Secure execution support for A.I. systems (and other heterogeneous systems)
View Patent ↗A method and apparatus for providing support for Secure Objects on a data processing system including providing a Secure Object comprising code and data that is protected on the data processing system on a first processor which is a first type of processor, wherein the data processing system includes a plurality of processors of different types, responsive to a portion of the Secure Object being needed to be executed on a second processor which is a second type of processor different than the first type of processor, by the first processor calling the second processor in a special interprocessor call, returning information by the second processor to the first processor, and retrieving, by the first processor, the information from the second processor.
1. A method for providing support for Secure Objects on a data processing system comprising:
providing a Secure Object comprising code and data that is protected on the data processing system on a first processor which is a first type of processor, wherein the data processing system includes a plurality of processors of different types;
executing the Secure Object on the first processor;
determining that an identified portion of the Secured Object is to be processed on a second processor which is a second type of processor different than the first type of processor;
responsive to determining that the identified portion of the Secure Object is to be processed on the second processor, performing, using the first processor, a special interprocessor call to allow the second processor to access the identified portion of the Secured Object, wherein the special interprocessor call securely passes an encryption key from the first processor to the second processor which the second processor uses to access a cryptographically protected region in system memory;
processing, using the second processor, the identified portion of the Secured Object; and
returning information obtained by the second processor to the first processor.
2. The method according to claim 1 , in which the special interprocessor call securely passes an integrity value from the first processor to the second processor which the second processor uses to access a cryptographically protected region in system memory.
3. The method according to claim 1 , in which the special interprocessor call securely passes a Secure Object ID from the first processor to the second processor which the second processor uses to access a protected region in system memory.
4. The method according to claim 1 , wherein the second processor performs the processing requested in the special interprocessor call, storing encrypted information resulting from the processing in system memory.
5. The method according to claim 1 , wherein the return includes an integrity value for the Secure Object.
6. The method according to claim 1 , wherein the special interprocessor call includes an indication of a particular processor from among the first processor and the second processor that is being called, an indication of a specific function that is being requested and the data that should be processed.
7. The method according to claim 1 , wherein the data processing system is an artificial intelligence system.
8. The method according to claim 1 , wherein the second type of processor is one of a Central Processing Unit, a specialized processor, a Graphical Processing Unit, a Tensor Processing Unit, a Field Programmable Gate Array, an Artificial Neural Network, a Quantum Processor and a Cryptographic Processor,
wherein the first type of processor is one of the Central Processing Unit, the specialized processor, the Graphical Processing Unit, the Tensor Processing Unit, the Field Programmable Gate Array, the Artificial Neural Network, the Quantum Processor, and the Cryptographic Processor, and
wherein the first type of processor is different than the second type of processor.
9. A computer readable medium, storing a method for securing a Secure Object on a data processing system comprising:
providing a Secure Object comprising code and data that is protected on the data processing system on a first processor which is a first type of processor, wherein the data processing system includes a plurality of processors of different types;
executing the Secure Object on the first processor;
determining that an identified portion of the Secured Object is to be processed on a second processor which is a second type of processor different than the first type of processor;
responsive to determining that the identified portion of the Secure Object is to be processed on the second processor, performing, using the first processor, a special interprocessor call to allow a the second processor to access an the identified portion of the Secured Object, wherein the special interprocessor call securely passes an encryption key from the first processor to the second processor which the second processor uses to access a cryptographically protected region in system memory;
processing, using the second processor, the identified portion of the Secured Object; and
returning information obtained by the second processor to the first processor.
10. The computer readable medium according to claim 9 , in which the special interprocessor call securely passes an integrity value from the first processor to the second processor which the second processor uses to access a cryptographically protected region in system memory.
11. The computer readable medium according to claim 9 , in which the special interprocessor call securely passes a Secure Object ID from the first processor to the second processor which the second processor uses to access a protected region in system memory.
12. The computer readable medium according to claim 9 , wherein the second processor performs processing requested in the special interprocessor call, storing encrypted information resulting from the processing in system memory.
13. The computer readable medium according to claim 9 , wherein the return includes an integrity value for the Secure Object.
14. The computer readable medium according to claim 9 , wherein the special interprocessor call includes an indication of a particular processor from among the first processor and the second processor that is being called, an indication of a specific function that is being requested and the data that should be processed, and wherein the data processing system is an artificial intelligence system.
15. The computer readable medium according to claim 9 , wherein the second type of processor is one of a Central Processing Unit, a specialized processor, a Graphical Processing Unit, a Tensor Processing Unit, a Field Programmable Gate Array, an Artificial Neural Network, a Quantum Processor and a Cryptographic Processor,
wherein the first type of processor is one of the Central Processing Unit, the specialized processor, the Graphical Processing Unit, the Tensor Processing Unit, the Field Programmable Gate Array, the Artificial Neural Network, the Quantum Processor, and the Cryptographic Processor, and
wherein the first type of processor is different than the second type of processor.
16. A data processing system comprising:
one or more processors, one or more computer-readable memories, one or more computer-readable storage media, and program instructions stored on at least one of the one or more computer-readable tangible storage media for execution by at least one of the one or more processors via at least one of the one or more computer-readable memories, wherein the computer system is capable of performing a method comprising:
providing a Secure Object comprising code and data that is protected on the data processing system on a first processor which is a first type of processor, wherein the data processing system includes a plurality of processors of different types;
executing the Secure Object on the first processor;
determining that an identified portion of the Secured Object is to be processed on a second processor which is a second type of processor different than the first type of processor;
responsive to determining that the identified portion of the Secure Object is to be processed on the second processor, performing, using the first processor, a special interprocessor call to allow a the second processor to access an the identified portion of the Secured Object, wherein the special interprocessor call securely passes an encryption key from the first processor to the second processor which the second processor uses to access a cryptographically protected region in system memory;
processing, using the second processor, the identified portion of the Secured Object; and returning information obtained by the second processor to the first processor.