KR102660736B1 - Secure offloading of computations from trusted execution environment(tee) to accelerators - Google Patents

Abstract

A technique for safely offloading computation to an accelerator in a trusted execution environment (TEE) is disclosed. A method of offloading a data operation performed by an offloading system according to an embodiment includes establishing an input/output channel between a trusted execution environment of a processor and an accelerator in an environment in which an accelerator is mounted; and offloading a computation from the trusted execution environment to the accelerator through the established input/output channel.

Description

A technique for safely offloading computations from a trusted execution environment (TEE) to an accelerator {SECURE OFFLOADING OF COMPUTATIONS FROM TRUSTED EXECUTION ENVIRONMENT(TEE) TO ACCELERATORS}

The explanation below is about technology for safely offloading computation from a trusted execution environment to an accelerator in a public server environment.

Cloud computing services provided by cloud service providers (CSPs) have recently experienced explosive growth due to scalability and convenience. Meanwhile, in the field of artificial intelligence, machine learning (ML) technology is also receiving public attention, and Machine Learning as a Service (MLaaS) has become an attractive option for data scientists and artificial intelligence researchers. However, the cloud environment is not an ideal environment for security, especially privacy protection. There may be a situation where hardware such as CPU and accelerator must be shared with other users, and attacks that steal data in situations where accelerators are shared have been proposed several times. Through this, there is a possibility that artificial intelligence researchers' assets, such as machine learning models, algorithms, and data sets, may be leaked. Since various institutions such as banks and hospitals have a large amount of personal information-related data, Privacy Preserving Machine Learning (PPML) techniques have been developed to protect this in machine learning.

Privacy protection machine learning is a technology that protects the model from other users when training a model containing sensitive personal information or making predictions using the model. However, existing technologies reduce accuracy, require high-level security knowledge, are difficult to use, or reduce performance. Multi-Party Computation (MPC) and Homomorphic Encryption (HE) are based on cryptography, so they have a huge impact on performance. Machine learning through hardware-based security uses special hardware or requires modification of existing hardware, making it less compatible. Differential Privacy (DP) adds noise to the data, which reduces accuracy.

As research on processor-based Trusted Execution Environment (TEE), including Intel SGX, has emerged, several studies have been conducted to perform machine learning calculations within a trusted execution environment. Intel SGX has many limitations. For example, the size of the enclave page cache (EPC), a memory area protected by SGX, is only 90MB, which is far below the typical model or data size. Additionally, system calls are not possible inside SGX and there are no communication channels with reliable I/O devices, so there are restrictions on using peripheral devices such as accelerators.

Recently, research related to library OS has been conducted to solve these limitations by enabling system calls or executing Python code in SGX. However, there is still a limitation that system call arguments are not protected. The SGXIO study sought to establish a generic trusted I/O path between SGX and devices, but this has the disadvantage of not being optimized for accelerator use and not suggesting a method of executing Python code commonly used by actual artificial intelligence researchers.

Performing the calculations required for machine learning using only the CPU results in performance degradation hundreds of times compared to using an accelerator. This is because many of the computations required for machine learning involve parallel computations, and accelerators are optimized for parallel computations. Accordingly, the need for a technique to offload calculations to be performed in the accelerator while executing a program in SGX to the accelerator is emerging.

In an environment where an accelerator is installed, a method and system can be provided to safely protect data offloaded to the accelerator from an attacker with system (kernel) privileges. In other words, it establishes and protects the I/O channel between the processor's Trusted Execution Environment (TEE) and the accelerator.

It is possible to provide a method and system that can be applied to a general existing system without modifying the architecture of the accelerator or processor.

A method and system that improves performance and accuracy can be provided without using homomorphic encryption (HE) or differentiated privacy (DP).

A method of offloading a data operation performed by an offloading system includes establishing an input/output channel between a trusted execution environment of a processor and an accelerator in an environment in which an accelerator is mounted; and offloading a computation from the trusted execution environment to the accelerator through the established input/output channel.

The environment in which the accelerator is installed may include a cloud environment in which the accelerator is installed, or an environment in which the accelerator is installed, including a trusted area created by separating kernel code.

The offloading step involves outsourcing data requested for operation from the trusted execution environment to the accelerator through an API remoting technique that enables input/output communication between the trusted execution environment of the processor and the accelerator in an environment in which the accelerator is mounted. May include steps.

The API remoting technique may mean that when an input/output request occurs in a guest environment, it is transmitted to a local or remote host to process the generated input/output request.

The guest environment may be a VM instance, and the host environment may be a hypervisor.

The guest environment may be an untrusted part of the kernel in which the kernel code is separated, and the host environment may be a trusted part of the kernel in which the kernel code is separated.

The offloading step includes decrypting the encrypted data uploaded to the VM instance through a channel between the user and the VM instance in the enclave of the trusted execution environment, and the VM instance (Instance) The encrypted data uploaded to may be encrypted data including code, data, and models from the user.

In the offloading step, the decrypted data is encrypted in the enclave by the library operating system (Library OS) of the trusted execution environment through a channel between the VM instance and the hypervisor, and the encrypted data is stored in the enclave. It may include copying the encrypted data out of the clave and copying the encrypted data to a physically contiguous page as the front-end driver is called through a system call.

The offloading step may include reading the encrypted data from the hypervisor, decrypting the encrypted data in the memory of the hypervisor, and performing an operation on the decrypted data by calling an accelerator API. You can.

In the offloading step, the user and kernel code are separated in the enclave of the trusted execution environment, and the kernel code is separated through a channel between untrusted areas of the kernel to decrypt the encrypted data uploaded to the untrusted area of the kernel. The encrypted data including the step, where the kernel code is separated and uploaded to an untrusted area of the kernel, may be encrypted data including code, data set, and model from the user.

In the offloading step, the kernel code is separated from the untrusted area of the kernel and the kernel code is separated, and the library operating system (Library) of the trusted execution environment is provided through a channel between the trusted part of the kernel. Data is encrypted in the enclave by the OS, the encrypted data is copied out of the enclave, and the front-end driver is called through a system call, thereby encrypting the encrypted data on a physically contiguous page. It may include the step of copying the data.

In the offloading step, the kernel code is separated and reads the encrypted data in a trusted area of the kernel, the kernel code is separated and decrypts the encrypted data in the memory of the trusted area of the kernel, and the accelerator It may include calling an API to perform an operation on the decrypted data.

The offloading step includes encrypting a result obtained by performing an operation on data for which the operation is requested in the accelerator, and returning the encrypted result to the enclave of the trusted execution environment. can do.

A computer program stored in a computer-readable storage medium to execute a method of offloading a data operation performed by an offloading system includes establishing an input/output channel between the trusted execution environment of the processor and the accelerator in an environment equipped with an accelerator. ; and offloading a computation from the trusted execution environment to the accelerator through the established input/output channel.

The offloading system includes a channel establishment unit that establishes an input/output channel between the trusted execution environment of the processor and the accelerator in an environment where the accelerator is mounted; and an offloading unit that offloads calculations from the trusted execution environment to the accelerator through the established input/output channel.

The risk of data leakage can be reduced by using a trusted execution environment (TEE).

In an SGX enclave, parallel computation can be safely offloaded to an accelerator to improve performance compared to using a processor.

It is compatible with existing hardware (processors and accelerators) without the need to purchase additional special hardware or modify existing hardware.

Artificial intelligence researchers and data scientists can use the same high-level code that they previously used.

Figure 1 is a diagram for explaining the operation of using an accelerator in a cloud environment.
Figure 2 is an example for explaining an operation of offloading a data operation, according to an embodiment.
Figure 3 is another example for explaining an operation of offloading a data operation, according to an embodiment.
Figure 4 is a diagram for explaining a data movement operation, according to one embodiment.
Figure 5 is a block diagram for explaining the configuration of an offloading system according to an embodiment.
FIG. 6 is a flowchart illustrating a method of offloading data operations in an offloading system according to an embodiment.

Hereinafter, embodiments will be described in detail with reference to the accompanying drawings.

Figure 1 is a diagram for explaining the operation of using an accelerator in a cloud environment.

Figure 1 is a diagram showing the movement of data when an existing artificial intelligence researcher uses an accelerator using a computing instance in a cloud environment. Data 110 such as code, data set, and model may be uploaded from the user 101's PC to the instance. Data codes for codes, data sets, models, etc. uploaded from the user's 101 PC to the instance (untrusted system) 120 may be executed. At this time, the data 110 is transmitted to the accelerator 130, and the operation result obtained as the accelerator 130 performs an operation on the data 110 can be received.

Likewise, if the existing system is taken over by an attacker, data may be leaked.

Since the cloud is a general virtual environment, a cloud service provider (CSP) allows users to utilize accelerators through accelerator pass-through or accelerator virtualization, a technique that allows existing accelerators to be used in a virtual environment.

In the current situation, if an instance is hacked by an attacker, data will be exposed without protection and important assets will be leaked. Accordingly, in the embodiment, an operation to safely protect data offloaded to the accelerator from an attacker with system (kernel) privileges in an environment where the accelerator is mounted using the data protection control area will be described. At this time, the data protection control area may refer to enclaves, which are memory areas protected in a trusted execution environment. For example, it could be Intel's SGX. Provides hardware-based memory encryption that separates data in memory from specific application code. It allows user-level code to allocate private areas of memory called enclaves, which are designed to be protected from processes running at high privilege levels.

Figure 2 is an example for explaining an operation of offloading a data operation, according to an embodiment.

The offloading system utilizes a trusted execution environment to protect running data and data stored on disk, and data that requires accelerator calculation can be outsourced to the accelerator through the API remoting technique (201). At this time, sensitive data transmitted and received through the API remoting channel can be encrypted and protected.

Inside the trusted execution environment, high level code such as Python can be executed using the Library OS.

The offloading system establishes an input/output channel between the processor's trusted execution environment and the accelerator in an environment equipped with an accelerator, and can offload calculations from the trusted execution environment to the accelerator through the established input/output channel.

Referring to FIG. 2, it is a diagram showing a cloud environment 200 equipped with an accelerator. The offloading system provides data 110 for which operation is requested through an API remoting technique 201 that enables input/output communication between the trusted execution environment of the processor and the accelerator 130 in a cloud environment 200 equipped with an accelerator 130. ) can be outsourced to the accelerator 130 in a trusted execution environment. At this time, the API remoting technique 201 means that when an input/output request occurs in a guest environment, it is transmitted to a local or remote host to process the generated input/output request. In an embodiment, the guest environment may be a VM instance, and the host environment may be a hypervisor.

The offloading system encrypts data 110 including code, data set, and model from the user 101 through a channel between the user 101 and the VM instance 210 and uploads it to the VM instance 210. , the VM instance 210 can decrypt data encrypted in the enclave 220 of the trusted execution environment. The offloading system encrypts data in the enclave 220 by the library operating system (Library OS) of the trusted execution environment through a channel between the VM instance 210 and the hypervisor 250, and the encrypted data is stored in the enclave 220. ), and as the front-end driver 230 is called through a system call, the encrypted data can be copied to a physically contiguous page. At this time, the pages allocated in the front-end driver 230 are physically adjacent and can be directly accessed by the hypervisor 250, so there is no need to copy data. The offloading system may read encrypted data from the hypervisor 250, decrypt data encrypted in memory, and perform operations on the decrypted data by calling an accelerator API (eg, CUDA API). The offloading system may transmit decrypted data to an accelerator through an accelerator API (eg, CUDA API) to perform an operation on the decrypted data. The offloading system encrypts the results obtained by performing operations on data in the accelerator, and returns the encrypted results to the enclave of the trusted execution environment.

For example, users can use instances that include accelerators when using cloud computing services (e.g., Amazon EC2). Clouds generally use a virtual environment, so users are likely to share their hardware with others, which can pose a security threat as it provides more attack vectors for attackers. At this time, by using the operation proposed in the embodiment, even if the instance is taken over by an attacker, data used in the instance can be prevented from being leaked.

According to the embodiment, it is very easy to apply to a cloud environment, but is not limited to the cloud environment. Similar to the hypervisor method, if it is possible to separate kernel code and create a reliable part (for example, SKEE, Nested kernel, etc.), the method described above can be applied. This is fully possible through software modification, so it can be used even if virtualization is not applicable. This will be explained in Figure 3.

Referring to FIG. 3, it is a diagram showing an environment in which the accelerator 130 is installed, including a trusted area created by separating kernel code. The offloading system is an API remoting system that enables input/output communication between the trusted execution environment of the processor and the accelerator 130 in an environment equipped with the accelerator 130, which includes a trusted area 310 created by separating the kernel code. Through the technique 201, data for which calculations have been requested can be outsourced to the accelerator 130 in a trusted execution environment. At this time, the API remoting technique 201 means that when an input/output request occurs in a guest environment, it is transmitted to a local or remote host to process the generated input/output request. In the embodiment, the guest environment is an untrusted part of the kernel 310 in which the kernel code is separated, and the host environment is an untrusted part of the kernel in which the kernel code is separated. It may be (320).

The offloading system separates the user 101 from the kernel code and encrypts the data 110 including the code, data set, and model from the user through a channel between the untrusted area (310) of the kernel. The kernel code can be separated and uploaded to the untrusted area 310 of the kernel, and the encrypted data can be decrypted in the enclave 220 of the trusted execution environment. In the offloading system, the kernel code is separated from the untrusted area of the kernel and the kernel code is separated into the library operating system (Library OS) of the trusted execution environment through a channel between the trusted area of the kernel (trusted part of the kernel). data is encrypted in the enclave, the encrypted data is copied out of the enclave, and the frontend driver is called through a system call to copy the encrypted data to a physically contiguous page. You can. At this time, the pages allocated in the front-end driver are physically adjacent, so the kernel code is separated and can directly access the trusted area of the kernel, so there is no need to copy data. The offloading system decouples kernel code to read encrypted data from a trusted region of the kernel, decrypts data encrypted in memory from a trusted region of the kernel, and uses accelerator APIs (e.g., CUDA). You can perform operations on decrypted data by calling API). The offloading system may transmit decrypted data to an accelerator through an accelerator API (eg, CUDA API) to perform an operation on the decrypted data. The offloading system encrypts the results obtained by performing operations on data in the accelerator, and returns the encrypted results to the enclave of the trusted execution environment.

Figure 4 is a diagram for explaining a data movement operation, according to one embodiment.

This diagram is intended to explain the operation of data movement between the front-end driver and the back-end driver. While PyTorch code is running, an accelerator API (e.g., CUDA API) may be called. In Figure 4, the CUDA API among the accelerator APIs will be explained as an example. At this time, the custom library can intercept the called CUDA API. The custom library can call the ioctl() system call to transfer the called CUDA API to the front-end driver. These system calls are processed by the library operating system (Library OS) and can be implemented through ocall. Encrypted arguments from unprotected memory can be passed to the front-end driver loaded in the kernel of the guest VM.

The front-end driver can provide an interface to the guest VM in the form of a virtual device to the /dev file system.

The front-end driver can receive a data operation request, copy the encrypted data to a physically connected page, and then forward the request to the back-end driver. For example, requests can be forwarded to a backend driver located on the hypervisor. At this time, even if an attacker takes control of the front-end driver, only encrypted data can be seen.

As the backend drive receives a data operation request, it can transmit commands to the accelerator using the actual CUDA runtime API and CUDA driver API. Data operations can be performed in the accelerator. The result obtained through the operation is encrypted and returned to the enclave of the trusted execution environment.

The operation described in FIG. 4 is not limited to a cloud environment and can also be applied in a trusted area that separates kernel code.

FIG. 5 is a block diagram for explaining the configuration of an offloading system according to an embodiment, and FIG. 6 is a flowchart for explaining a method of offloading data operations in an offloading system according to an embodiment.

The processor of the offloading system 500 may include a channel establishment unit 510 and an offloading unit 520. These processor components may be expressions of different functions performed by the processor according to control instructions provided by program codes stored in the offloading system. The processor and its components may control the offloading system to perform steps 610 to 620 included in the method for offloading data operations in FIG. 6 . At this time, the processor and its components may be implemented to execute instructions according to the code of an operating system included in the memory and the code of at least one program.

The processor may load program code stored in a program file into memory for a method of offloading data operations. For example, when a program is executed in an offloading system, the processor can control the offloading system to load program code from the program file into memory under the control of the operating system. At this time, the channel establishment unit 510 and the offloading unit 520 each execute instructions of the corresponding part of the program code loaded into the memory, and each has a different functional expression of the processor for executing the subsequent steps 610 to 620. You can take it in.

In step 610, the channel establishment unit 510 may establish an input/output channel between the trusted execution environment of the processor and the accelerator in an environment where the accelerator is mounted.

In step 620, the offloading unit 520 may offload the computation to the accelerator in the trusted execution environment through the established input/output channel. The offloading unit 520 can outsource data for which an operation has been requested from the trusted execution environment to the accelerator through an API remoting technique that enables input/output communication between the trusted execution environment of the processor and the accelerator in an environment equipped with an accelerator. At this time, the environment in which the accelerator is installed may include a cloud environment in which the accelerator is installed, or an environment in which the accelerator is installed, including a trusted area created by separating the kernel code. Additionally, the API remoting technique means that when an input/output request occurs in a guest environment, it is transmitted to a local or remote host to process the generated input/output request. Here, the guest environment may be a VM instance, and the host environment may be a hypervisor. Alternatively, the guest environment may be an untrusted part of the kernel with separate kernel code, and the host environment may be a trusted part of the kernel with separate kernel code. For example, encrypted data including code, data sets, and models can be uploaded from a user to a VM instance through a channel between the user and the VM instance. The offloading unit 520 can decrypt encrypted data in the enclave of the trusted execution environment. The offloading unit 520 encrypts data in the enclave by the library operating system (Library OS) of the trusted execution environment through a channel between the VM instance and the hypervisor, copies the encrypted data out of the enclave, and As the frontend driver is called through a call, encrypted data can be copied to a physically contiguous page. The offloading unit 520 may read encrypted data from the hypervisor, decrypt the data encrypted in the memory of the hypervisor, and perform operations on the decrypted data by calling an accelerator API. At this time, the accelerator API may include CUDA API, AMD GPU API, etc.

As another example, encrypted data, including code, datasets, and models, from users can be uploaded to an untrusted region of the kernel through a channel between user and kernel code, which is separated from the kernel code. there is. The offloading unit 520 can decrypt encrypted data in the enclave of the trusted execution environment. The offloading unit 520 operates the library operating system (Library OS) of the trusted execution environment through a channel between the untrusted area of the kernel in which the kernel code is separated and the trusted part of the kernel in which the kernel code is separated. Data is encrypted in the enclave, the encrypted data is copied out of the enclave, and the frontend driver is called through a system call, copying the encrypted data to a physically contiguous page. can do. The offloading unit 520 reads encrypted data from a trusted area of the kernel where the kernel code is separated, decrypts data encrypted in the memory of a trusted area of the kernel where the kernel code is separated, and calls the accelerator API. Operations can be performed on decrypted data.

The offloading unit 520 may encrypt the result obtained as the accelerator performs an operation on data for which an operation has been requested, and return the encrypted result to the enclave of the trusted execution environment.

According to the embodiment, companies that essentially use accelerators, such as cloud service providers or artificial intelligence research institutes, can improve security and reduce the risk of data leakage while minimizing changes to the system in use.

According to the embodiment, it is performed by companies or individuals, and data operation is performed at low cost through software measures such as installing a hypervisor in an existing system or dividing the kernel into a trusted area and an untrusted area without the need to purchase additional equipment. Offloading can be performed. When installing a hypervisor, you can borrow a widely used open source hypervisor such as KVM/QEMU.

According to the embodiment, the accelerator can be used throughout the business group in which it is used. It can be used by companies researching artificial intelligence such as banks, credit card companies, hospitals, insurance, IT companies, and even various government ministries. Additionally, it can be applied to various CSPs and IDCs that provide cloud services.

The device described above may be implemented with hardware components, software components, and/or a combination of hardware components and software components. For example, devices and components described in embodiments may include, for example, a processor, a controller, an arithmetic logic unit (ALU), a digital signal processor, a microcomputer, a field programmable gate array (FPGA), etc. , may be implemented using one or more general-purpose or special-purpose computers, such as a programmable logic unit (PLU), a microprocessor, or any other device capable of executing and responding to instructions. A processing device may execute an operating system (OS) and one or more software applications that run on the operating system. Additionally, a processing device may access, store, manipulate, process, and generate data in response to the execution of software. For ease of understanding, a single processing device may be described as being used; however, those skilled in the art will understand that a processing device includes multiple processing elements and/or multiple types of processing elements. It can be seen that it may include. For example, a processing device may include a plurality of processors or one processor and one controller. Additionally, other processing configurations, such as parallel processors, are possible.

Software may include a computer program, code, instructions, or a combination of one or more of these, which may configure a processing unit to operate as desired, or may be processed independently or collectively. You can command the device. Software and/or data may be used on any type of machine, component, physical device, virtual equipment, computer storage medium or device to be interpreted by or to provide instructions or data to a processing device. It can be embodied in . Software may be distributed over networked computer systems and stored or executed in a distributed manner. Software and data may be stored on one or more computer-readable recording media.

The method according to the embodiment may be implemented in the form of program instructions that can be executed through various computer means and recorded on a computer-readable medium. The computer-readable medium may include program instructions, data files, data structures, etc., singly or in combination. Program instructions recorded on the medium may be specially designed and configured for the embodiment or may be known and available to those skilled in the art of computer software. Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks, and magnetic tapes, optical media such as CD-ROMs and DVDs, and magnetic media such as floptical disks. -Includes optical media (magneto-optical media) and hardware devices specifically configured to store and execute program instructions, such as ROM, RAM, flash memory, etc. Examples of program instructions include machine language code, such as that produced by a compiler, as well as high-level language code that can be executed by a computer using an interpreter, etc.

As described above, although the embodiments have been described with limited examples and drawings, various modifications and variations can be made by those skilled in the art from the above description. For example, the described techniques are performed in a different order than the described method, and/or components of the described system, structure, device, circuit, etc. are combined or combined in a different form than the described method, or other components are used. Alternatively, appropriate results may be achieved even if substituted or substituted by an equivalent.

Therefore, other implementations, other embodiments, and equivalents of the claims also fall within the scope of the claims described below.

Claims (15)

In a method for offloading data operations performed by an offloading system,
Establishing an input/output channel between the trusted execution environment of the processor and the accelerator in an environment where the accelerator is mounted; and
Offloading computation from the trusted execution environment to the accelerator through the established input/output channel.
Including,
The offloading step is,
By offloading the calculations required for machine learning in the trusted execution environment to the accelerator,
In an environment in which the accelerator is mounted, the data including the code, data set, and model uploaded from the user computer is data requested for operation through an API remoting technique that enables input/output communication between the trusted execution environment and the accelerator. Step of outsourcing to the accelerator in a trusted execution environment
Including,
The outsourcing step to the accelerator is,
Encrypting data transmitted and received through the API remoting technique and copying the encrypted data to a physically contiguous page as the frontend driver is called through a system call.
Including,
The custom library intercepts the accelerator API and calls a system call processed in the library operating system (Library OS) to deliver it to the front-end driver,
The arguments of the unprotected system call are encrypted and delivered to the front-end driver,
The backend driver receives a data operation request from the front-end driver and transmits the corresponding command to the accelerator using the accelerator runtime API and accelerator driver API.
An offloading method characterized by . According to paragraph 1,
The environment equipped with the accelerator includes a cloud environment equipped with the accelerator or an environment equipped with the accelerator including a trusted area created by separating the kernel code.
An offloading method characterized by . delete According to paragraph 1,
The API remoting technique means that when an input/output request occurs in a guest environment, it is transmitted to a local or remote host to process the generated input/output request.
An offloading method characterized by . According to paragraph 4,
The guest environment is a VM instance, and the host environment is a hypervisor.
An offloading method characterized by . According to paragraph 4,
The guest environment is an untrusted part of the kernel in which the kernel code is separated, and the host environment is a trusted part of the kernel in which the kernel code is separated.
An offloading method characterized by . According to paragraph 1,
The outsourcing step to the accelerator is,
Decrypting the encrypted data uploaded to the VM instance through a channel between the user and the VM instance in the enclave of the trusted execution environment.
An offloading method including. In clause 7,
The decrypted data is encrypted in the enclave by the library operating system (Library OS) of the trusted execution environment through a channel between the VM instance and the hypervisor, and the encrypted data is copied out of the enclave.
An offloading method characterized by . According to clause 8,
The outsourcing step to the accelerator is,
Reading the encrypted data from the hypervisor, decrypting the encrypted data in the memory of the hypervisor, and calling an accelerator API to perform an operation on the decrypted data.
An offloading method including. According to paragraph 1,
The outsourcing step to the accelerator is,
A step of separating the user and kernel code in the enclave of the trusted execution environment and decrypting the encrypted data uploaded to the untrusted area of the kernel through a channel between untrusted areas of the kernel.
An offloading method including. According to clause 10,
The kernel code is separated from the untrusted area of the kernel and the kernel code is separated from the enclave by the library operating system (Library OS) of the trusted execution environment through a channel between the trusted part of the kernel. The decrypted data is encrypted, and the encrypted data is copied out of the enclave.
An offloading method characterized by . According to clause 11,
The outsourcing step to the accelerator is,
The kernel code is separated and reads the encrypted data from the trusted area of the kernel, and the kernel code is separated to decrypt the encrypted data in the memory of the trusted area of the kernel, and calls the accelerator API to retrieve the decrypted data. Steps to perform operations on data
An offloading method including. According to paragraph 1,
The offloading step is,
Encrypting the result obtained as the accelerator performs an operation on the data for which the operation is requested, and returning the encrypted result to the enclave of the trusted execution environment.
An offloading method including. A computer program stored in a computer-readable storage medium for executing a method of offloading a data operation performed by an offloading system, comprising:
A method of offloading data operations performed by the offloading system includes:
Establishing an input/output channel between the trusted execution environment of the processor and the accelerator in an environment where the accelerator is mounted; and
Offloading computation from the trusted execution environment to the accelerator through the established input/output channel.
Including,
The offloading step is,
By offloading the calculations required for machine learning in the trusted execution environment to the accelerator,
In an environment in which the accelerator is mounted, the data including the code, data set, and model uploaded from the user computer is data requested for operation through an API remoting technique that enables input/output communication between the trusted execution environment and the accelerator. Step of outsourcing to the accelerator in a trusted execution environment
Including,
The outsourcing step to the accelerator is,
Encrypting data transmitted and received through the API remoting technique and copying the encrypted data to a physically contiguous page as the frontend driver is called through a system call.
Including,
The custom library intercepts the accelerator API and calls a system call processed in the library operating system (Library OS) to deliver it to the front-end driver,
The arguments of the unprotected system call are encrypted and delivered to the front-end driver,
The backend driver receives a data operation request from the front-end driver and transmits the corresponding command to the accelerator using the accelerator runtime API and the accelerator driver API.
A computer program stored on a computer-readable storage medium, characterized by: In the offloading system,
a channel establishment unit that establishes an input/output channel between the trusted execution environment of the processor and the accelerator in an environment where the accelerator is mounted; and
An offloading unit that offloads calculations from the trusted execution environment to the accelerator through the established input/output channel.
Including,
The offloading unit,
By offloading the calculations required for machine learning in the trusted execution environment to the accelerator,
In an environment in which the accelerator is mounted, the data including the code, data set, and model uploaded from the user computer is data requested for operation through an API remoting technique that enables input/output communication between the trusted execution environment and the accelerator. Outsourcing to the accelerator in a trusted execution environment,
Encrypts data transmitted and received through the API remoting technique and copies the encrypted data to a physically contiguous page as the front-end driver is called through a system call,
The custom library intercepts the accelerator API and calls a system call processed in the library operating system (Library OS) to deliver it to the front-end driver,
The arguments of the unprotected system call are encrypted and delivered to the front-end driver,
The backend driver receives a data operation request from the front-end driver and transmits the corresponding command to the accelerator using the accelerator runtime API and accelerator driver API.
An offloading system characterized by .

Images