Method for accelerating secure metadata access in secure memory system, memory controller and system

Abstract

The invention discloses a method for accelerating secure metadata access in a secure memory system, a memory controller and a system, and belongs to the field of secure memory systems, and the method comprises the following steps: when a page table item corresponding to a logic page where data accessed by a processor is located does not hit a TLB, obtaining the page table item from a memory page table, extracting a physical page address from the page table item, and storing the physical page address in a memory; a counter corresponding to a physical page where the data to be accessed is located and a father node of the counter in the integrity tree are prefetched through the physical page address; adding a replacement dirty block address in a miss request sent by the last level of cache, after receiving the miss request containing a field of the replacement dirty block address, executing conventional memory reading and decryption, positioning a counter corresponding to the replacement dirty block address, and performing prefetching by using an idle memory bandwidth; in addition to the secure metadata cache, the prefetching queue is maintained to temporarily store the prefetched metadata. The cache hit rate of the security metadata in the security memory system can be improved, and the performance overhead caused by the cache miss can be reduced.

Description

TECHNICAL FIELD

[0001] The present application belongs to the field of secure memory systems, and more particularly, to a method for accelerating secure metadata access in secure memory systems, a memory controller and a system. BACKGROUND

[0002] With the continuous growth of the amount of data stored in computer systems, and the increasing motivation and attack ability of malicious attackers, computer security issues are becoming increasingly important. As a core component in modern computer systems, memory stores sensitive information such as user login passwords, personal privacy information, and business secrets. In order to deal with illegal reading and destruction of data by attackers, a secure memory system needs to be built to ensure the confidentiality and integrity of memory data. Confidentiality requires that data be encrypted before entering the bus, and then stored and transmitted in the form of ciphertext in the non-secure area, so that even if the ciphertext is intercepted by the attacker, no effective information can be obtained; integrity requires that when data is tampered with or destroyed, the system can detect abnormalities and handle them in a timely manner. In order to achieve the above goals, the secure memory system uses encryption mechanisms and integrity verification mechanisms. However, these mechanisms need to maintain a large number of security metadata, such as counters and integrity trees, and frequently access security metadata during data reading and writing.

[0003] In order to reduce the access overhead of security metadata, a security metadata cache is introduced in the memory controller. When reading and writing memory data, if the corresponding security metadata hits the data cache, the encryption and decryption of the data and the integrity verification process will be accelerated. However, for memory-intensive and irregular application loads, the cache miss rate of security metadata is high, resulting in frequent access to security metadata in memory, thereby causing high bandwidth and delay overhead, significantly reducing system performance. Therefore, improving the hit rate of security metadata cache and reducing the processing overhead when missing can improve system performance and achieve low-cost off-chip memory protection.

[0004] In order to improve the access performance of security metadata cache, existing methods propose a prefetching technology based on access model. The effectiveness of prefetching is derived from the regularity and predictability of access patterns, which are usually divided into three categories: stride, spatial correlation and temporal correlation.

[0005] Stride access pattern refers to an access sequence with linear characteristics. The stride prefetching technology based on stride access pattern detects the fixed stride characteristics in the access sequence, and generates a prefetch request combined with the last access address. Existing methods use the difference between multiple access addresses issued by the same instruction to perform prefetching, in order to improve the prefetching accuracy and timeliness of the cache. Although the stride prefetching technology can bring performance improvement at a lower storage overhead, it is difficult to learn a stable stride when facing more complex access behaviors.

[0006] Spatial correlation refers to different regions of a memory address space having similar access patterns. A spatial prefetcher divides the memory address space into several fixed-size spatial regions and learns the access patterns within the regions to predict subsequent access addresses. Existing methods record the difference between consecutive memory access addresses falling into the same spatial region and predict the difference pattern through a multi-level prediction table. Spatial prefetching techniques based on difference rely on an ordered difference queue, but the globally out-of-order memory access stream received by the memory controller can reduce the effectiveness of such prefetching techniques.

[0007] Temporal prefetchers predict the subsequent possible memory access addresses by utilizing the historical information of the address access sequence. Existing methods use the last and last two miss addresses to match the historical access stream to improve the prefetch hit rate, but require recording the complete address sequence, which can reach the MB level. Since the recording table also needs integrity protection to resist attacks, it further increases the overhead of accessing and updating the recording table.

[0008] In addition, existing technologies do not consider the miss of complex security metadata cache. First, the reasons for the miss of security metadata are diverse, and there is a lack of good locality between the miss metadata of different reasons; second, before the miss metadata is put into the cache, its parent node needs to be used for integrity verification, so it may cause the cache miss of the parent node; finally, in the replacement process of the metadata cache, if the metadata to be replaced is modified, the parent node needs to be updated, and if the parent node is missed, loading the parent node from the memory to the cache may further cause continuous eviction and miss. In addition, the coverage of security metadata is several physical pages (4KB), and since adjacent virtual pages may have a large interval after being mapped to physical pages, the memory access regularity of the program in the virtual address space will be interrupted on the physical pages, making it challenging to directly predict the memory access pattern of security metadata. SUMMARY

[0009] In view of the defects and improvement needs of the prior art, the present application provides a method for accelerating security metadata access in a secure memory system, a memory controller and a system, which aims to improve the cache hit rate of security metadata in a secure memory system and reduce the performance overhead caused by cache miss.

[0010] To achieve the above-mentioned purpose, according to one aspect of the present application, a method for accelerating security metadata access in a secure memory system is provided, and the read operation includes: S1: When the page table entry corresponding to the logical page containing the data accessed by the processor misses the TLB, the page table entry is obtained from the memory page table, and the physical page address is extracted from the page table entry. The physical page address is used to prefetch the counter corresponding to the physical page containing the data to be accessed and its parent node in the integrity tree. It is then determined whether the data to be accessed is cached in the data LLC. If so, the data is read from the data LLC, and the read operation ends; otherwise, proceed to S2. S2: Read the data to be accessed from memory; S3: Decrypt the read physical page using the prefetch counter and cache it in the data LLC; the read operation ends. The page table entries are used to record the mapping relationship between logical page addresses and physical page addresses.

[0011] Furthermore, the method for accelerating access to secure metadata in a secure memory system provided by the present invention further includes: Each in memory M Each consecutive physical page is divided into a region, and a page access history table is maintained in the security zone; M The default value is a positive integer; in the page access history table, each entry includes the region number, bitmap, and valid bits; the bitmap includes... M The units digit is used to identify the area. M Whether the data in a physical page is cached by the memory controller; the valid bit is used to indicate whether the entry is valid; Furthermore, it determines whether the data in the physical page is cached by the data LLC, including: Calculate the region number of the physical page based on its physical page address; If the page access history table is queried based on the region number of the physical page, and no corresponding entry is found, it is determined that the data in that physical page is not cached by the data LLC. If a corresponding entry is found, and the corresponding bit in the bitmap indicates that the data in that physical page is not cached, it is determined that the data in that physical page is not cached by the data LLC. If a corresponding entry is found, and the corresponding bit in the bitmap indicates that the data in that physical page is cached, it is determined that the data in that physical page is cached by the data LLC. Furthermore, in S3, after caching the data to the data LLC, it also includes: If there is no entry corresponding to the cached physical page in the page access history table, the corresponding entry will be created; the region number of the created entry is the region number of the cached physical page, and the valid bit indicates that the entry is valid; Configure the bitmap in the page access history table entry corresponding to the cached physical page to indicate that the data in that physical page has been cached by the data LLC.

[0012] Further, the reading of the physical page from the memory is triggered by a miss request, and if the data LLC is full, the miss request is further attached with the physical page address of the dirty data block replaced from the data LLC; Further, the reading of the physical page from the memory comprises: The miss request is parsed to obtain the physical page address to be read and the physical page address of the replaced dirty data block; The corresponding physical page is read from the memory, and if the parsed physical page address of the replaced dirty data block is valid, the corresponding counter C e is located. The free memory bandwidth is used to prefetch the counter C e and the parent node thereof in the integrity tree.

[0013] Further, the method for accelerating the access of the security metadata in the secure memory system provided by the application further comprises: When the memory system is idle or the amount of data replaced from the data LLC to the write buffer exceeds a preset threshold, the dirty data in the write buffer is encrypted and modified in the integrity tree by using the corresponding counter, and then the data is written back to the memory in batches, and the write buffer is emptied.

[0014] Further, after the dirty data in the write buffer is encrypted and written back to the memory, the method further comprises: For each data block in the write buffer, the corresponding entry of the corresponding physical page in the page access history table is queried, and the bit of the corresponding physical page in the bitmap is set to identify that the data in the physical page is not cached by the data LLC; If the data in each physical page in the bitmap identification area in the page access history table entry is not cached, the valid bit of the entry is set to identify that the entry is invalid and the space occupied by the entry is released.

[0015] Further, the method for accelerating the access of the security metadata in the secure memory system provided by the application further comprises: maintaining a security metadata cache and a prefetch queue in the security area; Further, the prefetch counter and the parent node thereof in the integrity tree node comprise: prefetching the counter and the parent node thereof in the integrity tree to the prefetch queue; Further, the method for accessing the counter or the parent node of the counter in the integrity tree comprises: P1: query the security metadata cache to obtain the counter or the parent node to be accessed, if hit, directly return the data read from the security metadata cache, and the access is ended; otherwise, turn to P2; P2: query the prefetch queue to obtain the counter or the parent node to be accessed, if hit, return the data read from the prefetch queue, load it into the secure metadata cache, and invalidate it in the prefetch queue, and the access ends; otherwise, go to P3; P3: read the counter or the parent node to be accessed from the memory, and put it into the prefetch queue, and the access ends.

[0016] Further, the prefetch queue includes a counter prefetch queue and an integrity tree prefetch queue; the counter prefetch queue is used to place the counter, and the integrity tree prefetch queue is used to place the parent node of the counter in the integrity tree.

[0017] Further, the method for accelerating secure metadata access in the secure memory system provided by the application further comprises: When metadata eviction occurs in the secure metadata cache, and the evicted metadata is dirty metadata, it is judged whether the parent node of the evicted dirty metadata in the integrity tree has been cached in the secure metadata cache or the integrity tree prefetch queue, if yes, the in-place update is directly performed on the parent node of the evicted dirty metadata in the secure metadata cache or the integrity tree prefetch queue; otherwise, the parent node of the evicted dirty metadata is read from the memory and loaded into the integrity tree prefetch queue, and then the in-place update is performed on the parent node of the evicted dirty metadata in the integrity tree prefetch queue; When metadata eviction occurs in the integrity tree prefetch queue, and the evicted metadata is dirty metadata, it is judged whether the parent node of the evicted dirty metadata in the integrity tree has been cached in the secure metadata cache or the integrity tree prefetch queue, if yes, the in-place update is directly performed on the parent node of the evicted dirty metadata in the secure metadata cache or the integrity tree prefetch queue; otherwise, the parent node of the evicted dirty metadata is read from the memory and updated, and then written back to the memory.

[0018] According to still another aspect of the application, a memory controller in a secure memory system is provided, comprising: a cache, a computer readable storage medium, and a processor; The computer readable storage medium is used to store a computer program; The processor is used to read the computer program stored in the computer readable storage medium, and realize the above-mentioned method for accelerating secure metadata access in the secure memory system provided by the application.

[0019] According to still another aspect of the application, a secure memory system is provided, comprising: a data LLC, a memory controller, and a memory; The memory controller is the memory controller in the above-mentioned secure memory system provided by the application.

[0020] Overall, the above technical solutions conceived by the present application can achieve the following beneficial effects: (1) When the page table entry is not hit and the missed page table entry is read from the memory, the present application judges whether the corresponding physical page is cached or not, and prefetches the corresponding counter and the corresponding integrity tree parent node when judging that the physical page is not cached, so that when the physical page is read from the memory to the data LLC subsequently, the counter that has been cached can be directly read to complete data decryption, without reading the counter from the memory. The prefetch operation fully utilizes the strong correlation between the missed page table entry and the missed counter, utilizes the time interval between the occurrence of the page table entry miss and the occurrence of the counter miss, realizes the prefetch of the missed counter, effectively reduces the performance overhead caused by the counter miss, and improves the cache hit rate of the security metadata in subsequent access.

[0021] (2) The present application maintains a page access history table in the security area, which is used to record the physical pages that have been recently accessed. Based on the page access history table, it can quickly and accurately judge whether the data in the physical page is cached or not, so as to avoid invalid prefetch caused by the fact that the page table entry and the counter are evicted while the related data is still in the cache in the memory-intensive and irregular load, and improve the efficiency of prefetching the corresponding counter based on the page table entry information.

[0022] (3) The present application fully utilizes the delayed write-back feature of the write buffer in the last level cache (LLC), that is, the data evicted from the LLC is first written back to the write buffer, and the write buffer is only written back in batches when the system is idle or the number of write requests reaches a threshold, so there is a certain time interval between the dirty data being evicted from the LLC and being actually written back to the main memory. Based on the delayed write-back feature, the present application adds a replaced dirty block address field to the miss request sent by the last level cache to the memory controller, which carries the physical address information of the dirty block replaced by the last level cache due to the request, and is used to indicate the counter to be prefetched. After receiving the miss request, the memory controller will locate the counter corresponding to the physical page address of the replaced dirty block while performing the regular memory reading and decryption, and prefetch the counter and the related integrity tree parent node using the idle memory bandwidth, so that when the dirty data in the write buffer is written back, the already prefetched counter can be directly used to complete the encryption, without reading from the memory, effectively hiding the access delay of the security metadata during the actual write-back.

[0023] (4) The application maintains a prefetch queue outside the secure metadata cache, the prefetched secure metadata will be firstly prefetched into the prefetch queue, and only when the prefetched secure metadata is hit by subsequent access, the secure metadata is placed from the prefetch queue to the secure metadata cache, thereby the pollution caused by the inaccurate prefetch of the prefetched secure metadata directly entering the secure metadata cache can be avoided, and further the frequent cache replacement and additional miss can be caused. In the further preferred scheme, the classified prefetch queue is used to store the prefetched secure metadata, specifically, the prefetch counter is placed into the counter prefetch queue, and the integrity tree node used for verifying the integrity of the counter is placed into the integrity tree prefetch queue, so that the access of the prefetched secure metadata can directly access the corresponding prefetch queue, thereby the access efficiency of the secure metadata can be further improved.

[0024] (5) The application replaces the dirty metadata from the integrity tree prefetch queue, and when the parent node of the dirty metadata in the integrity tree is not cached by the secure metadata cache or the integrity tree prefetch queue, the cache bypass strategy is enabled, that is, the secure metadata cache and the prefetch queue are skipped, the parent node of the evicted dirty metadata is read from the memory and updated, and then it is written back to the memory directly, thereby the continuous eviction and miss problem caused by the secure metadata cache is alleviated, and the cache hit number is improved. BRIEF DESCRIPTION OF DRAWINGS

[0025] Figure 1 The overall design schematic diagram of the method for accelerating secure metadata access in a secure memory system is provided for the embodiments of the application.

[0026] Fig. 2 is a format schematic diagram of a page access history table entry provided by the embodiments of the application.

[0027] Fig. 3 is a query and update behavior schematic diagram of a page access history table provided by the embodiments of the application.

[0028] Fig. 4 is a metadata prefetch schematic diagram using a miss page table entry provided by the embodiments of the application.

[0029] Fig. 5 is a metadata prefetch schematic diagram using an asynchronous write buffer provided by the embodiments of the application.

[0030] Fig. 6 is a flowchart of secure metadata access provided by the embodiments of the application.

[0031] Fig. 7 is a placement schematic diagram of prefetched metadata under the classified prefetch queue provided by the embodiments of the application.

[0032] Fig. 8 is a processing flowchart of secure metadata cache evicting dirty metadata provided by the embodiments of the application. DETAILED DESCRIPTION

[0033] In order to make the purposes, technical solutions and advantages of the present application clearer and more apparent, the present application will be further described in detail below in conjunction with the accompanying drawings and examples. It should be understood that the specific examples described herein are merely intended to explain the present application and should not be used to limit the present application. In addition, the technical features involved in each embodiment of the present application described below can be combined with each other as long as they do not conflict with each other.

[0034] In the present application, the terms "first", "second", etc. (if any) in the present application and the accompanying drawings are used to distinguish similar objects, and do not necessarily describe a specific order or sequence.

[0035] In order to improve the cache hit rate of security metadata and reduce the performance overhead caused by cache miss, the present application provides a method, a memory controller and a system for accelerating security metadata access in a secure memory system, the overall concept of which is to fully exploit the correlation between data accesses and accurately predict the security metadata that will be accessed and not cached, and to pre-fetch related security metadata using the time interval between data accesses, so that subsequent access to related security metadata can hit the cache, thereby improving the cache hit rate of security metadata and reducing the processing overhead when security metadata misses the cache.

[0036] Based on the above technical concept, the present application first considers that there is a strong correlation between the miss page table entry and the miss counter, and uses the time interval between the miss of the page table entry and the miss of the counter to pre-fetch metadata to meet future access requests, thereby realizing metadata prefetching using the miss page table entry. On this basis, the present application further considers that the write buffer is only written back in bulk when the system is idle or the number of write requests reaches a threshold, so there is a certain time interval between the dirty data being evicted from the last level cache to the actual write back to the main memory. Therefore, the time interval is used to pre-fetch the counter required for memory write operation, thereby hiding the access delay of security metadata during subsequent actual write back.

[0037] Before explaining the technical solutions of the present application in detail, the related terms involved in the present application are explained as follows: Security area: also known as Trusted Compute Base (TCB), which contains all components on the processor chip, such as processor core, processor cache and memory controller. TCB is usually physically represented as a single, complete chip. The threat model assumes that the data located in TCB is absolutely secure and attackers cannot steal or tamper with the data.

[0038] Counter: is a component in the widely used Counter Mode Encryption (CME) encryption mode, each data block is assigned a counter, and the counter is incremented by one before each data is written back to memory, thereby ensuring time uniqueness.

[0039] Integrity tree: a tree-shaped cryptographic data structure used to efficiently and securely verify the integrity of large-scale data, with leaf nodes storing counters and internal nodes and root nodes storing hash values calculated from child nodes.

[0040] Security metadata: a "security tag" attached to data, used to define and protect data integrity, confidentiality, and access permissions, and is a key technology for implementing fine-grained security control, including counters, integrity tree nodes, etc.

[0041] TLB: address translation cache, used to cache virtual address to physical address mappings, greatly reducing address translation overhead.

[0042] LLC: last level cache, the last level of CPU cache hierarchy, is a component used to reduce the average time required for the processor to access memory.

[0043] Write buffer: used to temporarily store data evicted from the last level cache, and when the system is idle or the number of saved write requests reaches a threshold, write back to memory operations are performed to avoid congestion.

[0044] Page table entry: the smallest unit in the page table, storing the mapping relationship between virtual pages and physical pages, as well as the permissions and control attributes of the page.

[0045] MMU: memory management unit, a special hardware in the CPU responsible for converting virtual addresses to physical addresses and implementing memory access permission checks.

[0046] The following is an example.

[0047] Example 1: A method for accelerating security metadata access in a secure memory system, as shown in Figure 1 The embodiment first implements security metadata prefetching using a missed page table entry.

[0048] To improve the efficiency of prefetching corresponding counters based on page table entry information, and to avoid invalid prefetching caused by the eviction of page table entries and counters while related data is still in the cache under memory-intensive and irregular loads, the embodiment designs a page access history table (PAT) to track the access of physical pages.

[0049] In adaptation to the page access history table, the embodiment divides the 64 consecutive physical page numbers into a region, and records the access status of each physical page in the region by using a 64-bit bitmap. Each bit in the bitmap corresponds to a physical page. If the bit is "1", it indicates that the corresponding physical page has been accessed. If the bit is "0", it indicates that the corresponding physical page has not been accessed. Since in the secure memory, the accessed pages will be loaded into the data LLC, the corresponding bit in the bitmap is "1", which simultaneously indicates that the corresponding physical page has been cached by the data LLC. Conversely, if the corresponding bit in the bitmap is "0", it simultaneously indicates that the corresponding physical page has not been cached by the data LLC.

[0050] Optionally, the physical address used in the embodiment is 48 bits, the default page size is 4 KB, and the physical page number is 36 bits. Since the region contains 64 physical pages, the region index occupies 30 bits, and the bitmap width is 64 bits. Optionally, the page access history table adopts the least recently used replacement policy. When the memory controller receives the eviction address from the last level cache, if the physical page of the eviction address exists in the page access history table, the bit corresponding to the physical page is set to "0". If all 64 bits in the bitmap of a page access history table entry are "0", it indicates that all pages in the region are marked as "unaccessed", and the entry is evicted according to the least recently used replacement policy. The valid position is "0" to identify that the entire region is not cached by the data LLC, so the entire entry is invalid. The space occupied by the invalid entry is released to save storage space.

[0051] In the embodiment, the entry format of the page access history table is as shown in Figure 2 It should be noted that the size of the region can be flexibly set according to actual needs. Herein, only an optional implementation is provided, and should not be understood as the only limitation of the present application.

[0052] Figure 3 The query and update process of the page access history table is as shown in

[0053] The embodiment maintains the secure metadata cache and the prefetch queue in the secure region, and the counters and their parent nodes in the integrity data are put into the corresponding prefetch queue.

[0054] Figure 4 shows the specific execution process of the security metadata prefetching using the missed page table entry after the memory management unit loads the page table entry when the page table entry is missed. The information of the missed page table entry is captured, the physical page number is extracted, and the page access history table is queried and updated using the physical page number; if there is no access record of the physical page in the page access history table, it means that the page has never been accessed or has not been accessed for a long time, so the counter corresponding to the physical page is prefetched; if there is an access record of the physical page in the page access history table, no prefetching is performed. After the missed page table entry is put into the address translation cache (TLB), the processor accesses the processor cache using the translated physical address, at which time the corresponding counter has been stored in the prefetch queue in advance through the previous steps. All eviction information from the last level cache is sent to the memory controller to update the page access history table.

[0055] When the last level cache is evicted, if it is a clean eviction, i.e., the data in the physical page is not modified after being cached, the address of the evicted data is sent to the memory controller; if the evicted data is dirty, i.e., the data in the physical page is modified in the cache after being cached, an additional write data request is sent to the memory controller. When the last level cache is evicted, whether the evicted data is dirty or not, the physical page number of the evicted data is extracted, and the corresponding entry in the page access history table is searched. If it exists, the physical page is marked as "not accessed", indicating that the page no longer exists in the cache.

[0056] The embodiment further implements security metadata prefetching using an asynchronous write buffer. The write buffer only writes back in batches when the system is idle or the number of write requests reaches a threshold, so there is a certain time interval between the dirty data being evicted from the last level cache and actually being written back to the main memory. The embodiment uses this time interval to prefetch the counter required for memory write operations, thereby hiding the access delay of the security metadata during the actual write back. Therefore, the embodiment adds a replacement dirty block address field to the missed request sent by the last level cache to the memory controller, which carries the physical address information of the last level cache replacement dirty block caused by the request, and is used to indicate the counter to be prefetched.

[0057] Figure 5 The specific execution process of the security metadata prefetching using the asynchronous write buffer provided by the embodiment is shown: After receiving the missed request containing the replacement dirty block address field, the regular memory reading and decryption are performed, and at the same time, the counter corresponding to the replacement dirty block address is located and prefetched using the idle memory bandwidth; when the system schedules the dirty block write back of the write buffer, the counter corresponding to the dirty data has been prefetched and can be used directly.

[0058] Although writeback itself is not on the system performance critical path, the corresponding counter miss can block the writeback pipeline and contend for the critical bandwidth. The secure metadata prefetching method based on data access association effectively reduces the risk of such congestion by prefetching counters.

[0059] To avoid the pollution caused by inaccurate prefetching directly into the secure metadata cache, and thus frequent cache replacement and additional misses, the embodiment uses a prefetch queue outside the secure metadata cache to temporarily save the prefetched metadata.

[0060] After receiving a secure metadata access request, the CPU will first check the secure metadata cache. If the metadata cache hits, it will directly return the metadata in the cache. If it misses, it will further check whether the secure metadata cache is in the prefetch queue. If it hits the prefetch queue, it means that the corresponding prefetch is a valid prefetch, then the metadata will be loaded from the prefetch queue to the metadata cache, and the metadata in the prefetch queue will be marked as invalid. The system decides whether to perform prefetching according to the last level cache eviction information and the miss page table item information.

[0061] To further improve the access efficiency of secure metadata in the prefetch queue, the embodiment further proposes a classified prefetch queue. Specifically, two types of prefetch queues are maintained, namely the counter queue and the integrity tree prefetch queue, which are used to store prefetched counters and integrity tree nodes respectively. Thus, when prefetching secure metadata, the prefetched counter will be placed in the counter prefetch queue, and the prefetched integrity tree node will be placed in the integrity tree prefetch queue. When querying the prefetch queue, the corresponding prefetch queue will be accessed according to the type of metadata. If the requested metadata type is a counter, the counter prefetch queue will be queried, otherwise the integrity tree prefetch queue will be queried.

[0062] In the embodiment, the steps of secure metadata access are specifically as shown in Figure 6 .

[0063] Figure 7 shows an example of prefetched metadata under the classified prefetch queue. When the prefetch logic triggers the prefetch of the counter node ctr1, in order to verify ctr1, its ancestor nodes node1 and node2 that miss are also prefetched. ctr1 is stored in the counter prefetch queue, while its ancestor nodes node1 and node2 are stored in the integrity tree prefetch queue. Alternatively, in the embodiment, the prefetch queue uses a full associative structure, uses a least recently used replacement strategy, and its entry contains a tag based on the secure metadata address, a valid bit and a dirty bit.

[0064] To alleviate the problem of continuous eviction and miss caused by secure metadata cache eviction, the embodiment uses the integrity tree prefetch queue as a buffer for the parent nodes of the evicted dirty data to block continuous eviction, thereby improving the cache hit rate.

[0065] Figure 8 shows the execution steps of metadata cache evicting dirty metadata. If the parent node is in the secure metadata cache or the integrity tree prefetch queue, the system updates the parent node in place without accessing memory. Otherwise, the parent node is read from memory, loaded into the integrity tree prefetch queue and updated. When the integrity tree prefetch queue needs to evict a dirty metadata due to capacity limit, its parent node also needs to be updated. If the required parent node exists in the metadata cache or the integrity tree prefetch queue, the system updates the parent node in the metadata cache or the integrity tree prefetch queue directly. If the parent node does not exist in either the secure metadata cache or the integrity tree prefetch queue, the cache bypass strategy is enabled, which skips the metadata cache and the prefetch queue and directly reads the parent node from memory. After the update, the parent node is written back to memory, thus avoiding further evictions.

[0066] Overall, the embodiment implements secure metadata prefetching using the missed page table entry and secure metadata prefetching using the asynchronous write buffer, fully utilizes the correlation of data access, effectively improves the secure metadata cache hit rate, and reduces the performance overhead caused by cache misses.

[0067] The method for accelerating secure metadata access in a secure memory system provided by the embodiment is implemented in a memory controller, which uses missed page table entry information and last level cache eviction information to prefetch secure metadata, and reduces continuous evictions and misses by classifying the prefetch queue to cache the missed parent nodes of the evicted dirty nodes, and all prefetching logic, prefetch queues and page access history tables are located in the secure area, thus ensuring security.

[0068] In terms of data confidentiality, the embodiment adopts the traditional one-time password book and counter increment and re-encryption strategy to ensure the confidentiality of the encryption key and the spatiotemporal uniqueness of the one-time password book; in terms of data integrity, the Synergy scheme and ECC chip are used to store MAC to verify the integrity of the prefetched counter and integrity tree nodes, thus ensuring the integrity of the data; at the same time, since the prefetching logic is located in the secure area and the page table data is protected, attackers cannot directly attack the prefetcher or induce false prefetching by tampering with the page table entry. In theory, the method for accelerating secure metadata access in a secure memory system provided by the embodiment is the same as the traditional secure metadata access method in terms of security.

[0069] Embodiment 2: A memory controller in a secure memory system, comprising: a cache, a computer readable storage medium, and a processor; The computer readable storage medium is used to store a computer program; The processor is configured to read a computer program stored in the computer readable storage medium, and implement the method for accessing the security metadata in the accelerated security memory system provided in the above embodiment 1.

[0070] Embodiment 3 A security memory system, comprising: a data LLC, a memory controller, and a memory. The memory controller is the memory controller in the security memory system provided in the above embodiment 2.

[0071] Those skilled in the art can easily understand that the above description is only the preferred embodiment of the present application, and is not intended to limit the present application. Any modification, equivalent replacement and improvement made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A method for accelerating secure metadata access in a secure memory system, the method comprising: The read operation comprises: S1: When a page table entry corresponding to a logical page where data accessed by a processor misses a TLB, the page table entry is obtained from a memory page table, a physical page address is extracted from the page table entry, a counter corresponding to a physical page where the data to be accessed and a parent node of the counter in an integrity tree are prefetched using the physical page address, and it is determined whether the data to be accessed is cached by a data LLC. If yes, the data is read from the data LLC, and the read operation ends. Otherwise, S2 is entered; S2: The data to be accessed is read from the memory; S3: The read data is decrypted using the prefetched counter and cached to the data LLC, and the read operation ends; The page table entry is used to record a mapping relationship between a logical page address and a physical page address.

2. The method for accelerating secure metadata access in a secure memory system of claim 1, wherein, Further comprising: Each in the memory M Each consecutive physical page is divided into a region, and a page access history table is maintained in the security zone; M is a preset positive integer; each entry in the page access history table includes a number of a region, a bitmap, and a valid bit; the bitmap includes M bits, respectively, for identifying whether data in M physical pages in the region is cached by the data LLC. The valid bit is used to identify whether an entry is valid; And determining whether data in the physical page is cached by the data LLC comprises: Calculating a region number where the physical page is located according to the physical page address; Querying the page access history table according to the region number where the physical page is located. If a corresponding entry is not queried, it is determined that the data in the physical page is not cached by the data LLC. If the corresponding entry is queried and a bit corresponding to the physical page in a bitmap identifies that the data in the physical page is not cached, it is determined that the data in the physical page is not cached by the data LLC. If the corresponding entry is queried and the bit corresponding to the physical page in the bitmap identifies that the data in the physical page is cached, it is determined that the data in the physical page is cached by the data LLC; And after the data is cached to the data LLC in S3, further comprising: If there is no entry corresponding to the cached physical page in the page access history table, a corresponding entry is created. The region number of the created entry is the region number where the cached physical page is located, and the valid bit identifies that the entry is valid; The bitmap in the page access history table entry corresponding to the cached physical page is set to identify that the data in the physical page has been cached by the data LLC.

3. The method for accelerating secure metadata access in a secure memory system of claim 2, wherein, The reading of the physical page from the memory is triggered by a miss request. If the data LLC is full, the miss request further has a physical page address corresponding to a dirty data block replaced from the data LLC; And the reading of the physical page from the memory comprises: The miss request is parsed to obtain the physical page address to be read and the physical page address corresponding to the replaced dirty data block; reading the corresponding physical page from the memory, if the physical page address corresponding to the replaced dirty data block obtained by the parsing is valid, locating the corresponding counter C e ; Utilizing free memory bandwidth prefetch counter C e and its parent node in the integrity tree.

4. The method for accelerating secure metadata access in a secure memory system of claim 3, wherein, Further comprising: When the memory system is idle or the amount of data replaced from the data LLC to the write buffer exceeds a preset threshold, the dirty data in the write buffer is encrypted and modified in the integrity tree using a corresponding counter, the dirty data is written back to the memory in batches, and the write buffer is emptied.

5. The method for accelerating secure metadata access in a secure memory system of claim 4, wherein, After the dirty data in the write buffer is encrypted and written back to the memory, further comprising: For each data block in the write buffer, a corresponding entry of a corresponding physical page in the page access history table is queried, and a bit of the physical page in the bitmap is set to identify that the data in the physical page is not cached by the data LLC; If data in each physical page in the bitmap identified region in the page access history table entry is not cached, the valid bit of the entry is set to identify that the entry is invalid and the space occupied by the entry is released.

6. The method for accelerating secure metadata access in a secure memory system according to any one of claims 1-5, wherein, Further comprising: maintaining a secure metadata cache and a prefetch queue in the secure region; and the prefetch counter and its parent node in the integrity tree node comprising: prefetching the counter and its parent node in the integrity tree into the prefetch queue; and the method of accessing the counter or the parent node of the counter in the integrity tree comprising: P1: querying the secure metadata cache for the counter or the parent node to be accessed, if a hit is made, directly returning the data read from the secure metadata cache, and ending the access; otherwise, going to P2; P2: querying the prefetch queue for the counter or the parent node to be accessed, if a hit is made, returning the data read from the prefetch queue, loading it into the secure metadata cache, and invalidating it in the prefetch queue, and ending the access; otherwise, going to P3; P3: reading the counter or the parent node to be accessed from the memory and putting it into the prefetch queue, and ending the access.

7. The method for accelerating secure metadata access in a secure memory system of claim 6, wherein, The prefetch queue comprises a counter prefetch queue and an integrity tree prefetch queue; the counter prefetch queue is used to place the counter, and the integrity tree prefetch queue is used to place the parent node of the counter in the integrity tree.

8. The method for accelerating secure metadata access in a secure memory system of claim 7, wherein, Further comprising: when metadata eviction occurs in the secure metadata cache and the evicted metadata is dirty metadata, judging whether the parent node of the evicted dirty metadata in the integrity tree has been cached by the secure metadata cache or the integrity tree prefetch queue, if yes, directly updating the parent node of the evicted dirty metadata in place in the secure metadata cache or the integrity tree prefetch queue; otherwise, reading the parent node of the evicted dirty metadata from the memory and loading it into the integrity tree prefetch queue, and then updating the parent node of the evicted dirty metadata in place in the integrity tree prefetch queue; when metadata eviction occurs in the secure metadata cache and the evicted metadata is dirty metadata, judging whether the parent node of the evicted dirty metadata in the integrity tree has been cached by the secure metadata cache or the integrity tree prefetch queue, if yes, directly updating the parent node of the evicted dirty metadata in place in the secure metadata cache or the integrity tree prefetch queue; otherwise, reading the parent node of the evicted dirty metadata from the memory and updating it, and then writing it back to the memory.

9. A memory controller in a secure memory system, the memory controller comprising: comprising: a cache, a computer readable storage medium, and a processor; the computer readable storage medium is used to store a computer program; the processor is used to read the computer program stored in the computer readable storage medium, and implement the method of accessing secure metadata in the accelerated secure memory system according to any one of claims 1-8.

10. A secure memory system, comprising: comprising: a data LLC, a memory controller, and a memory; wherein the memory controller is the memory controller in the secure memory system according to claim 9.

Images