Construction method of secure key-value storage system based on IntelSGX

Abstract

The present invention provides a method for constructing a secure memory key-value storage system based on Intel SGX, relating to the field of storage security technology. The method comprises the following steps: S1: placing key-value data and key-value storage indexes in a non-enclave area, constructing a continuous Merkle tree based on the memory address space, indexing Merkle tree nodes according to address offsets, and storing the Merkle tree in the enclave area; S2: designing a secure cache based on the continuous Merkle tree, and handling the movement of Merkle tree node data between enclave and non-enclave memory in a software-managed manner; S3: designing a user-mode memory allocator responsible for managing the allocation and release of non-enclave memory within the enclave; and S4: designing an index protection mechanism to detect integrity attacks against hash table or tree-based index structures. The present invention, employing the above-mentioned scheme, can ensure the confidentiality and integrity of key-value data in the key-value storage system, while significantly reducing the hardware protection overhead introduced by Intel SGX and supporting multiple types of index structures.

Description

Technical Field

[0001] The present invention relates to the field of storage security technology, and in particular to a method for constructing a secure memory key-value storage system based on Intel SGX. Background Art

[0002] In-memory key-value stores (KVS) have become a fundamental component of data center infrastructure. While KVS provide a simple interface abstraction for various online applications, they pose serious security threats to users, especially when deployed on untrusted third-party cloud infrastructure, where the operating system and hardware are vulnerable to attacks by potentially malicious attackers. In an untrusted environment, attackers can potentially compromise the confidentiality and integrity of in-memory KVS data.

[0003] The emergence of hardware-based Trusted Execution Environments (TEEs), such as Intel Software Guard Extensions (Intel SGX), provides shielded execution for applications in untrusted infrastructure. Shielded execution is designed to provide strong security features such as confidentiality and integrity using hardware-protected secure memory areas. Because the processor provides this shielded execution environment, SGX allows users to securely run their applications on untrusted infrastructure.

[0004] However, building a secure memory key-value store system based on a TEE can impact performance. SGX constructs a secure hardware container—an enclave—to protect applications within it from malicious attacks. The available space within the enclave, known as the enclave page cache (EPC), available to applications is limited. To accommodate larger data beyond physical limits, SGX employs a secure paging mechanism: SGX divides the memory space into two regions: the EPC, which stores recently accessed pages, and the non-EPC, which stores pages evicted from the EPC. Both the EPC and non-EPC regions are protected by SGX. Before pages are moved to the non-EPC region, they are hardware-encrypted. Pages in the non-EPC region must be moved to the EPC before they can be accessed. Unfortunately, an EPC miss incurs significant paging overhead (approximately 40,000 CPU cycles) compared to an EPC hit (approximately 200 CPU cycles). Therefore, placing all data in the memory key-value store in the EPC results in a significant performance degradation due to hardware secure paging overhead.

[0005] Currently, in order to take advantage of the hardware protection features of SGX, existing work directly places all data of the in-memory key-value storage system into the enclave space. However, the size of the in-memory key-value storage system is often much larger than the capacity of the EPC. Therefore, during the operation of the in-memory key-value storage system, SGX will incur high paging overhead. This performance overhead will make key-value services impractical.

[0006] In summary, there is currently no effective way to fully utilize the hardware protection features of SGX to build a high-performance and secure key-value storage system. Summary of the Invention

[0007] The present invention aims to solve one of the technical problems in related technologies at least to a certain extent.

[0008] To this end, the first objective of the present invention is to propose a method for constructing a secure key-value storage system based on Intel SGX. The system constructed by the above method can ensure the confidentiality and integrity of data in the key-value storage system, greatly reduce the high security overhead caused by Intel SGX, and support different types of index structures.

[0009] A second object of the present invention is to provide a computer device.

[0010] A third object of the present invention is to provide a non-transitory computer-readable storage medium.

[0011] To achieve the above objectives, an embodiment of the present invention discloses a method for constructing a secure key-value storage system based on Intel SGX, the method comprising the following steps:

[0012] S1: Place the key-value data and key-value storage index in the non-enclave memory, build a continuous Merkle tree based on the memory address space, index the Merkle tree nodes according to the address offset, and store the Merkle tree in the non-enclave memory;

[0013] S2: Design a secure cache based on a continuous Merkle tree, and handle the movement of Merkle tree node data between enclave memory and non-enclave memory in a software-managed manner;

[0014] S3: Design a user-mode memory allocator to manage the allocation and release of non-enclave memory within the enclave.

[0015] S4: Design index protection mechanisms to detect integrity attacks on hash table or tree-based index structures.

[0016] According to the method for constructing a secure key-value storage system based on Intel SGX in an embodiment of the present invention, the secure key-value storage system based on Intel SGX breaks the hardware limitations of SGX, makes full use of the limited secure memory resources provided by SGX to provide high-performance key-value services, while ensuring the confidentiality and integrity of key-value pairs, and can support multiple index structures and effectively support point queries and range queries.

[0017] In addition, the Intel SGX-based secure key-value storage system according to the above embodiment of the present invention may also have the following additional technical features:

[0018] In some examples, step S1 further includes: encrypting each key-value pair using a counter mode-based encryption algorithm, each key-value pair corresponding to a unique encryption counter, and calculating a message authentication code for the encrypted key-value pair and the encryption counter; the father node of the Merkle tree stores the message authentication codes of multiple child nodes, and the leaf nodes of the Merkle tree are composed of multiple encryption counters; the memory address of the starting tree node of each layer of the Merkle tree is fixed, and the address of the tree node is determined by the tree layer where the tree node is located and the offset of the node in the layer; and securely initializing the Merkle tree within the enclave.

[0019] Wherein, the security initialization first assigns a random value to the Merkle tree leaf node;

[0020] Then start from the Merkle tree child node, calculate the message authentication code of the Merkle tree node, and store the message authentication code in the parent node. When the calculation reaches the Merkle tree root node, stop iterating;

[0021] Finally, the root node of the Merkle tree is stored in the enclave.

[0022] In some examples, step S2 further includes: the secure cache is a key-value storage based on a hash table, the key is the memory address of the Merkle tree node, and the value is the message authentication code stored at the memory address; the software management method is to control the movement of the Merkle tree node between the enclave memory and the non-enclave memory using a software method within the enclave space; wherein,

[0023] The software method for controlling the movement of Merkle tree nodes between enclave memory and non-enclave memory further includes: the secure cache uses a cache replacement algorithm to control the movement of Merkle tree nodes, and before a program within the enclave accesses a Merkle tree node outside the enclave, the node is first moved to the secure cache; during the data movement process, the secure cache checks the integrity of the Merkle tree node moved into the enclave memory; the secure cache adopts a hierarchical fixed mechanism to always maintain high-level Merkle tree nodes in the enclave memory to prevent them from being replaced by the cache replacement algorithm to non-enclave memory.

[0024] In some examples, the secure cache checking the integrity of data moved into the enclave memory further includes: when a Merkle tree node in non-enclave memory is moved into the enclave memory, calculating a message authentication code of the moved-in node and comparing it with the parent node of the node; when a Merkle tree node in the enclave memory is moved into the non-enclave memory, if the node has not been modified since being moved into the secure cache, directly discarding the node; if the node has been modified, calculating a message authentication code of the moved-out node and storing it in its parent node.

[0025] In some examples, the comparing with the parent node of the node further includes: if the parent node is in a secure cache, directly comparing with a message authentication code stored in the parent node; if the message authentication codes are the same, the integrity is not compromised; if they are different, it indicates that the node has been attacked; if the parent node is not in the secure cache, first moving the parent node into the secure cache and then comparing;

[0026] The method of calculating the message authentication code of the node being moved out and storing it in its father node further includes: if the father node is located in the secure cache, directly writing the message authentication code into the father node; if the father node is not located in the secure cache, first moving the father node into the secure cache, and then writing the message authentication code into the father node.

[0027] In some examples, step S3 further includes: allocating a non-enclave memory space within the enclave, and dividing the memory space into a plurality of memory sub-regions; a user-mode memory allocator constructing a free list and a bitmap for each memory sub-region, each memory sub-region servicing a memory allocation request of a specific size; storing the first address of the memory sub-region and the bitmap in the enclave memory, and storing the free list in the non-enclave memory; wherein,

[0028] The free list is used by the user-mode memory allocator to allocate and release non-enclave space memory within the enclave space.

[0029] In some examples, the bitmap further includes: when the user-state memory allocator allocates memory, it detects whether the allocated memory address is set in the bitmap; if it is set, an integrity attack is detected; if it is not set, the allocation is successful, and the corresponding position in the bitmap is set; when the user-state memory allocator releases memory, the bitmap position corresponding to the released memory address is returned to its original position.

[0030] In some examples, the S4 step further includes: the index protection mechanism protecting internal connections of the index structure and malicious deletion of key-value pairs; storing the index entry address in the enclave space, generating a message authentication code together with the pointer address pointing to the current index node and the encrypted key-value pair corresponding to the index node; recording the number of key-value pairs and storing it in the enclave memory.

[0031] In order to implement the above embodiments, the second aspect of the present invention further proposes a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements any of the methods described above.

[0032] In order to implement the above embodiments, the third aspect of the present invention further proposes a non-transitory computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, it implements any of the methods described above.

[0033] Additional aspects and advantages of the present invention will be set forth in part in the description which follows and, in part, will be obvious from the description which follows, or may be learned by practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] The above and / or additional aspects and advantages of the present invention will become apparent and readily understood from the following description of the embodiments with reference to the accompanying drawings, in which:

[0035] Figure 1 This is a flowchart of a method for constructing a secure memory key-value storage system based on Intel SGX according to an embodiment of the present invention;

[0036] Figure 2 A schematic diagram of a Merkle tree structure according to an embodiment of the present invention;

[0037] Figure 3 A schematic diagram of a continuous Merkle tree memory organization method according to an embodiment of the present invention;

[0038] Figure 4 A schematic diagram of the collaboration between secure cache and Merkle tree according to an embodiment of the present invention;

[0039] Figure 5 This is a schematic diagram of the integrity attack on the index structure provided by the present invention. DETAILED DESCRIPTION

[0040] Embodiments of the present invention are described in detail below. Examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are illustrative only and are intended to illustrate the present invention and are not to be construed as limiting the present invention.

[0041] These and other aspects of the embodiments of the present invention will become apparent with reference to the following description and accompanying drawings. While some specific implementations of the embodiments of the present invention are disclosed in detail in these descriptions and accompanying drawings to illustrate some ways of implementing the principles of the embodiments of the present invention, it should be understood that the scope of the embodiments of the present invention is not limited thereby. On the contrary, the embodiments of the present invention encompass all variations, modifications, and equivalents that fall within the spirit and scope of the appended claims.

[0042] Figure 1 This is a flowchart of a method for constructing a secure memory key-value storage system based on Intel SGX according to an embodiment of the present invention.

[0043] The following describes a flowchart of a method for constructing a secure memory key-value storage system based on Intel SGX according to an embodiment of the present invention in conjunction with the accompanying drawings. Figure 1 As shown, the method comprises the following steps:

[0044] S101: Place the key-value data and key-value storage index in the non-enclave memory, build a continuous Merkle tree based on the memory address space, index the Merkle tree nodes according to the address offset, and store the Merkle tree in the non-enclave memory.

[0045] Furthermore, in an embodiment of the present invention, each key-value pair is encrypted using a counter mode-based encryption algorithm. Each key-value pair corresponds to a unique encryption counter, and a message authentication code is calculated for the encrypted key-value pair. The father node of the Merkle tree stores the message authentication codes of multiple child nodes, and the leaf nodes of the Merkle tree are composed of multiple encryption counters. The memory address of the starting tree node of each layer of the Merkle tree is fixed, and the address of the tree node is determined by the tree layer where the tree node is located and the offset of the node in the layer. The Merkle tree is securely initialized within the enclave.

[0046] Specifically, by dividing the secure memory key-value storage system into components, the key-value storage index and key-value data are placed in the non-enclave memory, reducing the use of the enclave memory and avoiding the hardware security paging overhead. At the same time, an encryption counter and message authentication code are constructed in the enclave memory to protect the confidentiality and integrity of the key-value data. 1) The encryption counter is bound to the key one-to-one. Each time the value corresponding to the key is updated, the encryption counter is incremented by 1, and the key-value pair is encrypted using the encryption counter to ensure the confidentiality of the key-value pair. The message authentication code is used to ensure the integrity of the encrypted key-value pair and the encryption counter. The present invention does not limit the specific calculation method of the message authentication code. The encryption counter and message authentication code are stored in the non-enclave memory. 2) The structure of the Merkle tree is as follows Figure 2As shown, the node size of the Merkle tree is fixed (for example, 768 bytes), and a message authentication code is calculated for a Merkle tree node and stored in the parent node. The size of the encryption counter and message authentication code varies with the specific algorithm implementation (for example, 16 bytes). Therefore, a Merkle tree leaf node includes multiple encryption counters or message authentication codes. The number of branches in the Merkle tree is the Merkle tree node size divided by the message authentication code size. 3) The organization of the continuous Merkle tree in non-enclave memory is as follows: Figure 3 As shown, all Merkle tree nodes are stored consecutively, which is beneficial to cache locality.

[0047] Furthermore, in an embodiment of the present invention, the Merkle tree is securely initialized within the enclave to ensure that the Merkle tree can protect the integrity of the leaf nodes during operation.

[0048] Specifically, in the initialization phase, random values ​​are assigned to the Merkle tree node. Then, starting from the Merkle tree node, the message authentication code of the Merkle tree node is calculated and stored in the parent node. This process is iterated until the Merkle tree root node is calculated. Finally, the root node of the Merkle tree is stored in the enclave to ensure that the root node will not be damaged, thereby protecting the integrity of the Merkle tree node.

[0049] S102: Design a secure cache based on a continuous Merkle tree, and handle the movement of Merkle tree node data between enclave memory and non-enclave memory in a software-managed manner.

[0050] Furthermore, in an embodiment of the present invention, the secure cache is a key-value storage based on a hash table, where the key is the memory address of the Merkle tree node and the value is the message authentication code stored at the memory address; the software management method is to use software methods to control the movement of the Merkle tree node between the enclave memory and the non-enclave memory within the enclave space.

[0051] Specifically, a software method is used within the enclave to manage the movement of Merkle tree nodes between enclave memory and non-enclave memory, avoiding the hardware security paging overhead, such as Figure 4 As shown, the secure cache is used to cache the message authentication codes and encryption counters of Merkle tree nodes. The cached nodes are located within the enclave's memory and cannot be compromised. These cached nodes can be used directly to encrypt or verify the integrity of key-value pairs. A hash table is used to maintain and index cached data. The present invention does not limit the specific implementation of the hash table.

[0052] Furthermore, in an embodiment of the present invention, the software method controls the movement of Merkle tree nodes between enclave memory and non-enclave memory; the secure cache uses a cache replacement algorithm to control the movement of Merkle tree nodes. Before a program within the enclave accesses a Merkle tree node outside the enclave, the node is first moved to the secure cache; during the data movement process, the secure cache checks the integrity of the Merkle tree node moved into the enclave memory; the secure cache adopts a hierarchical fixed mechanism to always maintain high-level Merkle tree nodes in the enclave memory to prevent them from being replaced by the cache replacement algorithm to non-enclave memory.

[0053] Specifically, the cache replacement algorithm is used to replace Merkle tree nodes within the enclave with non-enclave memory. The present invention does not limit the specific implementation of the cache replacement algorithm. During cache replacement, the node is detected to see if it is a hierarchically fixed node. If so, another node is selected for replacement.

[0054] Furthermore, in an embodiment of the present invention, the secure cache checks the integrity of data moved into the enclave memory. When a Merkle tree node in the non-enclave memory is moved to the enclave memory, the message authentication code of the incoming node is calculated and compared with the message authentication code stored in the parent node of the node. When a Merkle tree node in the enclave memory is moved to the non-enclave memory, if the node has not been modified since it was moved into the secure cache, the node is directly discarded. If the node has been modified, the message authentication code of the outgoing node is calculated and stored in its parent node.

[0055] Furthermore, in an embodiment of the present invention, the node is compared with its father node. If the father node is located in a secure cache, the comparison is performed directly. If the message authentication codes are the same, the integrity is not destroyed. If they are different, it means that the node is under an integrity attack. If the father node is not located in the secure cache, the father node is first moved into the secure cache and then compared.

[0056] Furthermore, in an embodiment of the present invention, the message authentication code of the node to be moved out is calculated and stored in its father node. If the father node is located in the security cache, the message authentication code is directly written into the father node; if the father node is not located in the security cache, the father node is first moved into the security cache, and then the message authentication code is written into the father node.

[0057] S103: Design a user-mode memory allocator to manage the allocation and release of non-enclave memory within the enclave.

[0058] Furthermore, in an embodiment of the present invention, a non-enclave memory space is allocated within the enclave, and the memory space is divided into multiple memory sub-regions; the user-mode memory allocator constructs a free list and a bitmap for each memory sub-region, and each memory sub-region serves memory allocation requests of a specific size; the first address of the memory sub-region and the bitmap are stored in the enclave memory, and the free list is stored in the non-enclave memory.

[0059] Specifically, the purpose of storing the free list in the non-enclave area is to reduce the enclave memory usage. The bitmap is used to detect whether the memory allocation is correct. The bitmap is stored in the enclave memory to prevent it from being tampered with.

[0060] Furthermore, in an embodiment of the present invention, the free list is used by the user-mode memory allocator to quickly allocate and release non-enclave space memory within the enclave space.

[0061] Furthermore, in an embodiment of the present invention, the bitmap is used to detect whether the allocated memory address is set in the bitmap when the user-state memory allocator allocates memory. If it is set, an integrity attack is detected; if it is not set, the allocation is successful, and the corresponding position in the bitmap is set; when the user-state memory allocator releases memory, the bitmap bit corresponding to the released memory address is returned to its original position.

[0062] S104: Design an index protection mechanism to detect integrity attacks against hash table or tree-based index structures.

[0063] Furthermore, in an embodiment of the present invention, the index protection mechanism protects the internal connections of the index structure and the malicious deletion of key-value pairs; the index entry address is stored in the enclave space, and the pointer address pointing to the current index node is combined with the encrypted key-value pair corresponding to the index node to generate a message authentication code; the number of key-value pairs is recorded and stored in the enclave memory.

[0064] Specifically, when traversing the index starting from the index entry, the pointer address pointing to the current index node is verified together with the index node for integrity, thereby detecting attacks on the index structure. Figure 5 A specific example of damaging the internal connection of the index structure is shown. A malicious attacker swaps the parent nodes of two nodes, node 2 and node 4. Since the generation of the message authentication code corresponding to the index node includes the address of its father node, the damage to the internal connection of the index structure can be detected.

[0065] In order to implement the above embodiments, the present invention also proposes a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, any of the above methods is implemented.

[0066] In order to implement the above embodiments, the present invention further proposes a non-transitory computer-readable storage medium having a computer program stored thereon, wherein the computer program implements any of the above methods when executed by a processor.

[0067] Although the embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the invention, and the scope of the invention is defined by the claims and their equivalents.

[0068] In the description of this specification, the reference terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" mean that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art can combine and combine different embodiments or examples described in this specification and features of different embodiments or examples without contradiction.

[0069] Furthermore, the terms "first" and "second" are used for descriptive purposes only and are not intended to indicate or imply relative importance or implicitly specify the number of technical features being referred to. Therefore, a feature specified as "first" or "second" may explicitly or implicitly include at least one such feature. In the description of the present invention, "plurality" means at least two, such as two, three, etc., unless otherwise specifically defined.

[0070] Any process or method description in a flowchart or otherwise described herein may be understood as representing a module, segment or portion of code comprising one or more executable instructions for implementing the steps of a custom logical function or process, and the scope of the preferred embodiments of the invention includes alternative implementations in which functions may be performed out of the order shown or discussed, including performing functions in a substantially simultaneous manner or in reverse order depending on the functions involved, which should be understood by those skilled in the art to which embodiments of the invention pertain.

[0071] The logic and / or steps represented in the flowcharts or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing the logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (e.g., a computer-based system, a system including a processor, or other system that can fetch and execute instructions from an instruction execution system, apparatus, or device). For purposes of this specification, a "computer-readable medium" can be any device that can contain, store, communicate, propagate, or transport a program for use by, or in conjunction with, an instruction execution system, apparatus, or device. More specific examples (a non-exhaustive list) of computer-readable media include the following: an electrical connection with one or more wires (electronic devices), a portable computer disk cartridge (magnetic device), random access memory (RAM), read-only memory (ROM), erasable and programmable read-only memory (EPROM or flash memory), fiber optic devices, and a portable compact disc read-only memory (CDROM). Furthermore, the computer-readable medium may even be paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium and then editing, translating or processing it in another suitable manner if necessary, and then storing it in a computer memory.

[0072] It should be understood that various parts of the present invention can be implemented using hardware, software, firmware, or a combination thereof. In the above-described embodiments, multiple steps or methods can be implemented using software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented using hardware, as in another embodiment, any one of the following technologies known in the art or a combination thereof can be used: a discrete logic circuit having logic gate circuits for implementing logic functions on data signals, an application-specific integrated circuit having suitable combinational logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0073] A person skilled in the art can understand that all or part of the steps carried out in the method of the above embodiment can be completed by instructing the corresponding hardware through a program, and the program can be stored in a computer-readable storage medium. When the program is executed, it includes one of the steps of the method embodiment or a combination thereof.

[0074] In addition, the functional units in the various embodiments of the present invention may be integrated into a single processing module, or each unit may exist physically separately, or two or more units may be integrated into a single module. The aforementioned integrated modules may be implemented in the form of hardware or in the form of software functional modules. If the integrated modules are implemented in the form of software functional modules and sold or used as independent products, they may also be stored in a computer-readable storage medium.

[0075] The storage medium mentioned above may be a read-only memory, a magnetic disk, or an optical disk, etc. Although the embodiments of the present invention have been shown and described above, it should be understood that the above embodiments are exemplary and are not intended to limit the present invention. Those skilled in the art may make changes, modifications, substitutions, and variations to the above embodiments within the scope of the present invention.

Claims

1. A method for constructing a secure key-value memory storage system based on Intel SGX, characterized in that: The construction method comprises the following steps: S1: Place the key-value data and key-value storage index in the non-enclave memory, build a continuous Merkle tree based on the memory address space, index the Merkle tree nodes according to the address offset, and store the Merkle tree in the non-enclave memory; S2: Design a secure cache based on a continuous Merkle tree, and handle the movement of Merkle tree node data between enclave memory and non-enclave memory in a software-managed manner; S3: Design a user-mode memory allocator to manage the allocation and release of non-enclave memory within the enclave. S4: Design index protection mechanisms to detect integrity attacks against hash table or tree-based index structures; The S2 step further includes: The secure cache is a key-value storage based on a hash table, where the key is the memory address of the Merkle tree node and the value is the message authentication code stored at the corresponding memory address; The software management method is to use software methods to control the movement of Merkle tree nodes between enclave memory and non-enclave memory within the enclave space; wherein, The secure cache uses a cache replacement algorithm to control the movement of Merkle tree nodes. Before a program in the enclave accesses a Merkle tree node outside the enclave, the Merkle tree node is first moved to the secure cache. During the data movement, the secure cache checks the integrity of the Merkle tree nodes moved into the enclave memory; The secure cache adopts a hierarchical fixed mechanism to always maintain high-level Merkle tree nodes in the enclave memory to prevent them from being replaced to non-enclave memory by the cache replacement algorithm.

2. The method according to claim 1, characterized in that The step S1 further comprises: Each key-value pair is encrypted using a counter-mode-based encryption algorithm. Each key-value pair corresponds to a unique encryption counter, and a message authentication code is calculated based on the encrypted key-value pair and the encryption counter. The father node of the Merkle tree stores the message authentication codes of multiple child nodes, and the leaf nodes of the Merkle tree are composed of multiple encryption counters; The memory address of the starting tree node of each layer of the Merkle tree is fixed, and the address of the tree node is determined by the tree layer where the tree node is located and the offset of the node in the layer; The Merkle tree is securely initialized within the enclave: first, random values ​​are assigned to the leaf nodes of the Merkle tree; Then, starting from the Merkle tree child node, calculate the message authentication code of the Merkle tree node and store the message authentication code in the parent node. When the calculation reaches the Merkle tree root node, stop iterating; Finally, the root node of the Merkle tree is stored in the enclave.

3. The method according to claim 1, characterized in that The secure cache checks the integrity of data moved into the enclave memory and also includes: When a Merkle tree node in non-enclave memory is moved to enclave memory, the message authentication code of the node is calculated and compared with the message authentication code stored in the parent node of the node; When a Merkle tree node in enclave memory is moved to non-enclave memory, if the node has not been modified since it was moved into the secure cache, the node is discarded directly. If the node has been modified, the message authentication code of the moved node is calculated and stored in its parent node.

4. The method according to claim 3, characterized in that The comparison with the message authentication code stored in the parent node of the node further includes: If the father node is in the secure cache, a direct comparison is performed. If the message authentication codes are the same, the integrity is intact. If they are different, it means that the node has been attacked. If the father node is not in the safe cache, first move the father node into the safe cache and then compare; The step of calculating the message authentication code of the removed node and storing it in its parent node further includes: If the father node is in the secure cache, the message authentication code is directly written to the father node; If the father node is not in the secure cache, first move the father node into the secure cache, and then write the message authentication code into the father node.

5. The method according to claim 1, wherein The S3 step further includes: Allocate a non-enclave memory space within the enclave and divide the memory space into multiple memory sub-regions; The user-mode memory allocator builds a free list and a bitmap for each memory sub-region, and each memory sub-region serves memory allocation requests of a specific size; The first address of the memory sub-region and the bitmap are stored in the enclave memory, and the free list is stored in the non-enclave memory; The free list is used by the user-mode memory allocator to allocate and release non-enclave space memory within the enclave space.

6. The method according to claim 5, characterized in that The bitmap includes: When allocating memory, the user-mode memory allocator detects whether the allocated memory address is set in the bitmap. If it is set, an integrity attack is detected; if not, the allocation is successful and the corresponding position in the bitmap is set; When the user-mode memory allocator releases memory, it returns the bitmap position corresponding to the released memory address to its original position.

7. The method according to claim 1, characterized in that The S4 step further includes: The index protection mechanism protects the internal connections of the index structure and the malicious deletion of key-value pairs; The index entry address is stored in the enclave space, and the pointer address pointing to the current index node is combined with the encryption key-value pair corresponding to the index node to generate a message authentication code; Record the number of key-value pairs and store them in the enclave memory.

8. A computer device, characterized in that: The method comprises a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the method according to any one of claims 1 to 7 is implemented.

9. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images