KR20230010963A - Secure offloading of computations from trusted execution environment(tee) to accelerators - Google Patents

Abstract

Disclosed is secure offloading of computation from a trusted execution environment(TEE) to an accelerator. According to one embodiment of the present invention, offloading data computation performed by an offloading system includes the steps of: establishing an input/output channel between a trusted execution environment of a processor and an accelerator in an environment in which the accelerator is mounted; and offloading an operation to the accelerator in the trusted execution environment through the established input/output channel.

Description

Techniques for safely offloading operations from Trusted Execution Environment (TEE) to accelerators

The following description relates to a technique for safely offloading operations from a trusted execution environment to an accelerator in a public server environment.

Cloud computing services provided by cloud service providers (CSPs) have recently achieved explosive growth due to scalability and convenience. Meanwhile, in the field of artificial intelligence, machine learning (ML) technology has also attracted public attention, making Machine Learning as a Service (MLaaS) an attractive option for data scientists and artificial intelligence researchers. However, the cloud environment is not an ideal environment for security, especially privacy protection. It may be a situation where you have to share hardware such as CPU and accelerator with other users, and attacks to steal data in situations where accelerators are shared have been suggested several times. Through this, there is a possibility that the assets of artificial intelligence researchers, such as machine learning models, algorithms, and data sets, will be leaked. Since various institutions such as banks and hospitals have a large amount of personal information-related data, Privacy Preserving Machine Learning (PPML) techniques have been created to protect it in machine learning.

Privacy Protection Machine learning is a technology that protects a model containing sensitive personal information from other users when training or using a model to make predictions. However, existing technologies reduce accuracy, require a high level of security knowledge, are difficult to use, or reduce performance. Multi-Party Computation (MPC) or Homomorphic Encryption (HE) have a huge impact on performance because they are based on encryption. Machine learning through hardware-based security requires the use of special hardware or modification of existing hardware, making it incompatible. Differential Privacy (DP) adds noise to the data, which reduces accuracy.

As research on processor-based Trusted Execution Environment (TEE), including Intel SGX, has emerged, several studies have been conducted to perform machine learning calculations in the Trusted Execution Environment (TEE). Intel SGX has many limitations. For example, the size of the enclave page cache (EPC), a memory area protected by SGX, is only 90MB, which is far below the size of common models or data. In addition, since system calls are impossible inside SGX and there is no reliable communication channel with I/O devices, there are restrictions on using peripheral devices such as accelerators.

Recently, studies related to the library OS have been conducted such as enabling system calls or executing Python codes in SGX to solve these limitations. However, there is still a limitation that system call arguments are not protected. In the SGXIO study, we tried to establish a generic trusted I/O path between SGX and the device, but it has the disadvantage that it is not optimized for accelerator use and does not suggest a method of executing Python code commonly used by artificial intelligence researchers.

Performing calculations required for machine learning using only a CPU results in hundreds of times lower performance compared to using an accelerator. This is because the computations required for machine learning are highly parallel, and the accelerator is optimized for parallel computation. Accordingly, the necessity of offloading calculations to be performed in the accelerator while executing the program in SGX to the accelerator is emerging.

It is possible to provide a method and system for safely protecting data offloaded to the accelerator from an attacker with system (kernel) authority in an environment where the accelerator is installed. That is, it establishes and protects the I/O channel between the trusted execution environment (TEE) of the processor and the accelerator.

A method and system that can be applied to a general existing system without modifying the architecture of an accelerator or processor can be provided.

It is possible to provide a method and system for improving performance and accuracy without using homomorphic encryption (HE) or differentiated privacy (DP).

A method of offloading a data operation performed by an offloading system includes establishing an input/output channel between a trusted execution environment of a processor and an accelerator in an accelerator-mounted environment; and offloading an operation to the accelerator in the trusted execution environment through the established input/output channel.

The environment in which the accelerator is installed may include a cloud environment in which the accelerator is installed or an environment in which the accelerator is installed including a trusted region in which kernel codes are separated and generated.

The offloading may include outsourcing data requested for operation from the trusted execution environment to the accelerator through an API remoting technique that enables input/output communication between the trusted execution environment of the processor and the accelerator in an environment in which the accelerator is mounted. steps may be included.

The API remoting technique may mean that when an input/output request is generated in a guest environment, it is transferred to a local or remote host to process the generated input/output request.

The guest environment may be a VM instance, and the host environment may be a hypervisor.

The guest environment may be an untrusted part of the kernel from which kernel codes are separated, and the host environment may be a trusted part of kernel from which kernel codes are separated.

The offloading step includes decrypting encrypted data uploaded to a VM instance through a channel between a user and a VM instance in an enclave of the trusted execution environment, and the VM instance Encrypted data uploaded to may be encrypted data including codes, data, and models from the user.

In the offloading step, the decrypted data is encrypted in the enclave by the library operating system (Library OS) of the trusted execution environment through a channel between the VM instance and the hypervisor, and the encrypted data is encrypted in the enclave. Copying the encrypted data out of the clave and copying the encrypted data to a physically contiguous page as a frontend driver is called through a system call.

The offloading may include reading the encrypted data in the hypervisor, decrypting the encrypted data in the memory of the hypervisor, and calling an accelerator API to perform an operation on the decrypted data. can

In the offloading step, the user and kernel code are separated from the enclave of the trusted execution environment, and the kernel code is separated through a channel between the untrusted area of the kernel to decrypt encrypted data uploaded to the untrusted area of the kernel. The encryption data including the step, in which the kernel code is separated and uploaded to the untrusted region of the kernel, may be encrypted data including code, data set, and model from the user.

In the offloading, the kernel code is separated from the untrusted area of the kernel and the kernel code is separated from the trusted part of the kernel through a channel between the library operating system (Library Operating System) of the trusted execution environment. Data is encrypted in the enclave by the OS), the encrypted data is copied out of the enclave, and the encryption is placed on a physically contiguous page as a frontend driver is called through a system call. It may include the step of copying the data.

In the offloading step, the kernel code is separated to read the encrypted data in the trusted region of the kernel, the kernel code is separated to decrypt the encrypted data in the memory of the trusted region of the kernel, and the accelerator and performing an operation on the decrypted data by calling an API.

The offloading may include encrypting a result value obtained as the accelerator performs an operation on the requested data, and returning the encrypted result value to the enclave of the trusted execution environment. can do.

A computer program stored in a computer-readable storage medium to execute a method of offloading data operations performed by the offloading system establishes an input/output channel between the trusted execution environment of the processor and the accelerator in an environment in which the accelerator is mounted. ; and offloading an operation to the accelerator in the trusted execution environment through the established input/output channel.

The offloading system includes: a channel establishment unit for establishing an input/output channel between a trusted execution environment of a processor and an accelerator in an accelerator-mounted environment; and an offloading unit for offloading an operation to the accelerator in the trusted execution environment through the established input/output channel.

The risk of data leakage can be reduced by using the Trusted Execution Environment (TEE).

In the SGX enclave, parallel operations can be safely offloaded to the accelerator to achieve performance gains over using the processor.

It is compatible with existing hardware (processor and accelerator) without the need to purchase additional special hardware or modify existing hardware.

AI researchers and data scientists can use existing high-level code as it is.

1 is a diagram for explaining an accelerator use operation in a cloud environment.
2 is an example for describing an operation of offloading a data operation, according to an embodiment.
3 is another example for describing an operation of offloading a data operation according to an exemplary embodiment.
4 is a diagram for explaining a data movement operation according to an exemplary embodiment.
5 is a block diagram illustrating a configuration of an offloading system according to an exemplary embodiment.
6 is a flowchart illustrating a method of offloading a data operation in an offloading system according to an exemplary embodiment.

Hereinafter, an embodiment will be described in detail with reference to the accompanying drawings.

1 is a diagram for explaining an accelerator use operation in a cloud environment.

1 is a diagram showing the movement of data when an existing artificial intelligence researcher uses an accelerator by utilizing a computing instance in a cloud environment. Data 110 such as codes, data sets, and models may be uploaded from the PC of the user 101 to the instance. Codes uploaded to the instance (untrusted system) 120 from the PC of the user 101, data codes for data sets, models, etc. may be executed. At this time, the data 110 is transmitted to the accelerator 130, and as the accelerator 130 performs an operation on the data 110, an operation result obtained may be delivered.

In this way, if the existing system is taken over by an attacker, data may be leaked.

Since the cloud is a general virtual environment, a cloud service provider (CSP) allows users to utilize the accelerator through accelerator pass-through or accelerator virtualization, which is a technique that can use an existing accelerator in a virtual environment.

In the current situation, if an instance is hacked by an attacker, data will be exposed defenselessly and important assets will be leaked. Therefore, in the embodiment, an operation of safely protecting data offloaded to the accelerator from an attacker with system (kernel) rights in an environment where the accelerator is installed using a data protection control area will be described. In this case, the data protection control area may mean enclaves, which are memory areas protected in a trusted execution environment. For example, it could be Intel's SGX. It provides hardware-based memory encryption that separates data in memory from specific application code. Allows user-level code to allocate private areas of memory called enclaves, which are designed to be protected from processes running at elevated privilege levels.

2 is an example for describing an operation of offloading a data operation, according to an embodiment.

The offloading system may protect running data and data stored in a disk by utilizing a trusted execution environment, and outsource data requiring accelerator operation to an accelerator through an API remoting technique (201). At this time, sensitive data transmitted and received through the API remoting channel can be encrypted and protected.

Inside the trusted execution environment, the Library OS is used to enable execution of high-level codes such as Python.

The offloading system establishes an input/output channel between the trusted execution environment of the processor and the accelerator in an environment where the accelerator is mounted, and can offload operations from the trusted execution environment to the accelerator through the established input/output channel.

Referring to FIG. 2 , it is a diagram illustrating a cloud environment 200 equipped with an accelerator. The offloading system provides data 110 for which operation is requested through an API remoting technique 201 that enables input/output communication between the trusted execution environment of the processor and the accelerator 130 in the cloud environment 200 in which the accelerator 130 is mounted. ) can be outsourced to the accelerator 130 in a trusted execution environment. At this time, the API remoting technique 201 means that when an input/output request is generated in a guest environment, it is transferred to a local or remote host to process the generated input/output request. In an embodiment, the guest environment may be a VM instance, and the host environment may be a hypervisor.

The offloading system encrypts data 110 including codes, data sets, and models from the user 101 through a channel between the user 101 and the VM instance 210 and uploads it to the VM instance 210, , Data encrypted in the enclave 220 of the trusted execution environment can be decrypted in the VM instance 210. The offloading system encrypts data in the enclave 220 by a library operating system (Library OS) of a trusted execution environment through a channel between the VM instance 210 and the hypervisor 250, and the encrypted data is transferred to the enclave 220. ), and as the frontend driver 230 is called through a system call, encrypted data may be copied to a physically contiguous page. At this time, since the pages allocated by the front-end driver 230 are physically adjacent to each other and directly accessible to the hypervisor 250, data copying is not required. The offloading system may read encrypted data from the hypervisor 250, decrypt the encrypted data in memory, and call an accelerator API (eg, CUDA API) to perform an operation on the decrypted data. The offloading system may deliver the decrypted data to the accelerator through an accelerator API (eg, CUDA API) to perform an operation on the decrypted data. The offloading system may encrypt result values obtained as the accelerator performs calculations on data, and return the encrypted result values to the enclave of the trusted execution environment.

For example, a user may use an instance with an accelerator when using a cloud computing service (eg, Amazon EC2). Clouds generally use virtual environments, which means users are more likely to share their hardware with others, which can pose a security threat as it provides attackers with more attack vectors. In this case, even if the instance is seized by an attacker by using the operation proposed in the embodiment, leakage of data used in the instance can be prevented.

According to the embodiment, it is very easy to apply to a cloud environment, but is not limited to the cloud environment. Similar to the hypervisor method, if a reliable part can be created by separating the kernel code (for example, SKEE, nested kernel, etc.), the method described above can be applied. Since this is sufficiently possible through software modification, it can be used even if virtualization is not applicable. A description of this will be described in FIG. 3 .

Referring to FIG. 3 , it is a diagram illustrating an environment in which an accelerator 130 including a trusted region generated by separating kernel codes is mounted. The offloading system is an API remoting that enables I/O communication between the trusted execution environment of the processor and the accelerator 130 in an environment where the accelerator 130 is mounted, including the trusted region 310 generated by separating the kernel code. Through the method 201, the data for which the operation is requested can be outsourced to the accelerator 130 in the trusted execution environment. At this time, the API remoting technique 201 means that when an input/output request is generated in a guest environment, it is transferred to a local or remote host to process the generated input/output request. In the embodiment, the guest environment is an untrusted part of the kernel 310 in which kernel code is separated, and the host environment is a trusted part of kernel in which kernel code is separated. (320).

The offloading system separates the user 101 and the kernel code and encrypts data 110 including codes, data sets, and models from the user through a channel between the untrusted area (untrusted area) 310 of the kernel. The kernel code is separated and uploaded to the untrusted area 310 of the kernel, and encrypted data can be decrypted in the enclave 220 of the trusted execution environment. The offloading system separates the kernel code from the untrusted area of the kernel and the kernel code to the library operating system (Library OS) of the trusted execution environment through channels between the trusted parts of the kernel. data is encrypted in the enclave by the enclave, the encrypted data is copied out of the enclave, and the encrypted data is copied to a physically contiguous page as the Frontend Driver is called through a system call. can At this time, since the pages allocated by the front-end driver are physically adjacent, the kernel code is separated and direct access to the trusted area of the kernel is possible, so no data copy is required. In the offloading system, the kernel code is separated to read the encrypted data in the trusted area of the kernel, the kernel code is separated to decrypt the encrypted data in the memory of the trusted area of the kernel, and the accelerator API (eg, CUDA API) can be called to perform operations on decrypted data. The offloading system may deliver the decrypted data to the accelerator through an accelerator API (eg, CUDA API) to perform an operation on the decrypted data. The offloading system may encrypt result values obtained as the accelerator performs calculations on data, and return the encrypted result values to the enclave of the trusted execution environment.

4 is a diagram for explaining a data movement operation according to an exemplary embodiment.

It is a diagram for explaining the operation of moving data between a front-end driver and a back-end driver. Accelerator APIs (e.g., CUDA APIs) can be called while PyTorch code is running. In FIG. 4 , CUDA API among accelerator APIs will be described as an example. At this time, the custom library can intercept the called CUDA API. The custom library can call the ioctl() system call to transfer the called CUDA API to the front-end driver. These system calls are processed in the library operating system (Library OS) and can be implemented through ocall. Encrypted arguments from unprotected memory can be passed to a front-end driver loaded into the guest VM's kernel.

A front-end driver can provide an interface to the guest VM in the form of a virtual device on the /dev filesystem.

The front-end driver can receive a data operation request, copy the encrypted data to a physically connected page, and forward the request to the back-end driver. For example, a request can be forwarded to a backend driver located in the hypervisor. At this point, even if an attacker takes control of the front-end driver, he or she will only be able to see the encrypted data.

As the backend drive receives a data operation request, it can transmit commands to the accelerator using the actual CUDA runtime API and CUDA driver API. Accelerators can perform data calculations. The result value obtained through the operation is encrypted and returned to the enclave of the trusted execution environment.

The operation described in FIG. 4 is not limited to a cloud environment, and may be applied to a trusted domain in which kernel codes are separated.

5 is a block diagram illustrating a configuration of an offloading system according to an exemplary embodiment, and FIG. 6 is a flowchart illustrating a method of offloading a data operation in an offloading system according to an exemplary embodiment.

The processor of the offloading system 500 may include a channel establishment unit 510 and an offloading unit 520 . The components of the processor may represent different functions performed by the processor according to control instructions provided by program codes stored in the offloading system. The processor and components of the processor may control the offloading system to perform steps 610 to 620 included in the method of offloading a data operation of FIG. 6 . In this case, the processor and components of the processor may be implemented to execute instructions according to the code of an operating system included in the memory and the code of at least one program.

The processor may load a program code stored in a file of a program for a method of offloading a data operation into a memory. For example, when a program is executed in the offloading system, the processor may control the offloading system to load a program code from a file of the program into a memory under the control of an operating system. At this time, each of the channel establishment unit 510 and the offloading unit 520 executes a command of a corresponding part of the program code loaded into the memory to perform the subsequent steps 610 to 620 with different functional representations of the processor. can be picked up

In step 610, the channel establishment unit 510 may establish an input/output channel between the trusted execution environment of the processor and the accelerator in the accelerator-mounted environment.

In step 620, the offloading unit 520 may offload the operation to the accelerator in the trusted execution environment through the established input/output channel. The offloading unit 520 may outsource data for which an operation is requested from the trusted execution environment to the accelerator through an API remoting technique that enables input/output communication between the trusted execution environment of the processor and the accelerator in an environment in which the accelerator is mounted. In this case, the environment in which the accelerator is installed may include a cloud environment in which the accelerator is installed or an environment in which the accelerator is installed including a trusted area generated by separating kernel codes. In addition, the API remoting technique means that when an input/output request is generated in a guest environment, it is transferred to a local or remote host to process the generated input/output request. Here, the guest environment may be a VM instance, and the host environment may be a hypervisor. Alternatively, the guest environment may be an untrusted part of the kernel with separated kernel code, and the host environment may be a trusted part of the kernel with separated kernel code. For example, encrypted data including codes, data sets, and models may be uploaded to a VM instance from a user through a channel between a user and a VM instance. The offloading unit 520 may decrypt encrypted data in the enclave of the trusted execution environment. The offloading unit 520 encrypts data in the enclave by a library operating system (Library OS) of a trusted execution environment through a channel between a VM instance and a hypervisor, copies the encrypted data out of the enclave, and As a frontend driver is called through a call, encrypted data can be copied to a physically contiguous page. The offloader 520 may read encrypted data from the hypervisor, decrypt the encrypted data in the memory of the hypervisor, and call an accelerator API to perform an operation on the decrypted data. In this case, the accelerator API may include CUDA API, AMD GPU API, and the like.

As another example, the kernel code is separated from the user, and encrypted data including code, data sets, and models from the user through a channel between the untrusted area of the kernel can be uploaded to the untrusted area of the kernel when the kernel code is separated. there is. The offloading unit 520 may decrypt encrypted data in the enclave of the trusted execution environment. The offloading unit 520 separates the kernel code and separates the untrusted area of the kernel and the kernel code to provide a library operating system (Library OS) of the trusted execution environment through a channel between the trusted part of the kernel. Data is encrypted in the enclave by , the encrypted data is copied out of the enclave, and the encrypted data is copied to a physically contiguous page as the frontend driver is called through a system call. can do. The offloading unit 520 separates the kernel code, reads the encrypted data in the trusted region of the kernel, decrypts the separated data encrypted in the memory of the trusted region of the kernel, calls the accelerator API, Operations can be performed on decrypted data.

The offloading unit 520 may encrypt a result value obtained as the accelerator performs an operation on the requested data, and return the encrypted result value to the enclave of the trusted execution environment.

According to the embodiment, a company that essentially uses an accelerator, such as a cloud service provider or an artificial intelligence research institute, can improve security and reduce the risk of data leakage while minimizing changes to the system in use.

According to the embodiment, a company or individual performs data calculation at low cost through software measures such as installing a hypervisor in an existing system or dividing a kernel into a trusted area and an untrusted area without the need to purchase additional equipment. Offloading can be done. When installing a hypervisor, widely used open source hypervisors such as KVM/QEMU can be borrowed.

According to the embodiment, it can be used throughout the business group in which the accelerator is used. It can be used by banks, credit card companies, hospitals, insurance companies, IT companies, and even various government departments that research artificial intelligence. In addition, it can be applied to various CSPs or IDCs that provide cloud services.

The devices described above may be implemented as hardware components, software components, and/or a combination of hardware components and software components. For example, devices and components described in the embodiments may include, for example, a processor, a controller, an arithmetic logic unit (ALU), a digital signal processor, a microcomputer, a field programmable gate array (FPGA) , a programmable logic unit (PLU), microprocessor, or any other device capable of executing and responding to instructions. A processing device may run an operating system (OS) and one or more software applications running on the operating system. A processing device may also access, store, manipulate, process, and generate data in response to execution of software. For convenience of understanding, there are cases in which one processing device is used, but those skilled in the art will understand that the processing device includes a plurality of processing elements and/or a plurality of types of processing elements. It can be seen that it can include. For example, a processing device may include a plurality of processors or a processor and a controller. Other processing configurations are also possible, such as parallel processors.

Software may include a computer program, code, instructions, or a combination of one or more of the foregoing, which configures a processing device to operate as desired or processes independently or collectively. You can command the device. Software and/or data may be any tangible machine, component, physical device, virtual equipment, computer storage medium or device, intended to be interpreted by or provide instructions or data to a processing device. can be embodied in Software may be distributed on networked computer systems and stored or executed in a distributed manner. Software and data may be stored on one or more computer readable media.

The method according to the embodiment may be implemented in the form of program instructions that can be executed through various computer means and recorded on a computer readable medium. The computer readable medium may include program instructions, data files, data structures, etc. alone or in combination. Program commands recorded on the medium may be specially designed and configured for the embodiment or may be known and usable to those skilled in computer software. Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks and magnetic tapes, optical media such as CD-ROMs and DVDs, and magnetic media such as floptical disks. - includes hardware devices specially configured to store and execute program instructions, such as magneto-optical media, and ROM, RAM, flash memory, and the like. Examples of program instructions include high-level language codes that can be executed by a computer using an interpreter, as well as machine language codes such as those produced by a compiler.

As described above, although the embodiments have been described with limited examples and drawings, those skilled in the art can make various modifications and variations from the above description. For example, the described techniques may be performed in an order different from the method described, and/or components of the described system, structure, device, circuit, etc. may be combined or combined in a different form than the method described, or other components may be used. Or even if it is replaced or substituted by equivalents, appropriate results can be achieved.

Therefore, other implementations, other embodiments, and equivalents of the claims are within the scope of the following claims.

Claims (15)

A method for offloading data operations performed by an offloading system, comprising:
Establishing an input/output channel between the trusted execution environment of the processor and the accelerator in an environment in which the accelerator is mounted; and
Offloading an operation to the accelerator in the trusted execution environment through the established input/output channel.
Offloading method comprising a. According to claim 1,
The environment in which the accelerator is mounted includes a cloud environment in which the accelerator is mounted or an environment in which the accelerator is mounted including a trusted area generated by separating the kernel code. According to claim 1,
In the offloading step,
Outsourcing data requested for operation from the trusted execution environment to the accelerator through an API remoting technique that enables input/output communication between the trusted execution environment of the processor and the accelerator in the environment in which the accelerator is mounted.
Offloading method comprising a. According to claim 3,
The API remoting technique means that when an input/output request occurs in a guest environment, it is transmitted to a local or remote host to process the generated input/output request. Offloading method. According to claim 4,
The guest environment is a VM instance, and the host environment is a hypervisor.
An offloading method, characterized in that. According to claim 4,
The guest environment is an untrusted part of the kernel from which kernel code is separated, and the host environment is a trusted part of kernel from which kernel code is separated.
An offloading method, characterized in that. According to claim 3,
In the offloading step,
Decrypting encrypted data uploaded to a VM instance through a channel between a user and a VM instance in the enclave of the trusted execution environment.
including,
The encrypted data uploaded to the VM instance is encrypted data including code, data, and models from the user.
How to offload. According to claim 7,
In the offloading step,
The decrypted data is encrypted in the enclave by the library operating system (Library OS) of the trusted execution environment through a channel between the VM instance and the hypervisor, the encrypted data is copied out of the enclave, and the system call Copying the encrypted data to a physically contiguous page as a frontend driver is called through
Offloading method comprising a. According to claim 8,
In the offloading step,
reading the encrypted data in the hypervisor, decrypting the encrypted data in the memory of the hypervisor, and calling an accelerator API to perform an operation on the decrypted data;
Offloading method comprising a. According to claim 3,
In the offloading step,
Decrypting encrypted data uploaded to the untrusted area of the kernel by separating the user and kernel code from the enclave of the trusted execution environment and separating the kernel code through a channel between the untrusted area of the kernel.
including,
The encrypted data from which the kernel code is separated and uploaded to the untrusted area of the kernel is encrypted data including code, data set, and model from the user.
How to offload. According to claim 10,
In the offloading step,
The kernel code is separated, and the kernel code is separated from the untrusted part of the kernel, and the library operating system (Library OS) of the trusted execution environment is used in the enclave through a channel between the trusted part of the kernel. The decrypted data is encrypted, the encrypted data is copied out of the enclave, and the encrypted data is copied to a physically contiguous page as a frontend driver is called through a system call. step to do
Offloading method comprising a. According to claim 11,
In the offloading step,
The kernel code is separated to read the encrypted data in the trusted area of the kernel, the kernel code is separated to decrypt the encrypted data in the memory of the trusted area of the kernel, and calls an accelerator API to obtain the decrypted data. Steps to perform operations on data
Offloading method comprising a. According to claim 3,
In the offloading step,
Encrypting a result value obtained as the accelerator performs an operation on the requested data, and returning the encrypted result value to the enclave of the trusted execution environment.
Offloading method comprising a. A computer program stored in a computer readable storage medium for executing a method of offloading a data operation performed by an offloading system, comprising:
Establishing an input/output channel between the trusted execution environment of the processor and the accelerator in an environment in which the accelerator is mounted; and
Offloading an operation to the accelerator in the trusted execution environment through the established input/output channel.
A computer program stored in a computer readable storage medium comprising a. In the offloading system,
a channel establishment unit that establishes an input/output channel between the trusted execution environment of the processor and the accelerator in an accelerator-mounted environment; and
An offloading unit for offloading an operation to the accelerator in the trusted execution environment through the established input/output channel.
An offloading system comprising a.

Images