针对卷积神经网络加速器的旁道信息泄露及其防御技术研究

In recent years, convolutional neural networks (CNNs) have achieved great success in image recognition, object detection, natural language processing, etc., and have been widely used in these areas. As the use of CNNs is becoming increasingly wider and deeper, however, they are also processing more and more users' private information, and thus, the information security problem is becoming more serious. If users' private information leaks during the processing of CNNs, users' privacy will face a serious threat. However, the data security problem has been rarely considered in existing algorithm and hardware accelerator designs of CNNs. This project will study the side-channel information leak and data protection problems of CNN accelerators. We will study the following three topics: (1) we will theoretically model side-channel information leak of CNNs, based on the statistical learning theory; (2) combining with the theoretical model, we will build a side-channel information leak model for CNN accelerators, based on the Bayesian theory; and (3) we will investigate some design and optimization techniques, to defend CNN accelerators against side-channel information leak, by using software-hardware co-optimization. A key feature of this project is that, we are the first team studying the information leak and data protect problems of CNN accelerators, from the side channel point of view. Through this project, we will build a side-channel information leak model for CNN accelerators, analyze the side-channel vulnerability of CNN accelerators, and also propose some design and optimization techniques for CNN accelerators, to defend against side-channel information leak.

近年来，卷积神经网络在图像识别、目标检测等领域被广泛应用。然而，随着卷积网络的应用越来越广泛，它所触及和处理的用户私密信息也越来越多。如果私密信息在卷积网络的计算过程中被泄露，用户的隐私就面临着严重威胁。然而，现有卷积网络的算法和硬件加速器设计都很少考虑到自身的数据安全性问题。本项目拟针对卷积网络加速器的旁道信息泄露及其防御技术进行研究。具体研究内容包括：（1）利用统计学习相关理论，建立卷积网络的旁道信息泄露的理想模型；（2）利用贝叶斯理论，结合理想模型，建立卷积网络加速器的旁道信息泄露模型；（3）基于软硬件协同优化，初步探索能够防御旁道信息泄露的卷积网络加速器优化设计方法。本项目的一个重要特色，是首次从旁道的角度研究卷积网络加速器的信息泄露问题和防御技术。通过本项目研究，形成卷积网络加速器的旁道泄露模型，分析卷积网络加速器的旁道脆弱性，并提出抗旁道泄露的卷积网络加速器优化设计方法。

近些年来，为了加速卷积神经网络的计算，人们提出了各种各样的卷积网络加速器。当卷积网络模型在加速器上运行时，权重一般是以明文形式存储在外部存储器中。明文存储的权重容易遭到旁道攻击而被窃取，给模型的生成者和使用者带来安全威胁和经济损失。然而，现有卷积网络的算法和硬件加速器设计都很少考虑到自身的数据安全性问题。针对该问题，本项目开展了卷积网络加速器在旁道攻击下的关于权重泄露的安全性分析和保护方法研究，主要包括：1）在一种混沌加密算法——Arnold Cat Map（ACM）算法下，分析了卷积网络的权重泄露的威胁程度，即卷积网络模型在不同的加密强度下的抗权重泄露的安全性；2）提出了基于ACM混沌加密的卷积网络加速器权重保护框架，设计了最优的密钥生成算法；3）提出了基于阻变存储器件的权重保护加速器架构，不仅利用ACM混沌加密保护权重，同时也利用基于存算一体的原位存储和计算原理进一步提升了权重对旁道攻击的安全性。仿真实验结果表明，本项目提出的卷积网络权重保护方案和加速器架构，能够有效地保护权重在旁道攻击下的安全性，并且代价较低。