全国网络安全标准化技术委员会 2024年9月 人工智能 安全治理框架1. 人工智能安全治理原则 …………………………………… 1 2. 人工智能安全治理框架构成 ……………………………… 2 3. 人工智能安全风险分类 …………………………………… 3 3.1 人工智能内生安全风险 ……………………………… 3 3.2 人工智能应用安全风险 ……………………………… 5 4. 技术应对措施 ……………………………… 15 目 录- 1 - 人工智能安全治理框架 人工智能是人类发展新领域，给世界带来巨大机遇，也带来各类风险挑战。 落实《全球人工智能治理倡议》，遵循“以人为本、智能向善”的发展方向，为 推动政府、国际组织、企业、科研院所、民间机构和社会公众等各方，就人工 智能安全治理达成共识、协调一致，有效防范化解人工智能安全风险，制定本 框架。 1. 人工智能安全治理原则 秉持共同、综合 包容审慎、确保安全。鼓励发展创新，对人工智能研发及应用采取 包容态度。严守安全底线，对危害国家安全、社会公共利益、公众合法权益的 风险及时采取措施。 人工智能安全治理框架 （V1.0）- 2 - 人工智能安全治理框架 1.2 风险导向、敏捷治理。密切跟踪人工智能研发及应用趋势，从人工 智能技术自身、人工智能应用两方面分析梳理安全风险，提出针对性防范应对 措施。关注安全风险发展变化，

云原生go-zero微服务框架设计思考 万俊峰Kevin@好未来 关于我 万俊峰Kevin ● go-zero作者 ● 好未来资深专家 ● 晓黑板研发负责人 ● 十多年研发团队管理经验 ● 近20年开发和架构经验 Agenda ● go-zero之前世今生 ● go-zero是如何设计的 ● go-zero如何高效解决问题 go-zero之前世今生 go-zero的由来 go-zero的由来 ● 单体服务的困局 ● 架构的选型 ● 如何无痛切换 go-zero是什么？ ● Web & RPC微服务框架 ● 微服务代码生成工具goctl ● 通用API定义规范 go-zero的设计原则 ● 保持简单，第一原则 ● 弹性设计，面向故障编程 ● 工具大于约定和文档 ● 尽可能约束做一件事只有一种方式 ● 对业务开发友好，封装复杂度 go-zero是如何设计的 客户端 ● 支持自定义fallback ● http/rpc框架内建 ● 自动触发，自动恢复 自适应熔断 ● K8S的HPA 80%触发 ● CPU>90%开始拒绝低优先级请求 ● CPU>95%开始拒绝高优先级请求 ● 基于滑动窗口，防止毛刺 ● 有冷却时间，防止抖动 ● 实践检验，配合K8S弹性伸缩 ● http/rpc框架内建 自适应降载 ● 超时 ● 级联调用 ● 跟客户端超时配合

environment – 3-tier architecture intro – alternative methods of resource connection: – Bastion host – SSM – EC2 Instance Connect – demo Why we should care? – brute force attacks – exploitation of security of failure solution two - ssm – to be precise AWS System Manager Session Manager – sessions based on secure bi-directional channel – traffic is encrypted with TLS 1.2ssm - props and cons – connection needs to be installed – configuration of Ansible is possible, however annoying(aka use Saltstack) ssm - costssolution three - EC2 Instance Connect – full name: EC2 Instance Connect Endpoint – SSH/RDP

SaveS- tate The VM state is being saved and the service must save relevant information using the SSM API (VBox/ssm.h). pfn- Load- State The VM is being restored from the saved state and the service must load

SaveS- tate The VM state is being saved and the service must save relevant information using the SSM API (VBox/ssm.h). pfn- Load- State The VM is being restored from the saved state and the service must load

provides a tree structure which holds configuration set- tings for the VM and all emulated devices. • SSM (Saved State Manager), saves and loads VM state. • VUSB (Virtual USB), a USB layer which separates fix for handling certain MSRs on ancient CPUs without VT-x support for MSR bitmaps • VMM: fixed VERR_SSM_LOAD_CPUID_MISMATCH errors when restoring a saved state with SMP guests on hosts without the CPUID/HTT VERR_SVM_UNEXPECTED_EXIT while intercepting debug register accesses (AMD-V only; bug #12481) • VMM: fixed a VERR_SSM_STRUCTURE_MAGIC error when trying to load a saved state made with VBox 4.3.4 when VT-x/AMD-V is disabled

provides a tree structure which holds configuration set- tings for the VM and all emulated devices. • SSM (Saved State Manager), saves and loads VM state. • VUSB (Virtual USB), a USB layer which separates fix for handling certain MSRs on ancient CPUs without VT-x support for MSR bitmaps • VMM: fixed VERR_SSM_LOAD_CPUID_MISMATCH errors when restoring a saved state with SMP guests on hosts without the CPUID/HTT VERR_SVM_UNEXPECTED_EXIT while intercepting debug register accesses (AMD-V only; bug #12481) • VMM: fixed a VERR_SSM_STRUCTURE_MAGIC error when trying to load a saved state made with VBox 4.3.4 when VT-x/AMD-V is disabled

provides a tree structure which holds configuration set- tings for the VM and all emulated devices. • SSM (Saved State Manager), saves and loads VM state. • VUSB (Virtual USB), a USB layer which separates VERR_SVM_UNEXPECTED_EXIT while intercepting debug register accesses (AMD-V only; bug #12481) • VMM: fixed a VERR_SSM_STRUCTURE_MAGIC error when trying to load a saved state made with VBox 4.3.4 when VT-x/AMD-V is disabled when a machine had immutable or writethrough storage attached (bug #5727) • Saved state: fixed VERR_SSM_LOADED_TOO_MUCH error when loading DisplayScreen- shot(bug #6162) • VBoxManage: add restorecurrent

SaveS- tate The VM state is being saved and the service must save relevant information using the SSM API (VBox/ssm.h). pfn- Load- State The VM is being restored from the saved state and the service must load

SaveS- tate The VM state is being saved and the service must save relevant information using the SSM API (VBox/ssm.h). pfn- Load- State The VM is being restored from the saved state and the service must load