Network architecture for artificial intelligence model protection
A remote (e.g., cloud, edge-cloud) computing environment may be improved by configuring a client device to function as an extension of the cloud computing environment, such as by coordinating the execution and processing of data on the client device. Secure content or privacy-sensitive content is protected confidentially while in a cloud computing environment or client device, and may be moved to a client device and decrypted to a client local container for various user productivity processing workloads, thereby reducing or eliminating privacy concerns. This solution also provides improved security for sharing and usage of pre-trained AI models on a client device, such as by extending attestation and provisioning capabilities from cloud computing environment into clients, and by leveraging cloud computing technology on clients that protects cloud assets. This provides an improved ability to protect trained AI models and avoid exposing an AI model training process on a client device.
1 . A system for provisioning of a trained artificial intelligence (AI) model, the system comprising:
processor circuitry; and
a memory that includes instructions, the instructions, when executed by the processor circuitry, cause the processor circuitry to:
receive a deployment request for an AI model from a client device;
send a remote attestation request to the client device in response to the deployment request;
receive a remote attestation response from the client device;
verify the remote attestation response;
generate an encrypted model based on the AI model in response to verifying the remote attestation response; and
send the encrypted model to a first trusted environment within the client device.
2 . The system of claim 1 , the instructions further cause the processor circuitry to send the encrypted model to a second trusted environment associated with an accelerator within the client device; wherein:
the first trusted environment includes a first security architecture specific to the client device; and
the second trusted environment includes a second architecture that is specific to the accelerator and different from the first security architecture.
3 . The system of claim 1 , the instructions further cause the processor circuitry to:
generate a symmetric key to encrypt the AI model in response to verifying the remote attestation response, wherein the encrypted model is generated further based on the symmetric key;
generate a wrapped key based on the symmetric key; and
send the wrapped key to the client device.
4 . The system of claim 3 , the instructions further cause the processor circuitry to provision an attestation key for a client computing device prior to receiving the deployment request.
5 . The system of claim 4 , wherein receiving the remote attestation response includes receiving a device quote signed by the attestation key.
6 . The system of claim 4 , the instructions further cause the processor circuitry to:
receive a unique device key pair and an attestation certificate chain for the attestation key generated at the client device; and
extract a public key from the attestation certificate chain subsequent to verifying the remote attestation response.
7 . The system of claim 1 , wherein verifying the remote attestation response includes:
sending the remote attestation response to an attestation verifier; and
receiving a remote attestation verification from the attestation verifier.
8 . The system of claim 1 , the instructions further cause the processor circuitry to receive a trained model from the client device, the trained model generated by retraining the AI model at the client device.
9 . A method for provisioning of a trained artificial intelligence (AI) model, the method comprising:
receiving a deployment request for an AI model from a client device;
sending a remote attestation request to the client device in response to the deployment request;
receiving a remote attestation response from the client device;
verifying the remote attestation response;
generating an encrypted model based on the AI model in response to verifying the remote attestation response; and
sending the encrypted model to a first trusted environment within the client device.
10 . The method of claim 9 , further including sending the encrypted model to a second trusted environment associated with an accelerator within the client device; wherein:
the first trusted environment includes a first security architecture specific to the client device; and
the second trusted environment includes a second architecture that is specific to the accelerator and different from the first security architecture.
11 . The method of claim 9 , further including:
generating a symmetric key to encrypt the AI model in response to verifying the remote attestation response, wherein the encrypted model is generated further based on the symmetric key;
generating a wrapped key based on the symmetric key; and
sending the wrapped key to the client device.
12 . The method of claim 11 , further including provisioning an attestation key for a client computing device prior to receiving the deployment request.
13 . The method of claim 12 , wherein receiving the remote attestation response includes receiving a device quote signed by the attestation key.
14 . The method of claim 12 , further including:
receiving a unique device key pair and an attestation certificate chain for the attestation key generated at the client device; and
extracting a public key from the attestation certificate chain subsequent to verifying the remote attestation response.
15 . The method of claim 9 , wherein verifying the remote attestation response includes:
sending the remote attestation response to an attestation verifier; and
receiving a remote attestation verification from the attestation verifier.
16 . The method of claim 9 , further including receiving a trained model from the client device, the trained model generated by retraining the AI model at the client device.
17 . At least one non-transitory machine-readable storage medium, comprising instructions that, responsive to being executed with processor circuitry of a computer-controlled device, cause the processor circuitry to:
receive a deployment request for an AI model from a client device;
send a remote attestation request to the client device in response to the deployment request;
receive a remote attestation response from the client device;
verify the remote attestation response;
generate an encrypted model based on the AI model in response to verifying the remote attestation response; and
send the encrypted model to a first trusted environment within the client device.
18 . The at least one non-transitory machine-readable storage medium of claim 17 , the instructions further causing the processor circuitry to send the encrypted model to a second trusted environment associated with an accelerator within the client device; wherein:
the first trusted environment includes a first security architecture specific to the client device; and
the second trusted environment includes a second architecture that is specific to the accelerator and different from the first security architecture.
19 . The at least one non-transitory machine-readable storage medium of claim 17 , the instructions further causing the processor circuitry to:
generate a symmetric key to encrypt the AI model in response to verifying the remote attestation response, wherein the encrypted model is generated further based on the symmetric key;
generate a wrapped key based on the symmetric key; and
send the wrapped key to the client device.
20 . The at least one non-transitory machine-readable storage medium of claim 19 , the instructions further causing the processor circuitry to provision an attestation key for a client computing device prior to receiving the deployment request.