Shared GPU Memory Isolation for Secure Multi-Tenant Execution
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current GPU resources cannot be efficiently shared among customers due to security concerns and limited processing capabilities of terminal devices, leading to inefficient usage and waste of computing resources.
Innovation Solution
A method and shared GPU device that verifies and compiles GPU software from multiple tenants, allowing simultaneous sharing without hardware support, ensuring data isolation and protection, and enabling efficient usage through safe execution.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If GPU resources are shared among multiple customers, then resource utilization efficiency improves, but security risks increase due to potential data leakage between customers
Solution Approach 1:
The patent segments the unified GPU memory space into customer-specific isolated memory spaces, where each customer's data is confined to their own address space. This segmentation prevents cross-customer data access while allowing shared GPU hardware resources, thus resolving the contradiction between resource sharing and data security.
Solution Approach 2:
The patent introduces a memory management intermediary layer that translates customer memory access requests. This intermediary prevents direct access to other customers' memory spaces while maintaining the illusion of direct memory access for each customer, enabling secure multi-tenant GPU sharing.
2Reliability
If a single customer is allocated a whole GPU device, then data security is ensured, but resource utilization efficiency deteriorates
Solution Approach 1:
The patent makes the GPU device universal by enabling it to serve multiple customers simultaneously through virtualization. The same physical GPU resources can be allocated to different customers at different times or concurrently, maximizing resource utilization while maintaining security through memory space isolation.
Solution Approach 2:
The patent implements periodic context switching between different customers' GPU workloads. By systematically allocating GPU execution time to different customers in periodic intervals, the system achieves both high resource utilization and data security, as each customer gets dedicated execution slots.
3Adaptability or versatility
If context switching is implemented for GPU sharing, then resource sharing capability improves, but system complexity and performance overhead increase
Solution Approach 1:
The patent extracts the context switching overhead from the GPU hardware level to the software/driver level. By handling memory space management and context transitions in software rather than requiring complex hardware support, the system achieves GPU sharing capability while minimizing device complexity and performance overhead.
Data Source
AI summary
A method of operating a shared GPU device includes receiving GPU software from each of one or more tenants sharing the GPU device. The method further includes for each received software, verifying the software is safe to execute, and compiling each software that is verified as safe. The method further includes executing each compiled software in turn using the shared GPU device.