels are encrypted with a security key and can only be decrypted and executed if they pass verification, ensuring security is established before processing begins

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

A security engine acts as an intermediary between the kernel source and the GPU execution units. This intermediary verifies kernel authenticity and manages encryption/decryption, allowing flexible processing of verified kernels while blocking unverified ones from accessing protected content

Inventive Principle:

Principle #24Intermediary (Mediator)

2Speed

If all kernels are decrypted on the GPU pipe, then processing speed is improved, but security is worsened

Engineering Contradiction:

Improveprocessing speedVSAvoidsecurity

Core Design Contradiction:

SpeedVSReliability

Solution Approach 1:

Different security treatments are applied to different parts of the system. Kernels are encrypted in storage and only decrypted in the specific location (GPU security context) where execution is authorized, maintaining security while enabling fast processing where needed

Inventive Principle:

Principle #3Local quality

Solution Approach 2:

The security state of kernels dynamically changes from encrypted to decrypted based on verification results and execution context. Once verified, kernels remain in a decrypted executable state for the duration of processing, balancing security requirements with processing performance

Inventive Principle:

Principle #35Parameter changes

3Reliability

If kernel encryption is implemented, then security is improved, but device complexity is worsened

Engineering Contradiction:

ImprovesecurityVSAvoidsystem complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

A dedicated security engine serves as an intermediary that handles all encryption/decryption operations. This specialized component manages the complexity of cryptographic operations without burdening the main GPU processing architecture, isolating security complexity from the rendering pipeline

Inventive Principle:

Principle #24Intermediary (Mediator)

Data Source

PatentUS11018863B2Graphics processor with encrypted kernels

Publication Date: 2021.05.25 INTEL CORP

AI summary

An embodiment of a graphics apparatus may include a graphics processor including a kernel executor, and a security engine communicatively coupled to the graphics processor. The security engine may be configured to create a kernel security key, encrypt an executable kernel for the kernel executor in accordance with the kernel security key, and share the kernel security key with the graphics processor.