PPU Trusted Execution Environment for Confidential Computing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional confidential computing systems are unable to protect data in use by parallel processing units (PPUs), such as graphics processing units (GPUs), which limits the performance advantages offered by hardware accelerators due to security requirements, particularly in multi-tenant environments handling sensitive data.
Innovation Solution
The implementation of a trusted execution environment (TEE) for PPUs, including separate and isolated memory paths, hardware firewalls for access control, and cryptographic key management to encrypt and decrypt data, allowing secure execution of user code and operations within a virtualized environment.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional confidential computing is used with CPU-based TEE, then data confidentiality is protected, but performance advantages of hardware accelerators are lost
Solution Approach 1:
The system segments the confidential computing environment by creating separate TEE instances for CPU and PPU, with isolated memory regions and access paths. Each PPU instance has its own protected memory region that is isolated from other instances and the host system, allowing parallel processing while maintaining confidentiality boundaries.
Solution Approach 2:
The patent introduces a PPU driver and hypervisor as intermediary layers that manage access to PPU resources. These intermediaries handle encryption/decryption operations and enforce access control policies, allowing secure data transfer between the confidential VM and PPU without requiring the entire system to operate at reduced performance.
2Productivity
If multiple tenants share the same physical computing resources, then resource utilization is improved, but security threats to confidential data increase
Solution Approach 1:
The system creates multiple isolated PPU instances, where each instance has separate memory regions and access paths. This segmentation ensures that even though multiple tenants share the same physical PPU hardware, their data and computation contexts are completely isolated, preventing cross-tenant security threats while maintaining high resource utilization.
Solution Approach 2:
Each PPU instance is configured with local security properties including instance-specific encryption keys, isolated memory regions, and dedicated access paths. This local quality approach allows each tenant to have customized security parameters while sharing the underlying hardware infrastructure.
3Speed
If PPU memory is made accessible for computation, then processing speed is improved, but unauthorized access to data increases
Solution Approach 1:
The patent implements hardware firewalls and encrypted memory regions as intermediary protective layers between the PPU compute engines and the memory system. These intermediaries allow fast data access for authorized computation while blocking unauthorized access attempts, maintaining processing speed without compromising security.
Solution Approach 2:
The system uses encrypted memory regions with flexible access control that appear transparent to authorized compute operations but provide strong security barriers against unauthorized access. The encryption layer acts as a thin protective film that allows legitimate high-speed computation while preventing data theft.
Data Source
AI summary
In examples, trusted execution environments (TEE) are provided for an instance of a parallel processing unit (PPU) as PPU TEEs. Different instances of a PPU correspond to different PPU TEEs, and provide accelerated confidential computing to a corresponding TEE. The processors of each PPU instance have separate and isolated paths through the memory system of the PPU which are assigned uniquely to an individual PPU instance. Data in device memory of the PPU may be isolated and access controlled amongst the PPU instances using one or more hardware firewalls. A GPU hypervisor assigns hardware resources to runtimes and performs access control and context switching for the runtimes. A PPU instance uses a cryptographic key to protect data for secure communication. Compute engines of the PPU instance are prevented from writing outside of a protected memory region. Access to a write protected region in PPU memory is blocked from other computing devices and/or device instances.