SaMD Execution Isolation on Edge AI Platforms by Criticality
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems face challenges in deploying Software-as-a-Medical-Device (SaMD) applications of varying criticality levels on a single compute platform without ensuring appropriate isolation, leading to potential interference and resource overconsumption that could compromise patient safety.
Innovation Solution
A system design that provides multiple execution environments with varying degrees of isolation, including bare metal, containers, and virtual machines, along with resource provisioning based on criticality levels, to ensure secure and efficient execution of SaMD applications on edge-AI platforms.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If multiple SaMD applications of varying criticality levels are deployed on a single compute platform, then resource utilization and system versatility are improved, but application isolation and security are worsened due to potential interference and resource overconsumption
Solution Approach 1:
The compute platform is segmented into multiple execution environments (bare metal, containers, virtual machines) with different isolation levels. Critical SaMD applications are deployed in isolated environments such as virtual machines or containers, while non-critical applications can run on bare metal. This segmentation allows multiple applications to coexist on the same platform while maintaining appropriate isolation boundaries that prevent interference and resource overconsumption between applications of different criticality levels.
2Reliability
If SaMD applications are executed with high isolation to ensure security, then patient safety is improved, but system complexity and resource overhead are worsened
Solution Approach 1:
Different levels of isolation are applied locally based on the criticality level of each SaMD application. Critical applications receive high isolation through virtual machine or container environments, while non-critical applications execute with lower isolation on bare metal. This local quality approach ensures patient safety for critical applications without unnecessarily complicating the entire system or wasting resources on isolation mechanisms for applications that do not require them.
3Productivity
If resource provisioning is allocated based on criticality levels, then fair resource distribution is improved, but resource competition and interference between applications are worsened without isolation
Solution Approach 1:
The resource provisioning system segments resource allocation based on execution environment and criticality level. Isolated environments (virtual machines, containers) are provisioned with dedicated resource quotas that prevent any single application from consuming excessive resources. This segmentation ensures fair resource distribution while the isolation boundaries automatically prevent resource competition and interference between applications, as each application is confined to its allocated resources within its isolation boundary.
Data Source
AI summary
Apparatuses, systems, and techniques providing isolated execution of software-as-a-medical device (SaMD) applications on edge-AI platforms are provided. A criticality level of an application of a plurality of applications associated with a medical device is identified. Based on the criticality level, the application is determined to be executed in one of a plurality of environment. Each environment of the plurality of environments provides a corresponding level of isolation from other applications of the plurality of applications. One or more computing resources are assigned to the application, based at least on the criticality level or resource requirements of the application.