Baidu USA LLC

Baidu.com Times Technology (beijing) Co. Ltd.

Baidu Online Network Technology (beijing) Co., Ltd.

Kunlunxin Technology (beijing) Company Limited

University of California

Kunlunxin Technology (beiiing) Company Limited

Tao Wei

Yueqiang Cheng

Yulong Zhang

Jian Ouyang

Yong Liu

Zhenyu Zhong

Yu Ding

Chenfu Bao

Peter G Schultz

Peng T Li

Xiao-Dong Xiang

Zhebin Qiu

Yunhan Jia

Liangzhao Xia

Qian Feng

Peng Li

Wei Ping

Xing Li

Chen Gao

Minghua Wang

Yongqiang Lu

Shengjian Guo

Pei Wang

Longri Zheng

Tongxin Li

Yaohui Chen

According to one embodiment, a DP accelerator includes one or more execution units (EUs) configured to perform data processing operations in response to an instruction received from a host system coupled over a bus. The DP accelerator includes a time unit (TU) coupled to the security unit to provide timestamp services. The DP accelerator includes a security unit (SU) configured to establish and maintain a secure channel with the host system to exchange commands and data associated with the data processing operations, where the security unit includes a secure storage area to store a private root key associated with the DP accelerator, where the private root key is utilized for authentication. The SU includes a random number generator to generate a random number, and a cryptographic engine to perform cryptographic operations on data exchanged with the host system over the bus using a session key derived based on the random number.

Data processing accelerator having a security unit to provide root trust services

According to one embodiment, a system performs a secure boot using a security module such as a trusted platform module (TPM) of a host system. The system establishes a trusted execution environment (TEE) associated with one or more processors of the host system. The system launches a memory manager within the TEE, where the memory manager is configured to manage memory resources of a data processing (DP) accelerator coupled to the host system over a bus, including maintaining memory usage information of global memory of the DP accelerator. In response to a request received from an application running within the TEE for accessing a memory location of the DP accelerator, the system allows or denies the request based on the memory usage information.

Method and system for managing memory of data processing accelerators

According to one embodiment, a system receives, at a host channel manager (HCM) of a host system, a request from an application to establish a secure channel with a data processing (DP) accelerator, where the DP accelerator is coupled to the host system over a bus. In response to the request, the system generates a first session key for the secure channel based on a first private key of a first key pair associated with the HCM and a second public key of a second key pair associated with the DP accelerator. In response to a first data associated with the application to be sent to the DP accelerator, the system encrypts the first data using the first session key. The system then transmits the encrypted first data to the DP accelerator via the secure channel over the bus.

Method for establishing a secure information exchange channel between a host system and a data processing accelerator

According to one embodiment, a data processing system performs a secure boot using a security module (e.g., a trusted platform module (TPM)) of a host system. The system verifies that an operating system (OS) and one or more drivers including an accelerator driver associated with a data processing (DP) accelerator is provided by a trusted source. The system launches the accelerator driver within the OS. The system generates a trusted execution environment (TEE) associated with one or more processors of the host system. The system launches an application and a runtime library within the TEE, where the application communicates with the DP accelerator via the runtime library and the accelerator driver.

Method and system for protecting data processed by data processing accelerators

According to one embodiment, a system receives, at a host system a public attestation key (PK_ATT) or a signed PK_ATT from a data processing (DP) accelerator over a bus. The system verifies the PK_ATT using a public root key (PK_RK) associated with the DP accelerator. In response to successfully verifying the PK_ATT, the system transmits a kernel identifier (ID) to the DP accelerator to request attesting a kernel object stored in the DP accelerator. In response to the system receives a kernel digest or a signed kernel digest corresponding to the kernel object from the DP accelerator, verifying the kernel digest using the PK_ATT. The system sends the verification results to the DP accelerator for the DP accelerator to access the kernel object based on the verification results.

Attestation protocol between a host system and a data processing accelerator

According to one embodiment, a system receives, at a runtime library executed within a trusted execution environment (TEE) of a host system, a request from an application to invoke a predetermined function to perform a predefined operation. In response to the request, the system identifies a kernel object associated with the predetermined function. The system verifies an executable image of the kernel object using a public key corresponding to a private key that was used to sign the executable image of the kernel object. In response to successfully the system verifies the executable image of the kernel object, transmitting the verified executable image of the kernel object to a data processing (DP) accelerator over a bus to be executed by the DP accelerator to perform the predefined operation.

Method and system for validating kernel objects to be executed by a data processing accelerator of a host system

A system is disclosed that receives, at a host system from a data processing (DP) accelerator, an accelerator identifier (ID) that uniquely identifies the DP accelerator, wherein the host system is coupled to the DP accelerator over a bus. The system transmits the accelerator ID to a predetermined trusted server over a network. The system receives a certificate from the predetermined trusted server over the network, the certificate certifying the DP accelerator. The system extracts a public root key (PK_RK) from the certificate for verification, the PK_RK corresponding to a private root key (SK_RK) associated with the DP accelerator. The system establishes a secure channel with the DP accelerator using the PK_RK based on the verification to exchange data securely between the host system and the DP accelerator.

Method and system for key distribution and exchange for data processing accelerators

According to one embodiment, a system establishes a secure connection between a host system and a data processing (DP) accelerator over a bus, the secure connection including one or more data channels. The system transmits a first instruction from the host system to the DP accelerator over a command channel, the first instruction requesting the DP accelerator to perform a data preparation operation. The system receives a first request to read a first data from a first memory location of the host system from the DP accelerator over one data channel. In response to the request, the system transmits the first data to the DP accelerator over the data channel, where the first data is utilized for a computation or a configuration operation. The system transmits a second instruction from the host system to the DP accelerator over the command channel to perform the computation or the configuration operation.

Method and system for providing secure communications between a host system and a data processing accelerator

Embodiments of the disclosure disclose a system to prevent data of a client from leaking to untrusted parties in a multiparty computation environment. According to one embodiment, in response to a request received at a gateway (e.g., a non-bypassable gateway) of a server from a user device of a user over a network to process user data by an execution service, the system sanitizes the user data by scanning the user data for malicious code. The system selects a trusted execution environment (TEE) worker from a number of TEE workers and initiates an execution of the execution service by the selected TEE worker. The system receives execution results from the selected TEE worker. The system transmits the execution results to the user device of the user over the network.

TPM-based secure multiparty computing system using a non-bypassable gateway

According to one embodiment, a DP accelerator includes one or more execution units (EUs) configured to perform data processing operations in response to an instruction received from a host system coupled over a bus. The DP accelerator includes a security unit (SU) configured to establish and maintain a secure channel with the host system to exchange commands and data associated with the data processing operations. The DP accelerator includes a time unit (TU) coupled to the security unit to provide timestamp services to the security unit, where the time unit includes a clock generator to generate clock signals locally without having to derive the clock signals from an external source. The TU includes a timestamp generator coupled to the clock generator to generate a timestamp based on the clock signals, and a power supply to provide power to the clock generator and the timestamp generator.

Data processing accelerator having a local time unit to generate timestamps

The present disclosure discloses a method and apparatus for loading a kernel module. A specific embodiment of the method comprises: detecting an instruction for loading a to-be-loaded kernel module into a target kernel; determining, in response to detecting the instruction, whether identifier information is included in the to-be-loaded kernel module, the identifier information being used to represent loading the to-be-loaded kernel module into the target kernel; and loading, in response to determining the identifier information being included in the to-be-loaded kernel module, the to-be-loaded kernel module into the target kernel. This embodiment improves the applicability of the to-be-loaded kernel module.

Method and apparatus for loading kernel module

According to one embodiment, in response to receiving a temporary public key (PK_d) from a data processing (DP) accelerator, a system generates a first nonce (nc) at the host system, where the DP accelerator is coupled to the host system over a bus. The system transmits a request to create a session key from the host system to the DP accelerator, the request including a host public key (PK_O) and the first nonce. The system receives a second nonce (ns) from the DP accelerator, where the second nonce is encrypted using the host public key and a temporary private key (SK_d) corresponding to the temporary public key. The system generates a first session key based on the first nonce and the second nonce, which is utilized to encrypt or decrypt subsequent data exchanges between the host system and the DP accelerator.

Method and system to derive a session key to secure an information exchange channel between a host system and a data processing accelerator

Embodiments of the disclosure disclose a system to mitigate against adversarial input samples for machine learning (ML)/artificial intelligence (AI) models. According to one embodiment, a system receives a query from a client for a ML service. The system calculates a similarity score for the query based on a number of prior queries received from the client, the similarity score representing a similarity between the received query and the prior queries. The system determines that the query is an adversarial query in response to determining that the similarity score is above a predetermined threshold.

System to mitigate against adversarial samples for ML and AI models

According to one embodiment, a system receives an intermediate result generated by a compiler based on source code, where the intermediate result includes one or more vulnerability indicators indicating one or more lines of the source code being potentially vulnerable. The system performs a grey box fuzzing on a first executable code generated from the intermediate result to generate a first set of seed inputs. The system calculates a vulnerability score for each of the seed inputs of the first set based on the vulnerability indicators for the lines of the source code reachable but has not been explored by the grey box fuzzing. The system selects one of the seed inputs in the first set having a highest vulnerability score. The system performs a concolic execution using the selected seed input as priority, the concolic execution being performed on a second executable code generated from the intermediate result.

Vulnerability driven hybrid test system for application programs

According to one embodiment, in response to a request received at a host agent of a server from a user device of a user over a network to process user data, a data processing system launches a restricted operating environment within the server. The system transmits a token representing the request to a guest agent executed within the restricted operating environment, where an executor associated with the token is launched by the guest agent within the restricted operating environment, where the executor, when executed, is configured to process the user data to generate a processing result without accessing an external component external to the restricted operating environment. The system returns the processing result back to the user device.

Growing community of inventors

Sunnyvale, CA, United States of America

Tao Wei