Telekine: Secure Computing with Cloud GPUs
Telekine: Secure Computing with Cloud GPUs
复制标题
DOI：
--
复制
发表时间：
2020
期刊：
影响因子：
--
通讯作者：
T. Hunt;Zhipeng Jia;Vance Miller;Ariel Szekely;Yige Hu;C. Rossbach;Emmett Witchel
中科院分区：
文献类型：
--
作者：
T. Hunt;Zhipeng Jia;Vance Miller;Ariel Szekely;Yige Hu;C. Rossbach;Emmett Witchel
由于gpu在机器学习和计算机视觉等领域的显著性能提升，gpu在云中变得无处不在。然而，将GPU计算转移到云端需要对供应商和管理员给予极大的信任。最近关于GPU可信执行环境（tee）的建议很有希望，但未能解决非常实际的侧信道问题。为了说明问题的严重性，我们演示了一种新颖的攻击，该攻击使攻击者能够通过仅观察GPU内核执行的时间而不是图像本身来正确分类来自ImageNet[17]的图像。Telekine使应用程序能够在云端安全地使用GPU加速，基于一种新颖的GPU流抽象，确保通过不可信组件的执行和交互独立于任何秘密数据。给定支持TEE的GPU， Telekine使用API远程的新变体将应用程序级软件划分为组件，以确保依赖于秘密的行为只发生在可信组件上。Telekine可以在MXNet[10]上安全地训练现代图像识别模型，相对于使用本地附加GPU的不安全基线，性能损失为10%-22%。它使用Galois[75]在一个和两个gpu上运行图形算法，开销为18%-41%。
GPUs have become ubiquitous in the cloud due to the dramatic performance gains they enable in domains such as machine learning and computer vision. However, offloading GPU computation to the cloud requires placing enormous trust in providers and administrators. Recent proposals for GPU trusted execution environments (TEEs) are promising but fail to address very real side-channel concerns. To illustrate the severity of the problem, we demonstrate a novel attack that enables an attacker to correctly classify images from ImageNet [17] by observing only the timing of GPU kernel execution, rather than the images themselves. Telekine enables applications to use GPU acceleration in the cloud securely, based on a novel GPU stream abstraction that ensures execution and interaction through untrusted components are independent of any secret data. Given a GPU with support for a TEE, Telekine employs a novel variant of API remoting to partition application-level software into components to ensure secret-dependent behaviors occur only on trusted components. Telekine can securely train modern image recognition models on MXNet [10] with 10%–22% performance penalty relative to an insecure baseline with a locally attached GPU. It runs graph algorithms using Galois [75] on one and two GPUs with 18%–41% overhead.