Patent Description:
The present disclosure relates to neural networks (NNs), and, more specifically, to always-on artificial intelligence (AI) security.

Ambient intelligence (AmI), e.g., ambient sensing, is proposed aiming to enhance the way environments and people interact with each other. Specifically speaking, AmI indicates intelligent computing where explicit input and output devices will not be required; instead a variety of sensors, e.g., accelerometers, global positioning system (GPS), microphone, camera, etc., and processors can be embedded into everyday electronic devices, e.g., mobile phones, to collect and process contextual information, using artificial intelligence (AI) techniques, for example, in order to interpret the environment's state and the users' needs.

Patent document <CIT> is regarded as relevant technological background.

Aspects of the present disclosure provide an apparatus that can be ambient intelligence (AmI) enabled. For example, the apparatus can include a first secured processor and two or more secured applications embedded in the first secured processor. Each of the secured applications can be associated with an artificial intelligence (AI) model. The apparatus can further include two or more first secured memories coupled to the first secured processor. Each of the first secured memories can be configured to store an AI executable binary that is associated with a corresponding one of the AI models. The apparatus can further include a second secured processor coupled to the first secured memories. The second secured processor can be configured to execute the AI executable binaries stored in the first secured memories. The apparatus can further include a sub-system coupled to the second secured processor, and an AI session manager coupled to the sub-system and the secured applications, the AI session manager configured to receive from the sub-system an AI session that identifies one of the AI models, and prepare and store an AI executable binary associated with the AI model to one of the first secured memories that corresponds to the AI executable binary. The sub-system can trigger the second secured processor to execute the AI executable binary stored in the first secured memory.

In an embodiment, the apparatus can further include a secure operating system (OS) embedded in the first secured processor. The secure OS can be configured to provide a trusted execution environment (TEE) within which the secured applications are protected. For example, the AI session manager can be embedded in the first secured processor and protected within the TEE. In another embodiment, the first secured memories and the second secured processor can be protected by a first firewall. In some embodiments, the sub-system can be protected by a second firewall. For example, the first firewall can provide a higher security level than the second firewall.

In an embodiment, the apparatus can further include a second memory coupled to the second secured processor. The second memory can be configured to store data on which the second secured processor executes the AI executable binary. In another embodiment, the apparatus can further include an image signal processor (ISP) coupled to the second memory. The ISP can be configured to process images and store the processed images into the second memory. In some embodiments, the apparatus can further include a facial biometric pattern secured within the TEE. For example, the second secured processor can execute the AI executable binary to determine whether any one of the processed images matches the facial biometric pattern.

In an embodiment, the first secured memories and the second secured processor can be protected by a first firewall. In another embodiment, the AI session manager can be embedded in the second secured processor. In some embodiments, the AI session manager can be protected by the first firewall. In various embodiments, the sub-system can be protected by a second firewall. For example, the first firewall can provide a higher security level than the second firewall.

In an embodiment, the sub-system can include a sensor hub.

In an embodiment, the first secured processor can include a secured central processing unit (CPU).

In an embodiment, the second secured processor can include a secured deep learning accelerator (DLA). In another embodiment, the DLA can include an accelerated processing unit (APU).

Note that this summary section does not specify every embodiment and/or incrementally novel aspect of the present disclosure or claimed invention. Instead, this summary only provides a preliminary discussion of different embodiments and corresponding points of novelty over conventional techniques. For additional details and/or possible perspectives of the present disclosure and embodiments, the reader is directed to the Detailed Description section and corresponding figures of the present disclosure as further discussed below.

Various embodiments of this disclosure that are proposed as examples will be described in detail with reference to the following figures, wherein like numerals reference like elements, and wherein:.

For example, "Personal Safety" app launched by Google has a feature that can sense if you have been in a car crash and, if so, make an emergency call on your behalf. As another example, AI and machine learning (ML) algorithms (or models) installed in a camera can be capable of recognizing its owner's face, e.g., by determining whether an image captured by the camera matches the facial biometric pattern of the owner's face.

In order for the car crash sensing feature to actually be useful, the mobile phone needs to be able to detect car crashes at all times. For example, whether a car crash happens or not can be determined by continuously polling the accelerometer and the microphone and then processing the data collected thereby, e.g., by performing always-on artificial intelligence (AI). However, the always-on continuous sensing tasks consume a great amount of precious power resources of the mobile phone.

A sensor hub (or a context hub) is a low-power sub-system (e.g., processor) that can be designed to process and interpret the data collected from the sensors, and wake up the main applications processor (AP) to take action. For example, after processing and interpreting the collected data and determining that a car crash has happened, the sensor hub can wake up the AP, and the mobile phone can call for emergency services.

<FIG> is a functional block diagram of an AmI-enabled apparatus <NUM>, e.g., a mobile phone. The apparatus <NUM> can include an AP <NUM>, a low-power sub-system <NUM> (e.g., a sensor hub) coupled to the AP <NUM>, a signal processor <NUM> (e.g., a low-power image signal processor (ISP)) coupled to the sensor hub <NUM>, a processor <NUM> such as an AI accelerator (such as a deep learning accelerator (DLA), e.g., an accelerated processing unit (APU)) coupled to the sensor hub <NUM>, and a memory150 coupled to the sensor hub <NUM>, the ISP <NUM> and the APU <NUM>.

The AP <NUM> can enable an ambient sensing function, e.g., an always-on vision (AOV) client <NUM>, and load an AI model <NUM> to the sensor hub <NUM> to offload the vast processing of data collected from embedded sensors, e.g., a camera (not shown) to the sensor hub <NUM>. In the sensor hub <NUM>, a camera driver <NUM> can drive, based on the AOV client <NUM>, the ISP <NUM> to process images (e.g., a user's face) captured by the camera and send the processed images to a camera input <NUM> of the memory <NUM>. A software development kit (SDK) <NUM>, e.g., an AI inference SDK, can drive the APU <NUM> to execute the AI model <NUM> on the processed images. For example, the APU <NUM> can execute the AI model <NUM> on the processed imaged transmitted from the camera input <NUM> with the AI executable binary corresponding to the AI model <NUM> and generate an output <NUM>, e.g., a classification result, that is associated with whether the captured user's face matches the facial biometric pattern of the owner's face.

In the apparatus <NUM>, the sensor hub <NUM> can provide secured computing with limited flexibility. For example, the sensor hub <NUM> can be secured at securing booting stage and fixed functions and security when the mobile phone is running. Ambient sensing keeps on sensing data, which include user privacy, such as voice, vision, around, location, etc. This kind of data, and the AI model <NUM> loaded into the sensor hub <NUM> as well, are likely to be attacked, stolen or tampered with if they are not well protected. Besides, the processed images on which the APU <NUM> executes the AI model <NUM> may be not captured from the camera, but transmitted by attackers from outside.

A firewall is a network security device that can monitor all incoming and outgoing traffic, and accept, reject or drop the traffic based on a defined set of security rules. For example, a firewall can control network access by monitoring incoming and outgoing packets on any open systems interconnection (OSI) layer, up to the application layer, and allowing them to pass or stop based on source and destination IP address, protocols, ports, and the packets' history in a state table, to protect the packets from being attacked, stolen or tampered with. A firewall can be hardware-based or software-based.

<FIG> is a functional block diagram of an AmI-enabled apparatus <NUM>, e.g., a mobile phone. The apparatus <NUM> differs from the apparatus <NUM> in that in the apparatus <NUM> the sensor hub <NUM> and the memory <NUM> are well protected, e.g., via a firewall <NUM> (shown in black background). Therefore, the sensed data and the AI model <NUM> are secured, and attackers cannot transmit images into the memory <NUM>. However, the AI model <NUM> needs to be restored or updated (e.g., with a new AI model <NUM>) from time to time for continuously enhancing the performance or security from device training or Internet. The AP <NUM> cannot restore or update the AI model <NUM> stored in the sensor hub <NUM>, as the sensor hub <NUM> is protected by the firewall <NUM> and the AP <NUM> does not have the authority to access the sensor hub <NUM>.

<FIG> is a functional block diagram of an AmI-enabled apparatus <NUM>, e.g., a mobile phone, according to some embodiments of the present disclosure. The apparatus <NUM> can include a secure operating system (OS) <NUM>, which can provide a trusted execution environment (TEE) <NUM> (shown in black background) for Android, where codes and data, e.g., trusted applications (TA), can be protected with respect to confidentiality and integrity. The secure OS <NUM> can run on the same processor as to where Android runs, e.g., the AP <NUM>, but be isolated by both hardware and software from the rest of the system, which runs a rich OS within a rich execution environment (REE).

An AI model <NUM> can be loaded within the TEE <NUM> provided by the secure OS <NUM>, and AI executable binary <NUM> and a control flow (including an AI session <NUM> such as the identifier (ID) of the AI model <NUM>, and an AI executor <NUM>) for the AI model <NUM> (collectively referred to as AI preparation <NUM>) can be prepared. The AI executable binary <NUM> can be transmitted to a secured memory <NUM>, and the AI session <NUM> and the AI executor <NUM> can be transmitted to a low-power sub-system <NUM>, e.g., a sensor hub. A processor <NUM> such as an AI accelerator (such as a DLA, e.g., an APU) can execute the AI executable binary <NUM> by determining the AI session <NUM> and the AI executor <NUM>. In an embodiment, the memory <NUM> and the APU <NUM> are also secured (shown in black background), e.g., via a first firewall <NUM>, in order to protect the AI executable binary <NUM> from being attacked, stolen or tampered with. In the example embodiment shown in <FIG>, the sensor hub <NUM> is not protected, as it provides only the control flow for the AI model <NUM>, which does not involve any sensed data. In some embodiment, the sensor hub <NUM> can also be protected, e.g., via a firewall. For example, the firewall may provide a lower security level than the first firewall <NUM>, as the AI session <NUM> and the AI executor <NUM> are less important than the AI executable binary <NUM>.

<FIG> is a functional block diagram of an AmI-enabled apparatus <NUM>, e.g., a mobile phone, according to some embodiments of the present disclosure. The apparatus <NUM> can include a secure OS <NUM>, which can provide a TEE <NUM> (shown in black background) for Android. An AI model <NUM> can be loaded within the TEE <NUM> provided by the secure OS <NUM>. Data, e.g., a facial biometric pattern <NUM>, can also be secured within the TEE <NUM>. AI executable binary <NUM> can be prepared based on the AI model <NUM> and downloaded into a secured memory <NUM>. The facial biometric pattern <NUM> can also be downloaded and stored in the secured memory <NUM>.

The apparatus <NUM> can further include a low-power sub-system <NUM>, e.g., a sensor hub. In the sensor hub <NUM>, a camera driver <NUM> can drive, based on the AOV client <NUM>, a signal processor <NUM>, e.g., a low-power ISP, to process images (e.g., a user's face) captured by a camera (not shown) and send the processed images to a camera input <NUM> of a protected memory <NUM>. An SDK <NUM>, e.g., an AI inference SDK, can drive a processor such as an AI accelerator (such as a DLA <NUM>, e.g., an APU) to execute the AI model <NUM> on the processed images. For example, the APU <NUM> can execute the AI model <NUM> on the processed imaged transmitted from the camera input <NUM> with the AI executable binary <NUM> and generate an output <NUM>, e.g., a classification result, that is associated with whether the captured user's face matches the owner's face, i.e., the facial biometric pattern <NUM>.

In an embodiment, the secured memory <NUM> and the APU <NUM> are well protected, e.g., via a first firewall <NUM> (shown in black background), in order to protect the AI executable binary <NUM> and the facial biometric pattern <NUM> from being damaged, stolen and tampered with. In another embodiment, the sensor hub <NUM>, the protected memory <NUM> and the ISP <NUM> can also be protected, e.g., by a second firewall <NUM> (shown in grey background), in order to prevent attackers from loading images into the ISP <NUM> and the protected memory <NUM>. For example, the first firewall <NUM> may provide a higher security level than the second firewall <NUM>, as the facial biometric pattern <NUM> and the AI executable binary <NUM> are more important than the captured images that the APU <NUM> is going to recognize.

In the example embodiment of the apparatus <NUM>, the AI model <NUM> can be prepared by the TEE <NUM> provided by the secure OS <NUM> and protected for only the APU <NUM> to access. In an embodiment, sensitive data, e.g., the facial biometric pattern <NUM>, can also be protected for only the APU <NUM> to access.

<FIG> is a functional block diagram of an AmI-enabled apparatus <NUM>, e.g., a mobile phone, according to some embodiments of the present disclosure. The apparatus <NUM> can include an AP <NUM>, e.g., a main secured central processing unit (CPU) <NUM>. A secure OS (or privilege secured app) <NUM> can be embedded in the main secured CPU <NUM> to provide a TEE <NUM> (shown in black background).

In an embodiment, two or more secured apps can be secured within the TEE <NUM>, and each of them can be associated with an AI model and AI preparation. For example, a first secured app 571A can be associated with a first AI model 522A and a first AI preparation 561A that is prepared by the secure OS <NUM> based on the first AI model 522A. As another example, a second secured app 571B can be associated with a second AI model 522B and a second AI preparation 561B that is prepared by the secure OS <NUM> based on the second AI model 522B. In an embodiment, the first secured app 571A and the second secured app 571B can request the secure OS <NUM> to open specified files with specified access rights. For example, the secure OS <NUM> can allow this request, and then open the files and return a handle (e.g., file descriptor, index into a file descriptor table) to the first secured app 571A and the second secured app 571B. Therefore, the first secured app 571A and the second secured app 571B can use the handle as a token to access the secure OS <NUM>.

In an embodiment, a first AI executable binary 581A that is generated based on the first AI preparation 561A can be sent to a first secured memory 580A, and a second AI executable binary 581B that is generated based on the second AI preparation 561B can be sent to a second secured memory 580B. The first and second AI executable binary 581A and 581B can be executed by a DLA, e.g., an APU. In an embodiment, the first secured memory 580A and the second secured memory 580B can be included in a single memory. In another embodiment, the first secured memory 580A and the second secured memory 580B can be separated from each other. In an embodiment, the first secured memory 580A and the second secured memory 580B can be secured, e.g., via a first firewall <NUM> (shown in black background), in order to protect the first AI executable binary 581A and the second AI executable binary 581B from being attacked, stolen or tampered with.

In an embodiment, the apparatus <NUM> can further include an AI session manager <NUM> and a low-power sub-system <NUM>, e.g., a sensor hub. The sensor hub <NUM> can select and send one or more of a plurality of Al sessions, e.g., a first AI session 527A and a second AI session 527B, to the AI session manager <NUM>. The AI session manager <NUM>, upon reception of the selected AI session, can manage the generation of an AI executable binary based on an AI preparation that is associated with the AI session. For example, the sensor hub <NUM> can select and send the first AI session 527A to the AI session manager <NUM>, and the AI session manager <NUM>, upon reception of the first AI session 527A, can manage the generation of the first AI executable binary 581A based on the first AI preparation 561A, which is associated with the first AI session 527A, send the generated first AI executable binary 581A to the sensor hub <NUM>, and inform the sensor hub <NUM> that the first AI executable binary 581A is ready for a processor such as an AI accelerator (such as a DLA, e.g., an APU <NUM>) to execute.

In the example embodiment of the apparatus <NUM> shown in <FIG>, the AI session manager <NUM> can also be secured within the TEE <NUM> provided by the secure OS <NUM>. In an embodiment, the sensor hub <NUM> can also be protected, e.g., by a second firewall <NUM> (shown in grey background). For example, the second firewall <NUM> may provide a lower security level than the first firewall <NUM>, as the control flow (including the first and second AI sessions 527A and 527B, such as IDs of the first and second AI models 522A and 522B, and first and second AI executors 528A and 528B) is less important than the first AI executable binary 581A and the second AI executable binary 581B.

In an embodiment, the apparatus <NUM> can further include an isolated or secured DLA <NUM>, e.g., an APU, which can execute one of the first and second AI models 522A and 522B with a corresponding one of the first and second AI executable binary 581A and 582A. For example, the first or second AI executor 528A or 528B can trigger the APU <NUM> to execute the first or second AI executable binary 581A or 581B that corresponds to the first or second AI session 517A or 527B, respectively. In an embodiment, the APU <NUM> can also be secured, e.g., via a firewall, such as the first firewall <NUM>.

In the example embodiment of the apparatus <NUM>, the first and second AI models 522A and 522B can be protected by the TEE <NUM>. In an embodiment, sensitive data, e.g., the facial biometric pattern <NUM>, can also be secured within the TEE <NUM> and downloaded and stored in the first secured memory 580A and/or the second secure memory 580B. In some embodiments, the first and second AI models 522A and 522B, which are protected within the TEE <NUM>, can be updated or restored, and new AI models, e.g., the new AI models <NUM> shown in <FIG>, can also be loaded, with mTEE's verification or decryption for security and integrity.

<FIG> is a functional block diagram of an AmI-enabled apparatus <NUM>, e.g., a mobile phone, according to some embodiments of the present disclosure. The apparatus <NUM> can be similar to the apparatus <NUM> except the location of the AI session manager <NUM> and the omission of the secure OS <NUM>. In the example embodiment of the apparatus <NUM> shown in <FIG>, the AI session manager <NUM> is embedded in the secured APU <NUM>, and the APU <NUM> can do central management for multiple OSs (hosts) supporting.

<FIG> is a functional block diagram of an AmI-enabled apparatus <NUM>, e.g., a mobile phone, according to some embodiments of the present disclosure. The apparatus <NUM> can be similar to the apparatus <NUM> except the location of the AI session manager <NUM> and the omission of the secure OS <NUM>. In the example embodiment of the apparatus <NUM> shown in <FIG>, the AI session manager <NUM> is independent from the main secured CPU <NUM> and the secured APU <NUM>.

Claim 1:
An apparatus, comprising:
a first secured processor; two or more secured applications embedded in the first secured processor, each of the secured applications associated with an artificial intelligence, AI, model;
two or more first secured memories coupled to the first secured processor, each of the first secured memories configured to store an AI executable binary that is associated with a corresponding one of the AI models;
a second secured processor coupled to the first secured memories, the second secured processor configured to execute the AI executable binaries stored in the first secured memories;
a sub-system coupled to the second secured processor; and
an AI session manager coupled to the sub-system and the secured applications, the AI session manager configured to receive from the sub-system an AI session that identifies one of the AI models, and prepare and store an AI executable binary associated with the AI model to one of the first secured memories that corresponds to the AI executable binary,
wherein the sub-system triggers the second secured processor to execute the AI executable binary stored in the first secured memory.