A remote memory access system and method

Abstract

The present invention provides a remote memory access system, comprising a network interface device, wherein the device comprises: an encryption and decryption module, which is used to obtain information of a buffer zone, wherein the information comprises a unique identifier, a virtual address, a length and a physical address of the buffer zone, wherein the encryption and decryption module generates a corresponding key for each buffer zone, encrypts the physical address of the buffer zone based on the key, and generates a ciphertext of the physical address of the buffer zone; an authority recording module, which is used to record authority verification information corresponding to each buffer zone, including the unique identifier, the virtual address, the length and the key information of the buffer zone; a response processing module, which is used to verify whether a requesting end has access rights to a designated buffer zone according to the authority verification information of the buffer zone, and obtain the physical address of the designated buffer zone obtained by decrypting the ciphertext of the physical address of the buffer zone designated by the verified requesting end; and a memory access module, which is used to authorize the requesting end to access the buffer zone according to the physical address of the designated buffer zone.

Description

Technical Field

[0001] The present invention relates to the field of network communication technology, and more specifically, to a system and method for remote memory access. Background Art

[0002] In existing distributed applications, a large amount of network communication is performed during their operation. Therefore, network communication capability is a key factor affecting the overall performance of distributed applications. Remote Direct Memory Access (RDMA) is an effective technical means to improve the network communication performance of distributed applications. Compared with traditional TCP / IP network communication, RDMA technology has the significant advantages of high bandwidth and low latency. RDMA network cards need to use network protocol stack related information and memory access related information. These two types of status information are usually pre-allocated by the operating system and placed in the memory. The network card reads or updates from the memory during the communication process. In order to speed up access to this status information, a cache space is opened on the network card to temporarily store this status information. When the network card processes a communication request for a connection, if the status information of the connection is not cached on the network card, the network card needs to access the memory through the system bus, read the status information from the memory, and then update the local cache before processing the data. Therefore, when the cache misses, the impact on communication performance is greater.

[0003] As the scale of the system and the application work data set continue to increase, the cache of the network card is facing great pressure. On the one hand, the number of communication processes within a single node is large, resulting in more and more communication states that need to be stored; on the other hand, the increase in the application work data set leads to an increasing number of virtual-to-real address translation table entries that need to be stored, and many applications have the characteristics of random memory access when accessing remote memory. At the same time, the increase in the number of caches on the network card is far less than the growth rate of state information. The loss of memory state access is a direct factor in the degradation of RDMA performance. There are currently four methods to solve the loss of RDMA network card memory state to improve the scalability of RDMA networks. One of the methods is to reduce the memory state information cached on the network card.

[0004] Traditional methods of reducing memory cache status information on network cards include: Existing method 1) When the operating system pages the memory after power-on, a portion of space is reserved, and the space is paged according to the configured page size. At this time, there will be two page sizes in the system (usually 4KB small pages and 2MB large pages), and different applications use different page sizes when using memory. When remote direct memory communication is required, the operating system uses large pages for memory allocation and writes the correspondence between virtual addresses and physical addresses into the page table entries of the memory. When the network card reads from the memory to the cache to convert the virtual address to the physical address during the communication process, this method can reduce the number of page table entries to 1 / 512 of the original, thereby significantly improving the hit rate of the network card cache. Existing method 2) When a process needs to communicate over the network, a buffer is registered with the operating system, and the operating system directly returns the physical page of the buffer. The physical page of the buffer is sent by the process to the communication peer through out-of-band communication. When the communication peer accesses the memory of the current process, the physical address is directly used to generate a network request. The physical page table entry will be delivered to the receiver via the network data packet, and the receiver's network card will directly use the physical page address to initiate memory read and write requests. In this way, the network card directly uses the physical address for memory access, eliminating the reliance on the memory state cache, thus solving the scalability problem of the memory state.

[0005] However, although the above existing method 1) uses large pages for memory allocation, it can reduce the number of correspondences between the virtual address and the physical address of the page table entry in the network card, read from the memory to the cache for conversion from virtual address to physical address, and improve the hit rate of the network card cache. However, on the one hand, since the system uses large pages, the protection granularity of the memory page will become larger, and it will become easier to sniff the process memory, thus reducing the security of the system; on the other hand, as the growth rate of the application working data set exceeds the growth rate of the network card cache capacity, this method cannot fundamentally solve the problem. In the existing method 2), since the physical address used by the receiving network card is directly transmitted by the sender, if the sending process is a malicious program, it may fill in an illegal physical address in the network request, thereby accessing any memory address area of ​​the responding end, which is also very insecure. Summary of the invention

[0006] Therefore, the purpose of the present invention is to overcome the above-mentioned defects of the prior art and provide a system and method for remote memory access.

[0007] The objective of the present invention is achieved through the following technical solutions:

[0008] According to a first aspect of the present invention, a remote memory access system is provided, comprising a network interface device, one or more CPUs and a memory corresponding to each CPU, wherein the network interface device is connected to the CPU via a system bus, the memory comprising a buffer, and the network interface device comprising: an encryption and decryption module, for obtaining buffer information, wherein the buffer information at least comprises a unique identifier, a virtual address, a length and a physical address of the buffer, the encryption and decryption module generates a corresponding key for each buffer, encrypts the physical address of the buffer based on the key, and generates a physical address ciphertext of the buffer; a permission recording module, for recording permission verification information corresponding to each buffer including the unique identifier, the virtual address, the length and the key information of the buffer; a response processing module, for a remote memory access request for a specified buffer by a requesting end, wherein the request includes the unique identifier, the virtual address, the length and the physical address of the specified buffer, the response processing module verifies whether the requesting end has access rights to the specified buffer according to the permission verification information recorded in the permission recording module, and obtains the physical address of the specified buffer obtained by decrypting the physical address ciphertext of the specified buffer to which the requesting end has access rights; and a memory access module, for authorizing the requesting end to access the buffer corresponding to the physical address according to the physical address of the specified buffer.

[0009] In some embodiments of the present invention, the network interface device also includes: a request processing module, which is used to make a remote memory access request to a specified buffer based on the request end, and the request includes a unique identifier, virtual address, length and physical address of the specified buffer. The request processing module verifies whether the request end has access rights to the existing specified buffer according to the permission verification information recorded in the permission recording module, and obtains the physical address of the specified buffer after decrypting the ciphertext of the physical address of the specified buffer to which the request end has access rights.

[0010] In some embodiments of the present invention, the response processing module is used to determine whether a specified buffer exists based on a unique identifier of the specified buffer and a unique identifier of a buffer in memory, and the response processing module verifies whether the requesting end has access rights to the specified buffer based on the permission verification information recorded in the permission recording module for the existing specified buffer in the following manner, including: determining whether the virtual address of the specified buffer is equal to the virtual address of the buffer in memory, and determining whether the length of the specified buffer is less than or equal to the length of the buffer in memory, to perform access rights verification.

[0011] In some embodiments of the present invention, the request processing module is used to determine whether a specified buffer exists based on a unique identifier of the specified buffer and a unique identifier of a buffer in memory, and the request processing module verifies whether the requesting end has access rights to the specified buffer based on the permission verification information recorded in the permission recording module for the existing specified buffer in the following manner, including: determining whether the virtual address of the specified buffer is equal to the virtual address of the buffer in memory, and determining whether the length of the specified buffer is less than or equal to the length of the buffer in memory, to perform access rights verification.

[0012] In some embodiments of the present invention, the request includes a physical address ciphertext and a physical address signature of a specified buffer; the encryption and decryption module is also used to verify whether the requesting end has access rights to the specified buffer based on the key in the recorded permission verification information and the physical address ciphertext and the physical address signature of the specified buffer; and to decrypt the physical address ciphertext of the specified buffer to which the requesting end has access rights to obtain the decrypted physical address of the specified buffer.

[0013] In some embodiments of the present invention, the encryption and decryption module is also used to encrypt the physical address of the buffer or decrypt the physical address ciphertext of the specified buffer using a predetermined encryption and decryption algorithm, wherein the encryption and decryption algorithm is an RSA encryption and decryption algorithm or a DES encryption and decryption algorithm.

[0014] In some embodiments of the present invention, the memory access module implements access to the buffer corresponding to the physical address in the following manner, including: obtaining the data to be sent based on the request type of the remote memory access request and the physical address and length of the specified buffer, and sending it to the responding end; or obtaining the data to be sent based on the request type of the remote memory access request and the physical address and length of the specified buffer, and sending it to the requesting end.

[0015] In some embodiments of the present invention, the network interface device also includes a data packet receiving and sending module, which is configured to: obtain data to be sent in a buffer corresponding to a physical address according to a remote memory access request, and generate a number of data packets based on the data to be sent for sending; or receive data packets sent through the network when receiving a remote memory access request.

[0016] In some embodiments of the present invention, the CPU is configured with: an application module, which is used to allocate a corresponding buffer in the memory according to the data to be sent or the data to be received in the remote memory access request, and generate a virtual address and length of the buffer; and a network card driver module, which is used to generate a unique identifier and a corresponding physical address of the buffer based on the allocated buffer.

[0017] According to a second aspect of the present invention, a remote memory access response method is provided, comprising: step B1: obtaining a request data packet sent by a requesting end through a network when requesting remote memory access, and extracting information of a designated response end buffer in the request data packet, wherein the information includes a physical address ciphertext, a unique identifier, a virtual address and a length of the designated response end buffer; step B2: obtaining permission verification information, and verifying whether the requesting end has access rights to the designated response end buffer based on the permission verification information and the unique identifier, the virtual address and the length of the designated response end buffer; step B3: for a requesting end that has passed the verification, obtaining a physical address of the designated response end buffer obtained by decrypting the physical address ciphertext of the designated response end buffer in a request data packet sent by the requesting end; and step B4: authorizing the requesting end to access the response end buffer corresponding to the physical address of the response end buffer based on the request type of the request data packet and the physical address of the designated response end buffer.

[0018] In some embodiments of the present invention, step B2 includes: determining whether the response end buffer specified for access exists based on the unique identifier of the specified response end buffer; obtaining permission verification information corresponding to the existing response end buffer based on the unique identifier of the specified response end buffer, including the unique identifier, virtual address and length corresponding to the response end buffer in the response end memory; determining whether the access permission is exceeded by comparing the virtual address of the specified response end buffer with the virtual address corresponding to the response end buffer in the memory, and comparing the length of the specified response end buffer with the length corresponding to the response end buffer in the memory.

[0019] In some embodiments of the present invention, the information of the specified response end buffer also includes a physical address signature of the specified response end buffer, the permission verification information also includes a key corresponding to the response end buffer in the response end memory, and the verification of whether the requesting end has access rights to the specified response end buffer also includes: verifying the correctness of the physical address signature of the specified response end buffer based on the key of the response end buffer in the memory and the physical address ciphertext of the specified response end buffer to determine whether it is a normal access.

[0020] In some embodiments of the present invention, step B4 includes: obtaining the length of the response end buffer specified in the request data packet, wherein the request type of the request data packet is remote memory write data or remote memory read data; performing remote memory write data on the response end buffer according to the request data packet of the remote memory write data, the physical address of the specified response end buffer, and the length of the specified response end buffer; reading the corresponding data in the response end buffer according to the request data packet of the remote memory read data, the physical address of the specified response end buffer, and the length of the specified response end buffer to obtain the data to be sent.

[0021] In some embodiments of the present invention, the request data packet for reading data from the remote memory includes information of a specified request side buffer, and the access to the response side buffer also includes: obtaining data to be sent, generating multiple response data packets based on the data to be sent for feedback to the request side, wherein the response data packet includes the length of the specified request side buffer and the physical address of the specified request side buffer calculated by decrypting the information of the specified request side buffer.

[0022] In some embodiments of the present invention, the response method also includes: based on the connection established between the responding end and the requesting end, according to the amount of data received or sent, allocating a responding end buffer in the memory of the responding end and generating corresponding response end buffer information for the responding end buffer in the memory, wherein the information includes a unique identifier, virtual address, length and physical address corresponding to the responding end buffer in the memory.

[0023] In some embodiments of the present invention, the information for generating the corresponding response end buffer also includes a key of the response end buffer generated by the responder for the response end buffer in the memory; based on the key, unique identifier, virtual address and length corresponding to the response end buffer in the memory, the permission verification information corresponding to the response end buffer is obtained; the ciphertext of the specified response end buffer is obtained by encrypting the physical address corresponding to the response end buffer in the memory based on the key corresponding to the response end buffer in the memory; the physical address signature of the specified response end buffer is obtained based on the key corresponding to the response end buffer in the memory and the physical address ciphertext of the response end buffer in the memory.

[0024] According to a third aspect of the present invention, a remote memory access request method is provided, comprising: step A1: obtaining a remote memory access request initiated to a responder, wherein the request includes information of a designated requester buffer and information of a designated responseer buffer, the information of the designated requester buffer includes a physical address ciphertext, a unique identifier, a virtual address and a length of the designated requester buffer, and the information of the designated responseer buffer includes a physical address ciphertext of the designated responseer buffer; step A2: obtaining permission verification information, and verifying whether the requester has access rights to the designated requester buffer according to the permission verification information and the unique identifier, virtual address and length of the designated requester buffer; step A3: for a verified requester, obtaining a physical address of the designated requester buffer obtained by decrypting the physical address ciphertext of the designated requester buffer in the information of the designated requester buffer; step A4: obtaining data to be sent according to the request type of the remote memory access request and the physical address of the designated requester buffer, so as to generate a corresponding request data packet based on the data to be sent and send it to the responder.

[0025] In some embodiments of the present invention, step A2 includes: determining whether the request side buffer specified for access exists based on the unique identifier of the specified request side buffer; obtaining permission verification information corresponding to the existing request side buffer based on the unique identifier of the specified request side buffer, including the unique identifier, virtual address and length corresponding to the request side buffer in the request side memory; determining whether the access permission is exceeded by comparing the virtual address of the specified request side buffer with the virtual address corresponding to the request side buffer in the memory, and comparing the length of the specified request side buffer with the length corresponding to the request side buffer in the memory.

[0026] In some embodiments of the present invention, the information of the specified request side buffer also includes a physical address signature of the specified request side buffer, the permission verification information also includes a key corresponding to the request side buffer in the request side memory, and the verification of whether the request side has access rights to the specified request side buffer also includes: based on the key of the request side buffer in the memory and the physical address ciphertext of the specified request side buffer, verifying the correctness of the physical address signature of the specified request side buffer to determine whether it is normal access.

[0027] In some embodiments of the present invention, the request types of the remote memory access request include remote memory read data requests and remote memory write data requests, and the step A4 includes: obtaining the length of the buffer of the specified request side in the remote memory access request; reading the data of the corresponding buffer of the request side according to the remote memory write data request, the physical address of the buffer of the specified request side, and the length of the buffer of the specified request side, to obtain the data to be sent and the information of the buffer of the specified response side; obtaining the information of the buffer of the specified request side to be sent and the information of the buffer of the specified response side according to the remote memory read data request, the physical address of the buffer of the specified request side, and the length of the buffer of the specified request side.

[0028] In some embodiments of the present invention, the generation of corresponding request data packets based on the data to be sent includes: based on the data to be sent and the information of the designated response end buffer, generating multiple request data packets for sending to the response end for remote memory writing data; or based on the information of the designated request end buffer to be sent and the information of the designated response end buffer, generating a request data packet for sending to the response end for remote memory reading data.

[0029] In some embodiments of the present invention, the request method also includes: based on the connection established between the responding end and the requesting end, according to the amount of data to be sent or received as needed, allocating a requesting end buffer in the memory and generating corresponding requesting end buffer information for the requesting end buffer in the memory, wherein the information includes a unique identifier, virtual address, length and physical address corresponding to the requesting end buffer in the memory.

[0030] In some embodiments of the present invention, the information of the generated request side buffer includes a key of the request side buffer generated by the request side for the request side buffer in the memory; based on the key, unique identifier, virtual address and length corresponding to the request side buffer in the memory, the permission verification information corresponding to the request side buffer is obtained; the physical address ciphertext of the specified request side buffer is obtained by encrypting the physical address corresponding to the request side buffer in the memory based on the key corresponding to the request side buffer in the memory; the physical address signature of the specified request side buffer is obtained based on the key corresponding to the request side buffer in the memory and the physical address ciphertext corresponding to the request side buffer in the memory.

[0031] According to a fourth aspect of the present invention, there is provided an electronic device comprising: one or more processors; and a memory, wherein the memory is used to store executable instructions; the one or more processors are configured to implement the steps of the method described in any one of the second aspect of the present invention and the third aspect of the present invention by executing the executable instructions.

[0032] Compared with the prior art, the advantages of the present invention are:

[0033] The network interface device in the system of the present invention needs to encrypt the physical address of the buffer in the memory, and when making a remote memory access request, the physical address transmitted is the physical address ciphertext, and the physical address obtained in the request is the encrypted physical address ciphertext. It is necessary to perform permission verification on the information of the specified buffer in the request according to the permission verification information to determine whether the requesting end has access rights to the specified buffer. Only after verification can the physical address of the specified buffer decrypted from the physical address ciphertext of the specified buffer be used to access the corresponding buffer in the memory, thereby enhancing the security of the system during remote memory access. In addition, the network interface device in the system of the present invention directly accesses through the decrypted physical address, and does not need to store the conversion page table entry from the virtual address to the physical address, thereby avoiding the performance impact caused by the lack of the corresponding conversion page table entry cached by the network interface device. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] The embodiments of the present invention are further described below with reference to the accompanying drawings, in which:

[0035] Figure 1 A schematic diagram of a remote memory access system according to an embodiment of the present invention;

[0036] Figure 2 A flowchart of a remote memory access request method according to an embodiment of the present invention;

[0037] Figure 3 The figure is a flow chart of a remote memory access response method according to an embodiment of the present invention. DETAILED DESCRIPTION

[0038] In order to make the purpose, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below through specific embodiments in conjunction with the accompanying drawings. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0039] As mentioned in the background technology section, in the existing method 1), although large pages are used for memory allocation, the number of corresponding conversion relationships between virtual addresses and physical addresses in the page table entries of the network card can be reduced, the missing of page table entries in the cache of the network card can be reduced, and the hit rate of the page table entries in the cache of the network card can be improved when the data is read from the memory to the cache and the virtual address is converted to the physical address according to the page table entries. However, on the one hand, since the system uses large pages, the protection granularity of the memory page will become larger, and it will become easier to sniff the process memory, thereby reducing the security of the system; on the other hand, as the growth rate of the application working data set exceeds the growth rate of the network card cache capacity, it will also cause the missing of the cached page table entries, thereby affecting the communication performance. This method cannot fundamentally solve the problem. In the existing method 2), since the physical address used by the receiving network card is directly transmitted by the sender, if the sending process is a malicious program, it is possible to fill in an illegal physical address in the network request, thereby accessing any memory address area of ​​the responding end, which is also very unsafe.

[0040] Based on the above research, the present invention provides a remote memory access system, which includes a network interface device, one or more CPUs and a memory corresponding to each CPU, wherein the network interface device is connected to the CPU via a system bus, and the memory includes a buffer, characterized in that the network interface device includes: an encryption and decryption module, used to obtain buffer information, wherein the buffer information at least includes a unique identifier, a virtual address, a length and a physical address of the buffer, the encryption and decryption module generates a corresponding key for each buffer, encrypts the physical address of the buffer based on the key, and generates a physical address ciphertext of the buffer; a permission recording module, used to record permission verification information corresponding to each buffer including its unique identifier, virtual address, length and key information of the buffer; a response processing module, used to request a remote memory access to a specified buffer based on a request from a requesting end, wherein the request includes a unique identifier, a virtual address, a length and a physical address of the specified buffer, the response processing module verifies whether the requesting end has access rights to the specified buffer according to the permission verification information recorded in the permission recording module, and obtains the physical address of the specified buffer obtained after decrypting the physical address ciphertext of the specified buffer to which the requesting end has access rights; a memory access module, used to authorize the requesting end to access the buffer corresponding to the physical address according to the physical address of the specified buffer. The network interface device in the system of the present invention needs to encrypt the physical address of the buffer, and when making a remote memory access request, the transmitted physical address is the physical address ciphertext, and the physical address obtained in the request is the encrypted physical address ciphertext. It is necessary to perform permission verification on the information of the specified buffer in the request according to the corresponding permission verification information to determine whether the requesting end has access rights to the specified buffer. Only after verification can the physical address of the specified buffer decrypted from the physical address ciphertext of the specified buffer be used to access the buffer in the memory, thereby enhancing the security of the system during remote memory access. In addition, the network interface device in the system of the present invention directly accesses through the decrypted physical address, and does not need to store the conversion page table entry from the virtual address to the physical address, thereby avoiding the performance impact caused by the lack of the corresponding conversion page table entry cached by the network interface device.

[0041] According to an embodiment of the present invention, a remote memory access system is provided. The system can be deployed on either a request end or a response end. Figure 1, including an application module 1, a network card driver module 2, an application buffer 3, a system bus module 4 and a network interface device 5. Among them, the network interface device 5 includes a request processing module 501, a response processing module 502, a memory access module 503, an encryption and decryption module 504, a permission recording module 505 and a data packet transceiving module 506. The application module 1 and the network card driver module 2 are arranged in the central processing unit CPU, the application buffer 3 is arranged in the memory, and the application buffer 3 is the buffer in the memory. The application module 1 and the network card driver module 2 are connected to the application buffer 3 in the memory, and are connected to the memory access module 503 in the network interface device 5 through the system bus module 4. The memory access module 503 and the data packet transceiving module 506 are interconnected with the request processing module 501, the response processing module 502 and the encryption and decryption module 504, and the encryption and decryption module 504 is also interconnected with the permission recording module 505.

[0042] According to one embodiment of the present invention, the memory is implemented by a dynamic random access memory DRAM to store the driver code of the application module 1 and the network card driver module 2 and the data required by them; the system bus module 4 itself has a routing function, and can forward the control information and data information between different modules in the system according to the relevant bus protocol fields in the carried data packets. The present invention does not limit the bus type of the system bus module, which can be a peripheral component interconnect standard: PCI (Peripheral Component Interconnect, PCI) or PCI-X, a high-speed serial computer expansion bus standard PCI-E (peripheral component interconnect express), a bus protocol: AXI (Advanced Xtensible Interface), etc. The memory access module 503 supports memory access based on the PCI-E protocol, the request processing module 501 is connected to the memory access module 503, the encryption and decryption module 504, and the data packet transceiver module 506 through the AXI bus; the response processing module 502 is connected to the memory access module 503, the encryption and decryption module 504, and the data packet transceiver module 506 through the AXI bus; the encryption and decryption module 504 supports reversible encryption and decryption algorithms such as RSA encryption and decryption algorithms or DES encryption and decryption algorithms, and the encryption and decryption module 504 is connected to the memory access module 503, the request processing module 501, the response processing module 502 and the authority recording module 505 through the AXI bus; the authority recording module 505 is implemented using a static random access memory SRAM; the data packet transceiver module 506 supports the InfiniBand network communication protocol and the TCP / IP protocol, and can realize end-to-end data transmission and reception. Among them, the TCP / IP protocol is used to transmit control information, and the InfiniBand network communication protocol is used to transmit data information. The data packet transceiver module 506 is connected to the request processing module 501 and the response processing module 502 via the AXI bus.

[0043] According to an embodiment of the present invention, control information of a corresponding buffer used when a remote memory access is performed between a request end and a response end is described.

[0044] K recv : The key of the responder buffer generated by the responder for the responder buffer in memory;

[0045] F recv : The unique identifier of the responder buffer generated by the responder for the responder buffer in memory;

[0046] P recv : The physical address of the responder buffer generated by the responder for the responder buffer in memory;

[0047] L recv : The size of the responder buffer generated by the responder for the responder buffer in memory;

[0048] V recv : The virtual address of the responder buffer generated by the responder for the responder buffer in memory;

[0049] S recv : The physical address signature of the responder buffer generated by the responder for the responder buffer in memory;

[0050] W recv : The physical address ciphertext of the responder buffer generated by the responder for the responder buffer in the memory;

[0051] K send : The key of the requester buffer generated by the requester for the requester buffer in memory;

[0052] F send : The unique identifier of the request side buffer generated by the request side for the request side buffer in memory;

[0053] P send : The physical address of the request side buffer generated by the request side for the request side buffer in memory;

[0054] L send : The size of the requester buffer generated by the requester for the requester buffer in memory;

[0055] V send : The virtual address of the request side buffer generated by the request side for the request side buffer in memory;

[0056] S send : The physical address signature of the requester buffer generated by the requester for the requester buffer in memory;

[0057] W send : The physical address ciphertext of the request side buffer generated by the request side for the request side buffer in the memory;

[0058] F r-app : The unique identifier of the specified responder buffer that the requester requests access to;

[0059] P r-app : The responder decrypts and calculates the physical address of the designated response end buffer according to the information of the designated response end buffer in the request data packet;

[0060] L r-app : The length of the specified responder buffer in the requester's memory access request;

[0061] V r-app: The virtual address of the specified responder buffer in the requester's memory access request;

[0062] S r-app : The physical address signature of the specified responder buffer in the requester's memory access request;

[0063] W r-app : The physical address ciphertext of the specified responder buffer in the requester's memory access request;

[0064] F s-app : The unique identifier of the specified requester buffer in the requester memory access request;

[0065] P s-app : The request end decrypts and calculates the physical address of the specified request end buffer according to the information of the specified request end buffer;

[0066] L s-app : The length of the specified request side buffer in the request side memory access request;

[0067] V s-app : The virtual address of the specified request side buffer in the request side memory access request;

[0068] S s-app : Physical address signature of the specified request side buffer in the request side memory access request;

[0069] W s-app : The physical address ciphertext of the specified request side buffer in the request side memory access request.

[0070] According to one embodiment of the present invention, the application module 1 includes an application program running on a CPU, and during its operation, it needs to communicate with an application program running on a remote host through a network. At the request end, the application module 1 submits a network communication request for making a remote memory access request, and at the response end, the application module 1 responds to the remote memory access request. Before the request end and the response end make a remote memory access, the application module 1 also needs to allocate a buffer for network communication in the application buffer 3 in the memory according to the data to be sent or the data to be received in the remote memory access request, and generate information about the buffer, which includes a virtual address and a length, wherein, at the request end, the information about the request side buffer generated for the request side buffer in the memory includes the virtual address V of the generated request side buffer. send and length L send , on the responder side, the information of the responder side buffer generated for the responder side buffer in the memory includes the virtual address V of the generated responder side buffer recv and length L recv .

[0071] According to an embodiment of the present invention, the corresponding buffer is registered by the network card driver module 2. Specifically, the network card driver module 2 is a program running on the CPU. When the application module 1 allocates a buffer according to the amount of data received or sent, at the request end, the network card driver module 2 registers the request end buffer allocated by the application module 1 in the application buffer 3 in the memory and generates information corresponding to the request end buffer, wherein the generated request end buffer information includes a unique identifier F of the generated request end buffer. send and physical address P send , and the unique identifier F of the request side buffer generated above send , virtual address V send Length L send and physical address P send The memory access module 503 of the network interface device 5 is sent to the memory access module 503 through the system bus module 4, and the memory access module 503 passes it to the encryption and decryption module 504. At the response end, the network card driver module 2 registers the request end buffer allocated by the application module 1 in the application buffer 3 of the memory and generates information corresponding to the response end buffer, wherein the generated response end buffer information includes the unique identifier F of the generated response end buffer recv and physical address P recv , and the unique identifier F of the response end buffer generated above recv , virtual address V recv Length L recv and physical address P recv The memory access module 503 sends it to the network interface device 5 through the system bus module 4, and the memory access module 503 passes it to the encryption and decryption module 504.

[0072] According to one embodiment of the present invention, the application buffer 3 is a storage area in the host memory, which is used to store the working data set and network communication data during the operation of the application in the application module 1, as well as the encrypted physical address ciphertext of the buffer where the network communication data is located.

[0073] According to one embodiment of the present invention, at the requesting end, the encryption and decryption module 504 generates a key K of the requesting end buffer for the registered requesting end buffer. send At the same time, the authority recording module 505 is used to record the unique identifier F corresponding to the request end buffer containing the request end buffer send , virtual address V send Length L send , key K send The permission verification information of the information forms a permission verification information table entry of the request end buffer < unique identifier F send, virtual address V send Length L send , key K send > Finally, according to the key K send The physical address P of the request side buffer generated send Encrypt and obtain the physical address ciphertext W of the generated request side buffer send , using the key K send is the ciphertext W send Generate signature S send , the unique identifier F send , virtual address V send Length L send , physical address ciphertext W send , Signature S send The data is returned to the requesting application module 1 through the network card driver module 2 so that the requesting end can access the local memory as required according to the allocated requesting end buffer.

[0074] According to an embodiment of the present invention, at the responding end, the encryption and decryption module 504 generates a key K of the responding end buffer for the registered responding end buffer. recv At the same time, the authority recording module 505 is used to record the unique identifier F corresponding to the response end buffer containing the response end buffer recv , virtual address V recv Length L recv , key K recv The permission verification information of the information forms a permission verification information table entry of the response end buffer < unique identifier F recv , virtual address V recv Length L recv , key K recv > Finally, according to the key K recv The physical address P of the generated response buffer recv Encrypt and obtain the physical address ciphertext W of the generated response end buffer recv , using the key K recv is the ciphertext W recv Generate signature S recv , the unique identifier F recv , virtual address V recv Length L recv , physical address ciphertext W recv , Signature S recv It is returned to the responding application module 1 through the network card driver module 2.

[0075] According to one embodiment of the present invention, after the request end and the responder end establish a connection, the application module 1 of the responder end registers and generates a unique identifier F corresponding to each responder end buffer. recv, virtual address V recv Length L recv , physical address ciphertext W recv , Signature S recv The application module 1 is sent to the requesting end through the network so that the requesting end can perform remote memory access as required based on the allocated responding end buffer.

[0076] According to one embodiment of the present invention, after a connection is established between a requesting end and a responding end, at the requesting end, a request processing module 501 is used for a remote memory access request to a specified buffer based on the requesting end, wherein the request includes a unique identifier, a virtual address, a length and a physical address of the specified buffer. The request processing module verifies whether the requesting end has access rights to the specified buffer according to the permission verification information recorded in the permission recording module, and obtains the physical address of the specified buffer obtained after decrypting the ciphertext of the physical address of the specified buffer to which the requesting end has access rights.

[0077] Specifically, the remote memory access request of the requesting end to the specified buffer includes a memory access request of the requesting end to the specified requesting end buffer, wherein the specified buffer is the specified requesting end buffer, and the request includes the physical address ciphertext W of the specified requesting end buffer. s-app , physical address signature S s-app , unique identifier F s-app , virtual address V s-app and length L s-app According to one embodiment of the present invention, the request processing module 501 is used to specify the unique identifier F of the request end buffer. s-app and the unique identifier F of the requester buffer in memory send Determine whether the specified request end buffer exists, the request processing module 501 verifies whether the request end has access rights to the specified request end buffer according to the permission verification information recorded in the permission recording module in the following manner, including: determining the virtual address V of the specified request end buffer s-app and the virtual address V of the requester buffer in memory send Whether they are equal, and determine the length L of the specified request end buffer s-app Is it less than or equal to the length L of the request side buffer in memory? send , when V s-app and V send are equal, and L s-app Less than or equal to L send When L s-app and V s-app After the verification is successful, the next step of access permission verification is performed based on the key in the permission verification information.

[0078] According to an embodiment of the present invention, the encryption and decryption module 504 is further configured to generate a key K corresponding to the authority verification information. send and the physical address ciphertext W of the specified request side buffer s-app and physical address signature S s-app Verify whether the requester has access rights to the specified requester buffer; the physical address ciphertext W of the specified requester buffer in the above request s-app , physical address signature S s-app , unique identifier F s-app , virtual address V s-app and length L s-app After all verifications are passed, the encryption and decryption module 504 ciphers the physical address W of the request buffer specified by the verified request end. s-app Decrypt and obtain the physical address P of the decrypted request buffer s-app The request of the request end of the present invention needs to be verified before the physical address ciphertext W of the request end buffer specified in the request can be used. s-app The physical address P of the specified request buffer after decryption s-app The request side buffer in the local memory is accessed to avoid the insecurity of accessing the system memory when the local system is maliciously invaded. In addition, the present invention directly accesses through the decrypted physical address, avoiding the performance impact caused by the missing of the corresponding conversion page table entry in the network card cache.

[0079] According to an embodiment of the present invention, the request side memory access module 503 is used to specify the request side buffer physical address P according to the request type of the remote memory access request. s-app , obtain the data to be sent, and generate a corresponding request data packet based on the data to be sent to the responding end.

[0080] According to one embodiment of the present invention, after a connection is established between a requesting end and a responding end, at the responding end, a response processing module 502 is used to verify whether the requesting end has access rights to the specified buffer based on a remote memory access request to the specified buffer by the requesting end according to the permission verification information recorded in the permission recording module, and obtains the physical address of the specified buffer obtained after decrypting the ciphertext of the physical address of the specified buffer to which the requesting end has access rights.

[0081] Specifically, the remote memory access request of the requesting end to the designated buffer includes the remote memory access request of the requesting end to the designated responding end buffer, wherein the designated buffer is the designated responding end buffer, and the request includes the physical address ciphertext W of the designated responding end buffer. r-app , physical address signature S r-app, unique identifier F r-app , virtual address V r-app and length L r-app According to one embodiment of the present invention, the response processing module 502 is used to specify the unique identifier F of the buffer of the response end. r-app and the unique identifier F of the responder buffer in memory recv Determine whether the designated response end buffer exists, the response processing module 502 verifies whether the request end has access rights to the designated response end buffer according to the permission verification information recorded in the permission recording module in the following manner, including: by comparing the virtual address V s-app and the virtual address V of the response buffer in memory recv Whether they are equal, and specify the length L of the response end buffer r-app Is it less than or equal to the length L of the response buffer in memory? recv , when V r-app and V recv are equal, and L r-app Less than or equal to L recv When L r-app and V r-app After the verification is passed, the next step of access permission verification is performed based on the key in the permission verification information.

[0082] According to an embodiment of the present invention, the encryption and decryption module 504 is further configured to generate a key K corresponding to the authority verification information. recv and the physical address ciphertext W of the specified response end buffer r-app and physical address signature S r-app Verify whether the requesting end has access rights to the specified responding end buffer; the physical address ciphertext W of the specified responding end buffer in the above request r-app , physical address signature S r-app , unique identifier F r-app , virtual address V r-app and length L r-app After all verifications are passed, the encryption and decryption module 504 ciphers the physical address W of the buffer of the response end specified by the verified request end. r-app Decrypt and obtain the physical address P of the decrypted specified response end buffer r-app The request of the request end of the present invention needs to be verified before the physical address ciphertext W of the buffer zone of the response end specified in the request can be used. r-app The physical address P of the specified request buffer after decryption r-appThe buffer in the remote memory is accessed to avoid the insecurity of accessing the system memory when the local system is maliciously invaded. In addition, the present invention directly accesses through the decrypted physical address, avoiding the performance impact caused by the missing of the corresponding conversion page table entry in the network card cache.

[0083] According to an embodiment of the present invention, the responder memory access module 503 is used to access the physical address P of the responder buffer according to the request type of the request data packet and the physical address P of the responder buffer. r-app Authorize the requester to specify the physical address P of the response buffer r-app The corresponding response end buffer is accessed.

[0084] According to one embodiment of the present invention, the encryption / decryption module 504 uses a predetermined encryption / decryption algorithm to encrypt the physical address or decrypt the physical address ciphertext, wherein the encryption / decryption algorithm is a reversible encryption / decryption algorithm such as the RSA encryption / decryption algorithm or the DES encryption / decryption algorithm, and the present invention is not limited to this.

[0085] According to one embodiment of the present invention, the data packet transceiver module 506 is used to obtain data to be sent according to a remote memory access request, and generate several data packets based on the data to be sent for sending; or receive data packets sent through the network when a remote memory access request is received.

[0086] According to an embodiment of the present invention, when a requesting end performs remote memory access, a remote memory access request method is provided based on a registered requesting end buffer and a responding end buffer, information of a requesting end buffer generated for a corresponding requesting end buffer in memory, permission verification information of a requesting end buffer, information of a responding end buffer generated for a corresponding responding end buffer in memory, and permission verification information of a responding end buffer, see Figure 2 , including steps A1, A2, A3 and A4, wherein the request processing module 501 is configured to execute steps A1, A2 and A3, and the memory access module 503 is configured to execute step A4, as follows.

[0087] Step A1: Obtain a remote memory access request initiated to a responder, wherein the request includes information of a specified requester buffer and information of a specified responseer buffer, the information of the specified requester buffer includes a physical address ciphertext, a unique identifier, a virtual address, and a length of the specified requester buffer, and the information of the specified responseer buffer includes a physical address ciphertext of the specified responseer buffer.

[0088] According to one embodiment of the present invention, the physical address ciphertext W of the request end buffer is specified. s-app , unique identifier F s-app , virtual address V s-app and length L s-appBased on the physical address ciphertext W corresponding to the request side buffer in the memory when registering the request side buffer area send , unique identifier F send , virtual address V send and length L send Directly obtain, in addition, specify the physical address ciphertext W of the response end buffer r-app The physical address ciphertext W corresponding to the responder buffer in the memory when the responder registers the responder buffer after the requester and the responder establish a connection. recv Directly obtain.

[0089] Step A2: Obtaining permission verification information, and verifying whether the requesting end has access rights to the specified requesting end buffer according to the permission verification information and the unique identifier, virtual address and length of the specified requesting end buffer.

[0090] According to one embodiment of the present invention, step A2 includes:

[0091] Step A21: Determine whether the request side buffer specified for access exists according to the unique identifier of the specified request side buffer.

[0092] According to an embodiment of the present invention, according to the unique identifier of the designated request end buffer, the permission verification information table entry of the corresponding request end buffer is read. If the corresponding table entry does not exist, it means that the designated request end buffer has not been registered, and the operation is terminated; if the table entry exists, the following steps are further performed.

[0093] Step A22: Based on the unique identifier of the specified request side buffer, obtain the permission verification information corresponding to the existing request side buffer, including the unique identifier, virtual address, and length of the request side buffer in the request side memory. send , virtual address V send Length L send , key K send >, where the table entries are the unique identifiers F corresponding to the requester buffer in the requester memory. send , virtual address V send Length L send , key K send .

[0094] Step A23: Determine whether the access permission is exceeded by comparing the virtual address of the specified request side buffer with the virtual address corresponding to the request side buffer in the memory, and comparing the length of the specified request side buffer with the length corresponding to the request side buffer in the memory.

[0095] According to one embodiment of the present invention, when the virtual address V of the designated request side buffer s-app Equal to the virtual address V corresponding to the request side buffer in memory send , and specify the length L of the requester buffer s-app Equal to or less than the length L of the request side buffer in memory send If the local memory access is legal, the corresponding operation will continue; otherwise, the memory access is out of bounds, an out-of-bounds access error is returned, and the operation is terminated. The information of the specified request side buffer also includes the physical address signature S of the specified request side buffer. s-app After determining that the local memory access is legal, the corresponding operation is: verifying the correctness of the physical address signature of the designated request side buffer by using the encryption and decryption module 504. s-app Based on the physical address signature S corresponding to the request side buffer in the memory when registering the request side buffer area send get.

[0096] According to one embodiment of the present invention, the correctness verification includes: send and the physical address ciphertext W of the specified request side buffer s-app , sign the physical address S of the specified request buffer s-app Perform correctness verification to determine whether it is a normal access. If the correctness verification fails, it means that the physical address ciphertext W of the request buffer is specified. s-app Invalid, the physical address of the current designated request side buffer has been tampered with, the operation is terminated, and the security of local memory access is enhanced; if the correctness verification passes, it means that the physical address of the designated request side buffer under the current request side is valid, and the encryption and decryption module 504 decrypts the physical address P of the request side buffer calculated according to the information of the designated request side buffer s-app Return to the request processing module 501 and continue to execute the following steps.

[0097] Step A3: For the authenticated requester, the physical address of the designated requester buffer is obtained by decrypting the ciphertext of the physical address of the designated requester buffer in the information of the designated requester buffer.

[0098] Step A4: according to the request type of the remote memory access request and the physical address of the buffer of the designated requesting end, the data to be sent is obtained, and a corresponding request data packet is generated based on the data to be sent and sent to the responding end.

[0099] According to an embodiment of the present invention, the request type of the remote memory access request includes a remote memory read data request and a remote memory write data request. Step A4 includes steps A41, A42 and A43, which are as follows:

[0100] Step A41: Obtain the length of the request side buffer specified in the remote memory access request;

[0101] According to one embodiment of the present invention, when the request type is a remote memory request to read data, the following step A42 is performed.

[0102] Step A42: According to the remote memory read data request, the physical address of the designated request side buffer and the length of the designated request side buffer, information of the designated request side buffer to be sent and information of the designated response side buffer are obtained.

[0103] According to one embodiment of the present invention, the request processing module 501 generates a request data packet for sending to the responder for remote memory reading data based on the information of the designated requester buffer to be sent and the information of the designated responseer buffer, and the request data packet includes the information of the designated requester buffer and the information of the designated responseer buffer. The data packet transceiver module 506 adds a network header to the request data packet according to the network protocol it supports, and sends the request data packet with the network header added to the responder.

[0104] According to one embodiment of the present invention, when the request type is a remote memory request to write data, the following step A43 is performed.

[0105] Step A43: Read the data in the request side buffer according to the remote memory write data request, the physical address of the designated request side buffer and the length of the designated request side buffer to obtain the data to be sent and the information of the designated response side buffer.

[0106] According to one embodiment of the present invention, after verification, the physical address P of the request side buffer obtained by decryption calculation is s-app It is the physical address P of the request side buffer registered by the network card driver module 2 send Memory access module 503 according to P s-app and specify the length L of the requester buffer s-app The data in the designated request end buffer is read from the application buffer 3 through the system bus module 4 to obtain the data to be sent and the information of the designated response end buffer.

[0107] According to one embodiment of the present invention, the request processing module 501 packets the read data to be sent based on the data to be sent and the information of the specified response end buffer, obtains multiple request data packets for sending to the response end for remote memory writing data, and each request data packet includes the information of the specified response end buffer, and sends the multiple request data packets to the data packet transceiver module 506.

[0108] According to an embodiment of the present invention, the data packet transceiver module 506 adds a network header to each request data packet according to the network protocol it supports, and sends the request data packet with the network header added to the responder.

[0109] According to an embodiment of the present invention, a remote memory access response method is provided. Figure 3 , including steps B1, B2, B3 and B4, wherein the response processing module 502 is configured to execute steps B1, B2 and B3, and the memory access module 503 is configured to execute step B4. The specific process is as follows.

[0110] Step B1: Obtain a request data packet sent by the requesting end through the network when requesting remote memory access, and extract information of a specified responding end buffer in the request data packet, wherein the information includes a physical address ciphertext, a unique identifier, a virtual address and a length of the specified responding end buffer.

[0111] According to one embodiment of the present invention, the physical address ciphertext W of the buffer of the designated response end is r-app , unique identifier F r-app , virtual address V r-app and length L r-app The physical address ciphertext W of the responder buffer in the memory corresponding to the registering responder buffer area by the requester based on the responder recv , unique identifier F recv , virtual address V recv and length L recv Directly obtain.

[0112] Step B2: Obtaining permission verification information, and verifying whether the requesting end has access rights to the designated response end buffer according to the permission verification information and the unique identifier, virtual address and length of the designated response end buffer.

[0113] According to one embodiment of the present invention, step B2 comprises:

[0114] Step B21: Determine whether the response end buffer designated for access exists according to the unique identifier of the designated response end buffer.

[0115] According to an embodiment of the present invention, according to the unique identifier of the designated response end buffer, the permission verification information table entry of the corresponding response end buffer is read. If the corresponding table entry does not exist, it means that the designated response end buffer has not been registered, and the operation is terminated; if the table entry exists, the following steps are further performed.

[0116] Step B22: Based on the unique identifier of the designated response end buffer, obtain the permission verification information corresponding to the existing response end buffer, including the unique identifier, virtual address, and length corresponding to the response end buffer in the response end memory. recv , virtual address V recv Length L recv , key K recv >, where the entries are the unique identifiers F corresponding to the responder buffer in the responder memory. recv , virtual address V recv Length L recv , key K recv .

[0117] Step B23: Determine whether the access permission is exceeded by comparing the virtual address of the designated response end buffer with the virtual address corresponding to the response end buffer in the memory, and comparing the length of the designated response end buffer with the length corresponding to the response end buffer in the memory.

[0118] According to one embodiment of the present invention, when the virtual address V of the buffer of the designated response end is r-app Equal to the virtual address V corresponding to the response end buffer in memory recv , and specify the length L of the response end buffer r-app Equal to or less than the length L of the response buffer in memory recv If the remote memory access is legal, the corresponding operation will continue; otherwise, the remote memory access is out of bounds, an out-of-bounds access error is returned, and the operation is terminated. The information of the specified response end buffer also includes the physical address signature S of the specified response end buffer. r-app After determining that the remote memory access is legal, the corresponding operation performed is: verifying the correctness of the physical address signature of the designated response end buffer by the encryption and decryption module 504. r-app Based on the physical address signature S corresponding to the responder buffer in the memory when registering the responder buffer recv Directly obtained, it can be regarded as the physical address signature S of the specified response end buffer r-app Sign S for the physical address corresponding to the response end buffer in memory recv .

[0119] According to one embodiment of the present invention, the correctness verification includes: recv and the physical address ciphertext W of the specified response end buffer r-app , sign the physical address S of the specified response end buffer r-appPerform correctness verification to determine whether it is a normal access. If the correctness verification fails, it indicates that the physical address ciphertext W of the specified response end buffer is r-app Invalid, the physical address of the current designated response end buffer has been tampered with, the operation is terminated, and the security of remote memory access is enhanced; if the correctness verification passes, it means that the physical address of the designated response end buffer requested by the current request end is valid, and the encryption and decryption module 504 decrypts the physical address P of the request end buffer calculated according to the information of the designated response end buffer r-app Return to the response processing module 502 and continue to execute the following steps.

[0120] Step B3: For the authenticated requesting end, the physical address of the designated response end buffer is obtained by decrypting the physical address ciphertext of the designated response end buffer in the request data packet sent by the requesting end.

[0121] Step B4: according to the request type of the request data packet and the physical address of the designated response end buffer, the request end is authorized to access the response end buffer corresponding to the physical address of the designated response end buffer.

[0122] According to an embodiment of the present invention, according to the request type of the request data packet being remote memory write data or remote memory read data, step B4 includes steps B41, B42 and B43. Specifically, as follows:

[0123] Step B41: Obtain the length of the response end buffer specified in the request data packet.

[0124] According to one embodiment of the present invention, when the request type is remote memory writing data, the following step B42 is executed.

[0125] Step B42: The memory access module 503 receives the physical address P of the buffer at the designated response end. r-app and specify the length L of the response end buffer r-app , remote memory write data is performed on the response end buffer, and the data in the request data packet is written into the designated response end buffer through the system bus module 4, and the remote memory write data operation is completed.

[0126] According to one embodiment of the present invention, when the request type is to read data from a remote memory, the request data packet includes information specifying a request side buffer, and the following step B43 is performed.

[0127] Step B43: Read the data in the response end buffer according to the request data packet for reading data from the remote memory, the physical address of the designated response end buffer, and the length of the designated response end buffer to obtain the data to be sent.

[0128] According to one embodiment of the present invention, a request packet for reading data from a remote memory includes information specifying a request side buffer, obtains data from a response side buffer, and generates multiple response packets based on the data to be sent for feedback to the request side, wherein the response packet includes the length L of the request side buffer. s-app and the physical address P of the specified request side buffer calculated by decrypting the information of the specified request side buffer s-app .

[0129] According to an embodiment of the present invention, the data packet transceiver module 506 adds a network header to the response data packet according to the protocol it supports, and sends the response data packet with the network header added to the request end. The request end receives the response data packet and obtains the physical address P of the buffer of the specified request end carried in the response data packet. s-app and length L s-app . Due to P s-app and L s-app The data in the response data packet has been verified during the request sending process, and the data in the response data packet will be directly written by the memory access module 503 to the physical address P of the buffer of the specified request end. s-app The remote read operation is completed in the specified request side buffer.

[0130] According to an embodiment of the present invention, a specific remote read and write operation process is given below in combination with the request end and the response end:

[0131] S1: The responder application module 1 allocates a responder buffer for network communication in the application buffer 3 in the memory, and the virtual address of the generated responder buffer is V recv , length L recv , continue to step S2.

[0132] S2: The responder network card driver module 2 registers the responder buffer and generates a unique identifier F for the responder buffer recv , and generates a physical address P for the responder buffer recv .

[0133] S3: The unique identifier F generated by the network card driver module 2 at the responding end recv , virtual address V recv Length L recv , physical address P recv The information is sent to the memory access module 503 through the system bus module 4 , and the memory access module 503 passes the information of the response end buffer generated above to the encryption and decryption module 504 .

[0134] S4: The response end encryption and decryption module 504 generates a key K according to the response end buffer recv , the physical address P is converted intorecv Encrypt and generate the physical address ciphertext W recv , and use the key K recv is the physical address ciphertext W recv Generate physical address signature S recv At the same time, the encryption and decryption module 504 generates a permission verification information table entry <F recv , V recv , L recv , K recv > and write to the permission record module 505, and the corresponding physical address ciphertext W of the response end buffer in the memory recv , physical address key K recv Return to the network card driver module 2.

[0135] S5: The responding end network card driver module 2 stores the unique identifier F corresponding to the responding end buffer in the memory recv , physical address ciphertext W recv and physical address signature S recv Return to the responding application module 1.

[0136] S6: The corresponding module of the requesting end also executes steps S2 to S5, registers the requesting end buffer, and generates a unique identifier F of the requesting end buffer for the requesting end buffer in the memory. send , virtual address V send Length L send , physical address ciphertext W send , physical address signature S send and key K send At the same time, a permission verification information table item is generated <F send , V send , L send , K send >Write to the permission recording module 505 and write the encrypted physical address ciphertext W send , physical address key K send Return to the network card driver module 2.

[0137] S7: The network card driver module 2 of the requesting end stores the unique identifier F corresponding to the requesting end buffer in the memory send , physical address ciphertext W send and physical address signature S send Return to the requesting application module 1.

[0138] S8: After the requester and the responder establish a connection, the responder application module 1 stores the unique identifier F corresponding to the responder buffer in the memory. recv , virtual address V recv Length L recv , physical address ciphertext Wrecv and physical address signature S recv Sent to the requesting application module 1 through the network.

[0139] S9: The requesting end initiates a remote memory access request and sends the request to the requesting end network interface device 5. The request includes a unique identifier F of the designated requesting end buffer requested by the application module 1. s-app , virtual address V s-app Length L s-app , physical address ciphertext W s-app and physical address signature S s-app , and the unique identifier F of the request's specified response buffer r-app , virtual address V r-app and length L r-app , physical address ciphertext W r-app and physical address signature S r-app .

[0140] S10: The request processing module 501 at the request end first checks whether the access rights of the request end buffer are legal. s-app The unique identifier F corresponding to the request side buffer in memory send , read the permission verification information table entry stored in the permission recording module 505 <F send , V send , L send , K send >. If the unique identifier F send If the corresponding entry does not exist, it means that the request side buffer has not been registered, and the operation is terminated; if the entry exists, determine whether the access to the virtual address area is legal. send Equal to the virtual address V of the specified request side buffer s-app And specify the length L of the request side buffer s-app Equal to or less than the length L of the requester buffer in memory during registration send If the access is legal, the step S11 is continued; otherwise, the access is out of bounds, an access out of bounds error is returned to the application module 1, and the operation is terminated.

[0141] S11: The request processing module 501 of the request end specifies the physical address ciphertext W of the request end buffer. s-app , physical address signature S s-app , the key K of the corresponding request buffer generated during registration send The encryption module 504 sends the encrypted data to the encryption module 504, which uses the key K according to the predetermined encryption algorithm. send and the ciphertext W s-appSignature S s-app If the verification is successful, it means that the physical address of the designated request end buffer sent by the current request end is valid, and the encryption and decryption module 504 will decrypt the calculated physical address P of the designated request end buffer s-app Return to the request processing module 501 and continue to execute step S12; if the verification fails, it means that the information of the current designated request end buffer has been tampered with, for example, the physical address ciphertext of its designated response end buffer has been tampered with, and the memory access is unsafe, so the operation is terminated.

[0142] S12: If the current request of the requesting end is a write data request, continue to execute step S13; if the current request is a read data request, continue to execute step S15;

[0143] S13: The request processing module 501 of the requesting end reads the data of the application buffer 3 of the requesting end: since it has passed the verification, the physical address P of the designated requesting end buffer after decryption s-app It is the physical address P of the request side buffer generated during registration send The memory access module 503 specifies the physical address P of the request end buffer. s-app and length L s-app Reading data from the application buffer 3 via the system bus module 4;

[0144] S14: The request processing module 501 of the request end packets the read data. The request type of each request data packet is a remote memory write data request. Each request data packet will carry a unique identifier F of the designated response end buffer. r-app , virtual address V r-app Length L r-app , physical address signature S r-app , physical address ciphertext W r-app and a piece of data read from the application buffer 3. The request processing module 501 sends the request data packet to the data packet transceiver module 506. The process continues with step S16.

[0145] S15: The request processing module 501 of the request end generates a request data packet. The request type of the request data packet is a remote memory read data request. The request data packet includes a unique identifier F of the request end buffer. s-app , virtual address V s-app Length L s-app , physical address signature S s-app and the physical address ciphertext W s-app ; At the same time, the request data packet also includes a unique identifier F that specifies the response end buffer r-app , virtual address V r-app Length Lr-app , physical address signature S r-app , physical address ciphertext W r-app The request processing module 501 sends the request data packet to the data packet transceiving module 506. The process continues with step S16.

[0146] S16: The requesting end data packet transceiver module 506 adds a network packet header to the corresponding request data packet according to the network protocol it supports, and sends the request data packet to the responding end. Then, step S17 is executed.

[0147] S17: After receiving the corresponding request data packet through the data packet transceiver module 506, the response processing module 502 of the responding end network interface device 5 extracts the unique identifier F of the designated responding end buffer in the request data packet. r-app , virtual address V r-app Length L r-app , physical address signature S r-app , physical address ciphertext W r-app , and according to the unique identifier F of the specified response end buffer r-app Search in the permission record table. If the search fails, it means that the accessed response end buffer does not exist and the operation is terminated. If the search succeeds, obtain the permission verification information table item corresponding to the specified response end buffer. <F recv , K recv , V recv , L recv >.

[0148] S18: The response processing module 502 of the responding end performs an access rights check. r-app Equal to the virtual address V corresponding to the response end buffer in memory recv And specify the length L of the response end buffer r-app Equal to or less than the length L of the response buffer in memory recv If the access permission check passes, the following step S19 is continued; otherwise, the access is out of bounds, the permission check fails, an access out of bounds error is returned, and the operation is terminated.

[0149] S19: The responder response processing module 502 stores the key K corresponding to the responder buffer in the memory recv , specify the physical address signature S of the response end buffer r-app and the physical address ciphertext W r-app Passed to the encryption and decryption module for verification. The encryption and decryption module uses the key K recv and the physical address ciphertext W r-app Sign the physical address S r-appIf the verification fails, it means that the information in the designated response end buffer has been tampered with, for example, the physical address ciphertext of the designated response end buffer has been tampered with, and the operation is terminated; if the verification passes, the encryption and decryption module performs tampering on the physical address ciphertext W of the designated response end buffer. r-app Decrypt and obtain the physical address P of the designated response end buffer after decryption r-app , and the physical address P r-app Return to the response processing module 502. Continue to execute step S20.

[0150] S20. If the request type of the request data packet received by the responding end is a remote memory write data request, execute step S21; if it is a remote memory read data request, execute step S22.

[0151] S21: The responder memory access module 503 receives the physical address P of the designated responder buffer. r-app and length L r-app The data in the request data packet is written into the response end buffer corresponding to the physical address of the designated response end buffer through the system bus module 4, and the remote write operation is completed.

[0152] S22: The responder memory access module 503 receives the physical address P of the designated responder buffer. r-app and length L r-app Data is read from the memory via the system bus module 4 , and the read data is passed to the response processing module 502 .

[0153] S23: The response processing module 502 at the responding end splits the data to generate multiple response data packets, each of which includes the physical address P of the designated requesting end buffer calculated by decryption. s-app , specify the request side buffer L s-app , the response processing module 502 passes the response data packet to the data packet transceiver module 506 .

[0154] S24. The data packet transceiver module 506 adds a network packet header to the response data packet according to the protocol it supports, and sends the response data packet to the requesting end.

[0155] S25. The requesting end receives the response data packet and obtains the physical address P of the buffer of the specified requesting end included in the response data packet. s-app , specify the request side buffer L s-app Since the physical address P of the request side buffer is specified s-app , specify the request side buffer L s-app The data in the response data packet has been verified during the request sending process, and the data in the response data packet will be directly written by the memory access module 503 to the physical address P of the buffer of the specified request end. s-appThe remote read operation is completed in the corresponding request side buffer.

[0156] It should be noted that although the above describes the various steps in a specific order, it does not mean that the various steps must be executed in the above specific order. In fact, some of these steps can be executed concurrently or even in a different order as long as the required functions can be achieved.

[0157] The present invention may be a system, a method and / or a computer program product. The computer program product may include a computer-readable storage medium carrying computer-readable program instructions for causing a processor to implement various aspects of the present invention.

[0158] Computer readable storage medium can be a tangible device that holds and stores instructions used by an instruction execution device. Computer readable storage medium can include, for example, but is not limited to, an electrical storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination thereof. More specific examples (non-exhaustive list) of computer readable storage medium include: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a static random access memory (SRAM), a portable compact disk read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanical encoding device, for example, a punch card or a protruding structure in a groove on which instructions are stored, and any suitable combination thereof.

[0159] The embodiments of the present invention have been described above, and the above description is exemplary, not exhaustive, and is not limited to the disclosed embodiments. Many modifications and variations will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the described embodiments. The selection of terms used herein is intended to best explain the principles of the embodiments, practical applications, or technical improvements in the market, or to enable other persons of ordinary skill in the art to understand the embodiments disclosed herein.

Claims

1. A remote memory access system, comprising a network interface device, one or more CPUs and a memory corresponding to each CPU, wherein the network interface device is connected to the CPU via a system bus, and the memory includes a buffer, characterized in that: The network interface device comprises: An encryption and decryption module, used to obtain buffer information, wherein the buffer information includes at least a unique identifier, a virtual address, a length, and a physical address of the buffer, and the encryption and decryption module generates a corresponding key for each buffer, encrypts the physical address of the buffer based on the key, and generates a ciphertext of the physical address of the buffer; The permission recording module is used to record the permission verification information corresponding to each buffer, including the unique identifier, virtual address, length and key information of the buffer; A response processing module, for verifying whether the requesting end has access rights to the specified buffer based on a remote memory access request to the specified buffer by the requesting end, wherein the request includes a unique identifier, a virtual address, a length, and a physical address of the specified buffer. The response processing module verifies whether the requesting end has access rights to the specified buffer according to the permission verification information recorded in the permission recording module, and obtains the physical address of the specified buffer obtained by decrypting the ciphertext of the physical address of the specified buffer to which the requesting end has access rights; The memory access module is used to authorize the request end to access the buffer corresponding to the physical address according to the physical address of the designated buffer.

2. The system according to claim 1, characterized in that The network interface device also includes: A request processing module is used to make a remote memory access request to a specified buffer based on the request end, wherein the request includes a unique identifier, virtual address, length and physical address of the specified buffer. The request processing module verifies whether the request end has access rights to the specified buffer according to the permission verification information recorded in the permission recording module, and obtains the physical address of the specified buffer obtained by decrypting the ciphertext of the physical address of the specified buffer to which the request end has access rights.

3. The system according to claim 1, characterized in that The response processing module is used to determine whether the specified buffer exists according to the unique identifier of the specified buffer and the unique identifier of the buffer in the memory, and the response processing module verifies whether the requesting end has access rights to the specified buffer according to the permission verification information recorded in the permission recording module in the following manner, including: Access permission verification is performed by determining whether the virtual address of the specified buffer is equal to the virtual address of the buffer in memory, and determining whether the length of the specified buffer is less than or equal to the length of the buffer in memory.

4. The system according to claim 2, characterized in that The request processing module is used to determine whether the specified buffer exists according to the unique identifier of the specified buffer and the unique identifier of the buffer in the memory, and the request processing module verifies whether the requesting end has access rights to the specified buffer according to the permission verification information recorded in the permission recording module in the following manner, including: Access permission verification is performed by determining whether the virtual address of the specified buffer is equal to the virtual address of the buffer in memory, and determining whether the length of the specified buffer is less than or equal to the length of the buffer in memory.

5. The system according to claim 3 or 4, characterized in that: The request includes a physical address ciphertext and a physical address signature of the specified buffer; The encryption and decryption module is further used to verify whether the requesting end has access rights to the specified buffer according to the key in the recorded permission verification information and the physical address ciphertext and physical address signature of the specified buffer; and The physical address ciphertext of the specified buffer to which the requesting end has access rights is decrypted to obtain the decrypted physical address of the specified buffer.

6. The system according to claim 1, characterized in that The encryption and decryption module is also used to encrypt the physical address of the buffer or decrypt the physical address ciphertext of the specified buffer using a predetermined encryption and decryption algorithm, wherein the encryption and decryption algorithm is an RSA encryption and decryption algorithm or a DES encryption and decryption algorithm.

7. The system according to claim 1, characterized in that The memory access module accesses the buffer corresponding to the physical address in the following manner, including: Obtaining the data to be sent according to the request type of the remote memory access request and the physical address and length of the specified buffer, and sending the data to the responding end; or According to the request type of the remote memory access request and the physical address and length of the specified buffer, the data to be sent is obtained and sent to the requesting end.

8. The system according to claim 1, characterized in that The network interface device also includes a data packet transceiver module, which is configured to: According to the remote memory access request, the data to be sent in the buffer corresponding to the physical address is obtained, and a number of data packets are generated based on the data to be sent for sending; Or a packet sent over the network when receiving a remote memory access request.

9. The system according to claim 1, characterized in that The CPU is configured with: The application module is used to allocate a corresponding buffer in the memory according to the data to be sent or the data to be received in the remote memory access request, and generate a virtual address and length of the buffer; The network card driver module is used to generate a unique identifier and a corresponding physical address of the buffer based on the allocated buffer.

10. A remote memory access response method, characterized in that: include: Step B1: obtaining a request data packet sent by the requesting end through the network when requesting remote memory access, and extracting information of a designated responding end buffer in the request data packet, wherein the information includes a physical address ciphertext, a unique identifier, a virtual address, and a length of the designated responding end buffer; Step B2: obtaining permission verification information, and verifying whether the requesting end has access rights to the designated response end buffer according to the permission verification information and the unique identifier, virtual address and length of the designated response end buffer; Step B3: For the authenticated requesting end, obtain the physical address of the designated response end buffer obtained by decrypting the physical address ciphertext of the designated response end buffer in the request data packet sent by the authenticated requesting end; Step B4: according to the request type of the request data packet and the physical address of the designated responder buffer, the requester is authorized to access the responder buffer corresponding to the physical address of the responder buffer.

11. The method according to claim 10, characterized in that The step B2 comprises: Determine whether a response end buffer for a specified access exists according to a unique identifier of the specified response end buffer; Based on the unique identifier of the specified response end buffer, obtain the permission verification information corresponding to the existing response end buffer, including the unique identifier, virtual address and length corresponding to the response end buffer in the response end memory; By comparing the virtual address of the specified response end buffer with the virtual address corresponding to the response end buffer in the memory, and comparing the length of the specified response end buffer with the length corresponding to the response end buffer in the memory, it is determined whether the access permission is exceeded.

12. The method according to claim 10, characterized in that The information of the designated response end buffer also includes a physical address signature of the designated response end buffer, the permission verification information also includes a key corresponding to the response end buffer in the response end memory, and the verification of whether the request end has access rights to the designated response end buffer also includes: The correctness of the physical address signature of the specified response end buffer is verified according to the key of the response end buffer in the memory and the physical address ciphertext of the specified response end buffer to determine whether it is a normal access.

13. The method according to claim 10, characterized in that The step B4 comprises: Obtain the length of the buffer of the specified response end in the request data packet, wherein the request type of the request data packet is remote memory write data or remote memory read data; Writing data to the remote memory of the response end buffer according to a request data packet for writing data to the remote memory, a physical address of a designated response end buffer, and a length of a designated response end buffer; According to the request data packet for reading data from the remote memory, the physical address of the designated response end buffer and the length of the designated response end buffer, the corresponding data in the response end buffer is read to obtain the data to be sent.

14. The method according to claim 13, characterized in that The request data packet for reading data from the remote memory includes information specifying a request side buffer, and the access to the response side buffer further includes: The data to be sent is obtained, and multiple response data packets are generated based on the data to be sent for feedback to the request end, wherein the response data packet includes the length of the specified request end buffer and the physical address of the specified request end buffer calculated by decrypting the information of the specified request end buffer.

15. The method according to any one of claims 10 to 14, characterized in that: Also includes: Based on the connection established between the responder and the requester, and according to the amount of data received or sent, a responder buffer is allocated in the memory of the responder and information corresponding to the responder buffer is generated for the responder buffer in the memory, wherein the information includes a unique identifier, a virtual address, a length, and a physical address corresponding to the responder buffer in the memory.

16. The method according to claim 15, characterized in that The information for generating the corresponding response end buffer also includes a key of the response end buffer generated by the response end for the response end buffer in the memory; Based on the key, unique identifier, virtual address and length corresponding to the response end buffer in the memory, obtain the permission verification information corresponding to the response end buffer; The ciphertext of the designated response end buffer is obtained by encrypting the physical address corresponding to the response end buffer in the memory based on the key corresponding to the response end buffer in the memory; The physical address signature of the designated response end buffer is obtained based on the key corresponding to the response end buffer in the memory and the physical address ciphertext of the response end buffer in the memory.

17. A remote memory access request method, characterized in that: include: Step A1: obtaining a remote memory access request initiated to a responder, wherein the request includes information of a designated requester buffer and information of a designated responder buffer, the information of the designated requester buffer includes a physical address ciphertext, a unique identifier, a virtual address, and a length of the designated requester buffer, and the information of the designated responder buffer includes a physical address ciphertext of the designated responder buffer; Step A2: obtaining permission verification information, and verifying whether the requesting end has access rights to the specified requesting end buffer according to the permission verification information and the unique identifier, virtual address and length of the specified requesting end buffer; Step A3: for the authenticated requester, obtaining the physical address of the designated requester buffer obtained by decrypting the ciphertext of the physical address of the designated requester buffer in the information of the designated requester buffer; Step A4: according to the request type of the remote memory access request and the physical address of the buffer of the designated requesting end, the data to be sent is obtained, and a corresponding request data packet is generated based on the data to be sent and sent to the responding end.

18. The method according to claim 17, characterized in that The step A2 comprises: Determine whether a request side buffer for a specified access exists according to a unique identifier of the request side buffer; Based on the unique identifier of the specified request side buffer, obtaining the permission verification information corresponding to the existing request side buffer, including the unique identifier, virtual address and length corresponding to the request side buffer in the request side memory; By comparing the virtual address of the specified request side buffer with the virtual address corresponding to the request side buffer in the memory, and comparing the length of the specified request side buffer with the length corresponding to the request side buffer in the memory, it is determined whether the access permission is exceeded.

19. The method according to claim 17, characterized in that The information of the designated requester buffer also includes a physical address signature of the designated requester buffer, the permission verification information also includes a key corresponding to the requester buffer in the requester memory, and the verification of whether the requester has access rights to the designated requester buffer also includes: According to the key of the request side buffer in the memory and the physical address ciphertext of the specified request side buffer, the correctness of the physical address signature of the specified request side buffer is verified to determine whether it is a normal access.

20. The method according to claim 17, characterized in that The request types of the remote memory access request include a remote memory read data request and a remote memory write data request, and the step A4 includes: Get the length of the request side buffer specified in the remote memory access request; According to the remote memory write data request, the physical address of the designated request end buffer and the length of the designated request end buffer, the data of the corresponding buffer of the request end is read to obtain the data to be sent and the information of the designated response end buffer; According to the remote memory read data request, the physical address of the designated request side buffer and the length of the designated request side buffer, information of the designated request side buffer to be sent and information of the designated response side buffer are obtained.

21. The method according to claim 17, characterized in that Generating a corresponding request data packet based on the data to be sent includes: Based on the data to be sent and the information of the designated response end buffer, generate a plurality of request data packets for sending to the response end to perform remote memory write data; or Based on the information of the designated request end buffer to be sent and the information of the designated response end buffer, a request data packet for sending to the response end to perform remote memory read data is generated.

22. The method according to any one of claims 17 to 21, characterized in that: Also includes: Based on the connection established between the responder and the requester, a requester buffer is allocated in the memory according to the amount of data to be sent or received, and information corresponding to the requester buffer in the memory is generated, wherein the information includes a unique identifier, a virtual address, a length, and a physical address corresponding to the requester buffer in the memory.

23. The method according to claim 22, characterized in that The information of the generated request side buffer includes a key of the request side buffer generated by the request side for the request side buffer in the memory; Based on the key, unique identifier, virtual address and length corresponding to the request side buffer in the memory, obtain the permission verification information corresponding to the request side buffer; The physical address ciphertext of the designated request side buffer is obtained by encrypting the physical address corresponding to the request side buffer in the memory based on the key corresponding to the request side buffer in the memory; The physical address signature of the specified request side buffer is obtained based on the key corresponding to the request side buffer in the memory and the physical address ciphertext corresponding to the request side buffer in the memory.

24. A computer-readable storage medium, characterized in that: A computer program is stored thereon, which can be executed by a processor to implement the steps of the method in any one of claims 10 to 16 and claims 17 to 23.

25. An electronic device, characterized in that: include: one or more processors; as well as A memory, wherein the memory is used to store executable instructions; The one or more processors are configured to implement the steps of the method of any one of claims 10 to 16 and claims 17 to 23 by executing the executable instructions.

Images