A direct storage access method, apparatus, and related equipment

Abstract

This application provides a direct storage access method, apparatus, and related devices. The method is applied to an external pass-through device. Upon receiving a direct storage access command from an Encryption Virtual Machine (VM) indicating at least the need to read encrypted memory data from memory, the method responds to the direct storage access command by transmitting a direct storage access request to an Input / Output Memory Management Unit (I / O Memory Unit). This allows the memory controller to receive the direct storage access request and decrypt the encrypted memory data based on the VM key of the VM. The plaintext of the encrypted memory data is then transmitted from the I / O Memory Management Unit to the external pass-through device. The method also receives the plaintext of the encrypted memory data transmitted from the I / O Memory Management Unit, encrypts the plaintext based on a pre-configured VM key, and stores the corresponding ciphertext data. This application embodiment can improve data security.

Description

Technical Field

[0001] This application relates to the field of computer technology, specifically to a direct memory access method, apparatus, and related devices. Background Technology

[0002] With the development of cloud technology, most service programs run within virtual machines in the cloud. As virtual machines themselves serve as carriers of user data, their data security is receiving increasing attention. To protect virtual machine data in physical memory, secure virtualization technology can be used to encrypt the data, storing the encrypted virtual machine data in physical memory. Because the virtual machine data in physical memory is encrypted, even when the Virtual Machine Monitor (VMM) reads virtual machine data from physical memory, it can only access the encrypted virtual machine data.

[0003] However, when data is passed between an external pass-through device and an encrypted virtual machine in a pass-through manner, the virtual machine data in physical memory must be transmitted to the external pass-through device in plaintext for storage, and the plaintext data stored on the external pass-through device may be leaked.

[0004] Therefore, how to improve the security of virtual machine data stored on external pass-through devices has become a technical problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0005] In view of this, embodiments of this application provide a direct storage access method, apparatus, and related devices to store virtual machine data in encrypted form in an external pass-through device, thereby improving data security.

[0006] To achieve the above objectives, the embodiments of this application provide the following technical solutions.

[0007] In a first aspect, embodiments of this application provide a direct storage access method applied to an external pass-through device, the method comprising:

[0008] Receive a direct storage access command for an encrypted virtual machine, the direct storage access command indicating at least that the encrypted memory data to be accessed should be read from memory;

[0009] In response to the direct memory access command, a direct memory access request is transmitted to the input / output memory management unit, so that the memory controller receives the direct memory access request transmitted by the input / output memory management unit, and decrypts the encrypted memory data to be accessed based on the virtual machine key of the encrypted virtual machine, and transmits the plaintext corresponding to the encrypted memory data to be accessed by the input / output memory management unit to the external pass-through device.

[0010] The system receives the plaintext of the encrypted memory data to be accessed transmitted by the input / output memory management unit, encrypts the plaintext of the encrypted memory data to be accessed based on a pre-configured virtual machine key, and stores the corresponding ciphertext data.

[0011] Secondly, embodiments of this application provide a direct memory access method applied to a memory controller, the method comprising:

[0012] The system acquires a direct storage access request from an external pass-through device transmitted by the input / output memory management unit. The direct storage access request corresponds to a direct storage access command that reads the encrypted memory data to be accessed from memory.

[0013] Based on the direct storage access request, the encrypted memory data to be accessed is read, and the encrypted memory data to be accessed is decrypted based on the virtual machine key of the encrypted virtual machine.

[0014] The plaintext corresponding to the memory encryption data to be accessed is transmitted to the input / output memory management unit, so that the external pass-through device receives the plaintext of the memory encryption data to be accessed transmitted by the input / output memory management unit, encrypts the plaintext of the memory encryption data to be accessed based on a pre-configured virtual machine key, and stores the corresponding ciphertext data.

[0015] Thirdly, embodiments of this application provide a direct storage access method applied to an external pass-through device, the method comprising:

[0016] Receive a direct storage access command from an encrypted virtual machine, the direct storage access command indicating at least that the encrypted data to be accessed should be written into memory;

[0017] In response to the direct storage access command, the encrypted data to be accessed is read, and the encrypted data to be accessed is decrypted based on the pre-configured virtual machine key;

[0018] The plaintext corresponding to the encrypted data to be accessed is transmitted to the input / output memory management unit, so that the memory controller receives the plaintext of the encrypted data to be accessed transmitted by the input / output memory management unit, encrypts the plaintext of the encrypted data to be accessed based on the virtual machine key of the encrypted virtual machine, and writes the corresponding ciphertext data into memory.

[0019] Fourthly, embodiments of this application provide a direct memory access method applied to a memory controller, the method comprising:

[0020] The system acquires a direct storage access request from an external pass-through device transmitted by the input / output memory management unit. The direct storage access request corresponds to a direct storage access command that writes plaintext of the encrypted data to be accessed into memory.

[0021] Based on the direct storage access request, the plaintext of the encrypted data to be accessed is encrypted using the virtual machine key of the encrypted virtual machine, and the corresponding ciphertext data is written into memory.

[0022] Fifthly, embodiments of this application provide a direct storage access device applied to an external pass-through device, the device comprising:

[0023] The command receiving module is used to receive direct storage access commands from the encrypted virtual machine, wherein the direct storage access commands at least indicate that the encrypted memory data to be accessed should be read from memory;

[0024] The response module is used to respond to the direct memory access command by transmitting a direct memory access request to the input / output memory management unit, so that the memory controller receives the direct memory access request transmitted by the input / output memory management unit, decrypts the encrypted memory data to be accessed based on the virtual machine key of the encrypted virtual machine, and transmits the plaintext corresponding to the encrypted memory data to be accessed by the input / output memory management unit to the external pass-through device.

[0025] Encryption and decryption hardware is used to receive the plaintext of the encrypted memory data to be accessed transmitted by the input / output memory management unit, encrypt the plaintext of the encrypted memory data to be accessed based on a pre-configured virtual machine key, and store the corresponding ciphertext data.

[0026] Sixthly, embodiments of this application provide a direct memory access device applied to a memory controller, the device comprising:

[0027] The request acquisition module is used to acquire the direct storage access request of the external pass-through device transmitted by the input / output memory management unit. The direct storage access request corresponds to the direct storage access command for reading the encrypted memory data to be accessed in memory.

[0028] The memory encryption / decryption hardware is used to read the encrypted memory data to be accessed according to the direct storage access request, and to decrypt the encrypted memory data to be accessed based on the virtual machine key of the encrypted virtual machine.

[0029] The transmission module is used to transmit plaintext corresponding to the memory encryption data to be accessed to the input / output memory management unit, so that the external pass-through device receives the plaintext of the memory encryption data to be accessed transmitted by the input / output memory management unit, encrypts the plaintext of the memory encryption data to be accessed based on a pre-configured virtual machine key, and stores the corresponding ciphertext data.

[0030] In a seventh aspect, embodiments of this application also provide a computer device, including the direct storage access device as described in the fifth aspect and / or the sixth aspect above.

[0031] Eighthly, embodiments of this application also provide a storage medium storing one or more computer-executable instructions, wherein when the one or more computer-executable instructions are executed, the direct storage access method as described in the first aspect or the second aspect above, or the direct storage access method as described in the third aspect or the fourth aspect above, is implemented.

[0032] The direct storage access method provided in this application embodiment is applied to an external passthrough device. When receiving a direct storage access command from an encrypted virtual machine, the direct storage access command at least indicates reading the encrypted memory data to be accessed from memory. In response to the direct storage access command, a direct storage access request is transmitted to an input / output memory management unit, so that the memory controller receives the direct storage access request transmitted by the input / output memory management unit and decrypts the encrypted memory data to be accessed based on the virtual machine key of the encrypted virtual machine. The plaintext corresponding to the encrypted memory data to be accessed is transmitted by the input / output memory management unit to the external passthrough device, and then the plaintext of the encrypted memory data to be accessed transmitted by the input / output memory management unit is received. The plaintext of the encrypted memory data to be accessed is encrypted based on a pre-configured virtual machine key, and the corresponding ciphertext data is stored.

[0033] As can be seen, the direct storage access method provided in this application can encrypt the plaintext data based on a pre-configured virtual machine key after receiving the plaintext of the encrypted memory data to be accessed by the encrypted virtual machine transmitted by the input / output memory management unit, so that the virtual machine data stored in the external pass-through device is in ciphertext form, thereby improving data security. Attached Figure Description

[0034] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of this application. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0035] Figure 1 Virtualization technology architecture for cloud service scenarios.

[0036] Figure 2 This is a schematic diagram of an optional passthrough process between an encrypted virtual machine and an external passthrough device.

[0037] Figure 3 This is an optional passthrough architecture diagram of an encrypted virtual machine and an external passthrough device provided in an embodiment of this application.

[0038] Figure 4 An optional flowchart of the direct storage access method provided in the embodiments of this application.

[0039] Figure 5 An optional flowchart for configuring encryption / decryption hardware keys for a security processor in an initial state, as provided in an embodiment of this application.

[0040] Figure 6 An optional flowchart for configuring encryption / decryption hardware keys for a security processor in runtime, as provided in an embodiment of this application.

[0041] Figure 7 Another optional flowchart for direct storage access provided in the embodiments of this application.

[0042] Figure 8 An optional block diagram of a direct storage access device provided in an embodiment of this application.

[0043] Figure 9 Another optional block diagram of the direct storage access device provided in the embodiments of this application.

[0044] Figure 10 An optional block diagram of a computer device provided in an embodiment of this application. Detailed Implementation

[0045] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0046] With the development of cloud services, virtualization technology has been increasingly widely used in cloud service scenarios. Virtualization technology allows users to deploy their business systems as virtual machines on cloud hosts, thereby reducing their operating costs.

[0047] To prevent the host operating system of a cloud server from accessing the memory data in a virtual machine and to ensure the security of cloud computing for users, refer to... Figure 1 The virtualization architecture of the cloud service scenario shown allows virtual machine memory data to be encrypted before storage. The virtual machine (VM) runs on the host operating system (OS) and the virtual machine monitor (VMM), and the corresponding memory data can be encrypted and decrypted using an encryption engine (such as the SM4 standard block cipher engine) and then stored in the cloud host's DRAM.

[0048] To further ensure the independence of data between virtual machines, the encryption and decryption keys of each virtual machine can be bound to its virtual machine ID. The virtual machine ID identifies the virtual machine, and different virtual machines have different virtual machine IDs. Figure 1 For example, the virtual machine with ID=1 has key 1, the virtual machine with ID=2 has key 2, and so on, the virtual machine with ID=n has key n.

[0049] Specifically, during the operation of the virtual machine, the hardware identifies the code and data corresponding to the virtual machine based on the virtual machine ID. In the process of encrypting and decrypting memory data, the encryption engine determines the virtual machine key based on the virtual machine ID and further encrypts and decrypts the memory data based on the key.

[0050] In cloud servers, not all virtual machines perform memory data encryption and decryption, nor does all memory data undergo encryption and decryption processes. For ease of explanation, in this embodiment, the virtual machine allocated with a key is referred to as an encrypted virtual machine; and the memory storing encrypted memory data is referred to as encrypted memory. It should be noted that the virtual machine generated using the national standard encryption secure virtualization technology is a CSV VM, where CSV stands for China Secure Virtualization, a national standard secure virtualization technology.

[0051] To improve system efficiency and reduce CPU (Central Processing Unit) load, DMA (Direct Memory Access) devices can be deployed on cloud hosts to enable direct data exchange between the CPU and physical memory. An external pass-through device can be understood as a device capable of DMA functionality. Accordingly, in this embodiment, such a device is a disk controller, which allows virtual machine data to be stored on a disk device, achieving persistent storage of virtual machine data. Taking a disk controller as an example of an external pass-through device, refer to... Figure 2 The diagram illustrates an optional passthrough process between the encrypted virtual machine and an external passthrough device.

[0052] In this context, SOC can be understood as a chip equipped with a CPU. In addition to the CPU, this chip can also have hardware structures that assist the CPU in its operation, such as a memory controller, a disk controller, and a virtual machine monitor.

[0053] When the encrypted virtual machine reads memory data, the memory controller can simultaneously receive the virtual machine ID and the source memory physical address. It can then use the virtual machine ID as an index to query the encryption / decryption engine for the virtual machine key, read the encrypted data from the source memory physical address, decrypt it, and pass it to the CPU.

[0054] When the disk controller performs DMA data interaction with the virtual machine data stored in memory by the encrypted virtual machine, the DMA request received by the memory controller from the disk controller only contains the physical memory address and not the virtual machine ID. Therefore, the memory controller can only pass the ciphertext from memory to the disk controller. Consequently, the disk controller can only obtain and save the ciphertext of the encrypted virtual machine. When the encrypted virtual machine restarts, the encryption key for the virtual machine corresponding to the memory controller is randomly generated again, making the ciphertext of the virtual machine data stored on the disk undecryptable and thus rendering it garbage data. To address this, shared memory is set up in memory for the virtual machine data of the encrypted virtual machine. The data in the shared memory is stored in plaintext, and the process of storing the encrypted memory data of the encrypted virtual machine to the disk is completed with the assistance of the VMM, allowing both the VMM and the encrypted virtual machine to read the plaintext virtual machine data in the shared memory.

[0055] like Figure 2As shown, when the encrypted virtual machine needs to write data to the disk, the encrypted virtual machine can execute step S1, decrypt the encrypted virtual machine data stored in memory, and copy the obtained virtual machine data plaintext to shared memory for storage; then execute step S2, the encrypted virtual machine requests the VMM to store the virtual machine data plaintext to the disk and exit the virtual machine; step S3, the VMM controls the disk controller to initiate a DMA request; step S4, the disk controller sends a DMA request to the memory controller so that the memory controller transfers the virtual machine data plaintext in shared memory to the disk and saves it.

[0056] However, in Figure 2 In the passthrough process between the encrypted virtual machine and the disk controller, the external passthrough device and the encrypted virtual machine must pass through the VMM to access the plaintext virtual machine data in shared memory. When data is read and written between the two, the plaintext data read and written between the external passthrough device and the encrypted virtual machine is at risk of being stolen and tampered with by the VMM, which would prevent the external passthrough device and the encrypted virtual machine from reading and writing confidential data. However, in confidential computing scenarios, there is a need for the external passthrough device and the encrypted virtual machine to read and write confidential data. Therefore, it is necessary to ensure the security of the data read and written between the external passthrough device and the encrypted virtual machine.

[0057] In an optional example, an IOMMU (Input / Output Memory Management Unit) can be used to manage device access to system memory. Upon receiving a data request, the IOMMU obtains the virtual machine identifier and the base address information of the input / output page table based on the external pass-through device that sent the data request. It then locates the input / output page table (IO page table) based on the base address information, thereby obtaining the correspondence between the virtual machine physical address (GPA) and the host physical address (HPA) in the IOMMU, as well as the encrypted information contained in the host physical address (HPA). Based on the HPA indication, the IOMMU constructs a read / write request for address data using the encrypted information, the virtual machine identifier, and the host physical address, and transmits the read / write request to the memory controller, enabling direct and efficient data transmission between the external pass-through device and the encrypted memory space.

[0058] When the disk controller needs to send a DMA request to the memory controller to write data into memory, the disk controller can send the request to the IOMMU. After the IOMMU translates it, it is converted into request information containing the physical address of the memory and the virtual machine ID, and then transmitted to the memory controller. The memory controller can then obtain the encryption key through the virtual machine ID, encrypt the plaintext virtual machine data sent by the disk controller into virtual machine data ciphertext, and write the ciphertext into memory.

[0059] When the disk controller needs to send a DMA request to the memory controller to read memory data, the disk controller can send the request to the IOMMU. After the IOMMU translates it, it is converted into request information containing the physical address of the memory and the virtual machine ID, and then transmitted to the memory controller. The memory controller can then obtain the encryption key through the virtual machine ID, use the encryption key to decrypt the ciphertext of the virtual machine data in memory, and transmit the plaintext virtual machine data to the disk controller for storage on the disk.

[0060] As can be seen, the Input / Output Memory Management Unit (IOMMU) enables direct data transfer between external passthrough devices and encrypted virtual machines, ensuring data security during this process. However, because the virtual machine data stored on the disk is in plaintext, there is a possibility of leakage of plaintext virtual machine data stored outside the SOC, thus reducing data security.

[0061] In one alternative example, to protect the virtual machine data stored on the disk, software encryption can be used in the operating system to encrypt the virtual machine data to be saved. Specifically, after the encrypted memory data of the encrypted virtual machine is decrypted by the encryption / decryption hardware in the SOC, the memory controller transmits the plaintext data to the operating system. The operating system then performs an encryption process on the plaintext data and transmits the encrypted ciphertext to the IOMMU. The IOMMU then transmits the ciphertext data to the disk controller for storage on the disk.

[0062] As can be seen, when the disk controller is directly connected to the encrypted virtual machine, the encryption software in the operating system can encrypt the data before it is written to the disk, ensuring that the data is stored in ciphertext and protecting the security of the virtual machine data on the disk. However, once an attacker gains access to the operating system, there is a possibility of maliciously attacking the encryption process for the plaintext virtual machine data within the operating system. This could involve illegally disabling encryption configurations or bypassing the encryption process through attacks. Therefore, encrypting the virtual machine data to be stored on the disk using software increases the likelihood of attackers attacking the plaintext virtual machine data and reduces data security.

[0063] Based on the above, this application embodiment considers adding encryption / decryption hardware between the disk controller and the disk. When the disk controller writes plaintext data to the disk, it encrypts the data using the encryption / decryption hardware and writes the ciphertext to the disk. When the disk controller reads the ciphertext data from the disk, it decrypts the data using the encryption / decryption hardware and transmits the virtual machine data in plaintext within the SOC. This ensures that attacks on the operating system cannot affect the disk controller's encryption process, and that the virtual machine data can be stored in ciphertext form on an external storage device, preventing data leakage and effectively improving data security.

[0064] Following this approach, embodiments of this application provide an improved direct storage access method, which, after receiving plaintext of the encrypted memory data to be accessed by the encrypted virtual machine transmitted by the input / output memory management unit, can encrypt the plaintext data based on a pre-configured virtual machine key, so that the virtual machine data stored in the external pass-through device is in ciphertext form, thereby improving data security.

[0065] The direct storage access method provided in the embodiments of this application will be described in detail below.

[0066] In the optional implementation, taking the disk controller as the external pass-through device as an example, Figure 3 This illustration shows an optional passthrough architecture diagram between the encrypted virtual machine and the external passthrough device provided in an embodiment of this application, such as... Figure 3 As shown, it can specifically include: encrypted virtual machine, SOC, memory and disk.

[0067] The basic introductions of the SOC, memory, and disk can be found in the descriptions of the corresponding sections above. The functions and relationships of these components in this application embodiment will be further explained below. It is worth noting that in this application embodiment, the device driver in the encrypted virtual machine supports the virtual machine ID lookup function, and the input / output memory management unit (IOMMU) supports the IO page table function with the virtual machine ID.

[0068] In the embodiments of this application, Figure 3 The technical architecture shown also includes a security processor, which configures corresponding keys for the encryption and decryption hardware corresponding to the memory controller and the encryption and decryption hardware corresponding to the disk controller, and marks them with the virtual machine identifier (ID) of the encrypted virtual machine, so that the encryption and decryption hardware can encrypt and decrypt data based on the configured keys.

[0069] It should be noted that the keys configured by the security processor for the encryption / decryption hardware corresponding to the memory controller and the encryption / decryption hardware corresponding to the disk controller can be the same as the virtual machine keys configured by the security processor for the encrypted virtual machine, so as to correspond to the virtual machine ID of the encrypted virtual machine. Therefore, the keys configured by the security processor for the encryption / decryption hardware corresponding to the memory controller to encrypt the virtual machine memory, and the keys configured by the security processor for the encryption / decryption hardware corresponding to the disk controller to encrypt the virtual machine data stored on the disk, are collectively referred to as virtual machine keys.

[0070] based on Figure 3 The illustrated alternative architecture, in one alternative implementation, Figure 4 This illustration shows an optional flowchart of the direct storage access method provided in an embodiment of this application. The method flow can be... Figure 3 The disk controller and memory controller shown are implemented as external pass-through devices.

[0071] like Figure 4 As shown, the direct storage access method flow of this application embodiment may include the following steps.

[0072] In step S40, the disk controller receives a direct storage access command from the encrypted virtual machine.

[0073] The encrypted virtual machine has the requirement to read virtual machine data in memory to disk for permanent storage, so that the encrypted virtual machine can directly display virtual machine data stored on disk. Thus, the direct storage access command can at least instruct the reading of the encrypted memory data to be accessed from memory.

[0074] In step S43, the disk controller, in response to the direct storage access command, transmits a direct storage access request to the input / output memory management unit (IOMMU).

[0075] The disk controller, based on the direct storage access command of the encrypted virtual machine, can initiate direct storage access requests to memory. Specifically, the direct storage access request can be transmitted to the memory controller through the input / output memory management unit (IOMMU) to ensure data security.

[0076] In step S44, the memory controller obtains the direct memory access request transmitted by the input / output memory management unit (IOMMU).

[0077] In step S45, the memory controller reads the encrypted memory data to be accessed according to the direct storage access request, and decrypts the encrypted memory data to be accessed based on the virtual machine key of the encrypted virtual machine.

[0078] It is understood that the direct memory access request transmitted by the Input / Output Memory Management Unit (IOMMU) may include the physical memory address and the virtual machine ID. This allows the memory controller to read the corresponding encrypted data from memory based on the physical memory address. Furthermore, the encryption / decryption hardware corresponding to the memory controller can determine the memory encryption key configured by the security processor based on the virtual machine ID. Optionally, this memory encryption key may be the same as the virtual machine key configured by the security processor for the encrypted virtual machine. Thus, the corresponding memory encryption key, i.e., the virtual machine key, can be determined based on the virtual machine ID. Subsequently, the encryption / decryption hardware corresponding to the memory controller can decrypt the accessed encrypted memory data based on the virtual machine key of the encrypted virtual machine, obtaining the plaintext of the encrypted memory data.

[0079] Step S46: The memory controller transmits the plaintext corresponding to the encrypted memory data to be accessed to the input / output memory management unit (IOMMU).

[0080] In step S47, the disk controller receives the plaintext of the encrypted memory data to be accessed transmitted by the input / output memory management unit (IOMMU).

[0081] In step S48, the disk controller encrypts the plaintext of the memory encryption data to be accessed based on the pre-configured virtual machine key and stores the corresponding ciphertext data.

[0082] It is understandable that when the Input / Output Memory Management Unit (IOMMU) transmits plaintext of the encrypted memory data that the encrypted virtual machine needs to access, it can also transmit the virtual machine ID. This allows the encryption / decryption hardware corresponding to the disk controller to determine the disk encryption key pre-configured by the security processor for the disk controller based on the virtual machine ID. Alternatively, this disk encryption key can be the same as the virtual machine key configured by the security processor for the encrypted virtual machine. Thus, the corresponding disk encryption key, i.e., the virtual machine key, can be determined based on the virtual machine ID. Furthermore, the encryption / decryption hardware corresponding to the disk controller can encrypt the plaintext of the encrypted memory data to be accessed based on the pre-configured virtual machine key, obtaining ciphertext data, and storing the corresponding ciphertext data on the disk.

[0083] As can be seen, the direct storage access method provided in this application can encrypt the plaintext data based on a pre-configured virtual machine key after receiving the plaintext of the encrypted memory data to be accessed by the encrypted virtual machine transmitted by the input / output memory management unit, so that the virtual machine data stored in the external pass-through device is in ciphertext form, thereby improving data security.

[0084] Continue to refer to Figure 4 As shown, in some embodiments, in secure virtualization technology, the virtual machine key for the encrypted virtual machine is configured by a security processor. Since the security processor in this embodiment has the function of configuring corresponding keys for the encryption / decryption hardware corresponding to the memory controller and the encryption / decryption hardware corresponding to the disk controller, after step S40, the following is also included:

[0085] Step S41: The disk controller configures the virtual machine key corresponding to the encrypted virtual machine based on the configuration information of the security processor.

[0086] Before step S43, the following is also included:

[0087] Step S42: The memory controller configures the virtual machine key corresponding to the encrypted virtual machine based on the configuration information of the security processor.

[0088] The configuration information for security processing may include virtual machine keys.

[0089] As an optional implementation, steps S41 and / or S43 may be executed in the initial state of the encrypted virtual machine, which corresponds to the initial startup of the encrypted virtual machine. In this case, the virtual machine key configured based on the security processor's configuration information corresponding to the encrypted virtual machine may be obtained by acquiring a virtual machine key randomly generated by the security processor according to the identifier of the encrypted virtual machine.

[0090] As an alternative implementation, steps S41 and / or S43 can be executed while the encrypted virtual machine is running, the running state corresponding to the restart of the encrypted virtual machine. In this case, based on the configuration information of the security processor, the virtual machine key configured for the encrypted virtual machine can be obtained by acquiring the virtual machine history key for the encrypted virtual machine determined by the security processor according to the identifier of the encrypted virtual machine. The virtual machine history key is the same as the virtual machine key configured by the security processor for the encrypted virtual machine in the initial state.

[0091] In some embodiments, the virtual machine key can be pre-stored in a key information table by a security processor. This key information table refers to a file containing the encrypted key corresponding to the encryption / decryption hardware, which can be created by the Virtual Machine Monitor (VMM). Specifically, since the virtual machine data of the encrypted virtual machine stored on disk is ciphertext, the key used by the encryption / decryption hardware to encrypt the virtual machine data must be stored simultaneously to facilitate the use of the ciphertext stored on disk. Furthermore, to ensure the security of the key, the key itself must be encrypted before storage.

[0092] It should be noted that the VMM in this embodiment is configured with an output key command and an input key command. The output key command instructs the security processor to transmit a key to the VMM, and the input key command instructs the security processor to verify and decrypt the key stored on the VMM and configure it to the encryption / decryption hardware. Corresponding to the output key command and input key command of the VMM, when the virtual machine is first started, the security processor can use a key derivation algorithm to derive two types of keys from the hardware root key: a transmission key and a signature verification key pair. These are then stored in the security processor's internal storage device. To ensure the security of data stored on the disk, the key in the encryption / decryption hardware must be configured by the security processor; the operating system and the VMM do not have the authority to configure the key in the encryption / decryption hardware.

[0093] In one optional example, Figure 5This illustration shows an optional flowchart of a security processor configuring encryption / decryption hardware keys in an initial state, according to an embodiment of this application. This method can be implemented by the VMM and the security processor. The initial state corresponds to the state of the encrypted virtual machine's initial startup. During the initial startup of the encrypted virtual machine, the security processor can randomly generate a virtual machine key for the encrypted virtual machine. This virtual machine key can be used by the encryption / decryption hardware of the corresponding memory controller and the encryption / decryption hardware of the corresponding disk controller to encrypt and decrypt virtual machine data. Figure 5 As shown,

[0094] This may include the following steps:

[0095] In step S50, the VMM sends an output key command to the security processor.

[0096] In step S51, the security processor encrypts the virtual machine key using the transmission key.

[0097] After receiving the output key command sent by the VMM, the security processor can encrypt the virtual machine key using the transmission key. The virtual machine key may be the disk key corresponding to the disk controller's encryption of plaintext data.

[0098] In step S52, the security processor signs the virtual machine key ciphertext using the signing key.

[0099] In step S53, the security processor sends the encrypted virtual machine key and the virtual machine key signature to the VMM.

[0100] Step S54: The VMM saves the encrypted virtual machine key and the virtual machine key signature to the key information table.

[0101] The encrypted virtual machine key stored in the key information table by the VMM can be the ciphertext of the virtual machine's historical key corresponding to the encrypted virtual machine.

[0102] In another optional example, Figure 6 This illustration shows an optional flowchart of a security processor configuring encryption / decryption hardware keys during runtime, according to an embodiment of this application. This method can be implemented by the VMM and the security processor. The runtime state corresponds to the restart state of the encrypted virtual machine. When the encrypted virtual machine restarts, the security processor can configure virtual machine keys for the memory controller and disk controller based on the encrypted virtual machine key and virtual machine key signature stored in the VMM's key information table. These virtual machine keys are used by the encryption / decryption hardware of the corresponding memory controller and the encryption / decryption hardware of the corresponding disk controller to encrypt and decrypt virtual machine data. Figure 6 As shown, it may include the following steps:

[0103] In step S60, the VMM sends an input key command to the security processor.

[0104] The VMM can input the stored encrypted virtual machine key and virtual machine key signature as parameters to the security processor.

[0105] In step S61, the security processor verifies the virtual machine key ciphertext signature using the signature verification key.

[0106] After receiving the input key command sent by the VMM, the security processor can use the signature verification key to verify the signature of the virtual machine key ciphertext. If the signature of the virtual machine key ciphertext matches the signature verification key of the security processor, then the virtual machine key ciphertext is a trusted virtual machine key ciphertext, and step S62 is executed.

[0107] In step S62, the security processor decrypts the virtual machine key ciphertext using the transmission key.

[0108] In step S63, the security processor configures the virtual machine key to the memory controller and disk controller.

[0109] After the security processor decrypts the virtual machine key ciphertext using the transmission key, it can obtain the virtual machine key. This virtual machine key can then be configured to the encryption / decryption hardware corresponding to the memory controller and the encryption / decryption hardware corresponding to the disk controller. This allows the encryption / decryption hardware to be used to perform encryption / decryption operations on virtual machine data based on direct storage access requests. For example, the memory controller can use the encryption / decryption hardware to decrypt read encrypted memory data, and the disk controller can use the encryption / decryption hardware to encrypt received plaintext virtual machine data.

[0110] In some embodiments, the direct storage access command sent by the encrypted virtual machine may include the virtual machine identifier of the encrypted virtual machine, and the disk controller may configure the virtual machine key of the encrypted virtual machine corresponding to the virtual machine identifier of the encrypted virtual machine based on the configuration information of the security processor.

[0111] As can be seen, the embodiments of this application, after receiving the plaintext of the encrypted memory data that the encrypted virtual machine needs to access transmitted by the input / output memory management unit, can encrypt the plaintext data based on the pre-configured virtual machine key, so that the virtual machine data stored in the external pass-through device is in ciphertext form, thereby improving data security.

[0112] This application also provides a direct storage access method. Figure 7 An exemplary diagram illustrates another optional flowchart of direct storage access provided in this application embodiment, the method flow of which can be... Figure 5 The disk controller and memory controller implementations are shown. Figure 7As shown, the method flow may include the following steps. The content described below can be referenced in conjunction with the content described above.

[0113] In step S70, the disk controller receives a direct storage access command from the encrypted virtual machine, the direct storage access command indicating at least that the encrypted data to be accessed should be written into memory.

[0114] The cryptographic virtual machine has the requirement to write virtual machine data stored on the disk into memory for retrieval, so that the cryptographic virtual machine can make direct calls based on the virtual machine data written into memory, and the direct storage access command can at least instruct the writing of the cryptographic data to be accessed into memory.

[0115] In step S73, the disk controller responds to the direct storage access command by reading the encrypted data to be accessed and decrypting the encrypted data based on a pre-configured virtual machine key.

[0116] The direct storage access command may include a disk storage address and a virtual machine ID. This allows the disk controller to read the required encrypted data from the disk based on the disk storage address. Furthermore, the encryption / decryption hardware corresponding to the disk controller can determine a disk encryption key pre-configured by the security processor based on the virtual machine ID. Optionally, this disk encryption key may be the same as the virtual machine key configured by the security processor for the encrypted virtual machine; that is, the pre-configured virtual machine key is determined based on the virtual machine ID. Subsequently, the encryption / decryption hardware corresponding to the disk controller can decrypt the read encrypted data based on the pre-configured virtual machine key to obtain the plaintext of the encrypted data.

[0117] In step S74, the disk controller transmits a direct storage access request to the input / output memory management unit (IOMMU) to write the plaintext of the encrypted data to be accessed.

[0118] In step S75, the memory controller obtains a direct memory access request transmitted by the input / output memory management unit (IOMMU).

[0119] In step S76, the memory controller encrypts the plaintext of the encrypted data to be accessed based on the virtual machine key of the encrypted virtual machine according to the direct storage access request, and writes the corresponding ciphertext data into memory.

[0120] The direct memory access request transmitted by the Input / Output Memory Management Unit (IOMMU) can include the plaintext of the encrypted data to be accessed and the virtual machine ID. Based on the direct memory access request, the memory controller can instruct its corresponding encryption / decryption hardware to determine the memory encryption key configured by the security processor for the encryption / decryption hardware, using the virtual machine ID. Optionally, the memory encryption key can be the same as the virtual machine key configured by the security processor for the encrypted virtual machine; that is, the virtual machine key for the encrypted virtual machine is determined based on the virtual machine ID. Subsequently, the encryption / decryption hardware corresponding to the memory controller can encrypt the plaintext of the encrypted data to be accessed based on the virtual machine key of the encrypted virtual machine, obtaining ciphertext data, and write the corresponding ciphertext data into memory.

[0121] As can be seen, the external pass-through device in this application embodiment can decrypt the ciphertext of the encrypted data that the encrypted virtual machine needs to access and then transmit the plaintext of the encrypted data that the encrypted virtual machine needs to access to the memory controller. Furthermore, the memory controller can encrypt the plaintext data based on the configured virtual machine key, so that the virtual machine data stored in memory is in ciphertext form. This achieves end-to-end encryption of data when the external pass-through device and the memory are directly transmitted, thereby improving data security.

[0122] Optionally, the virtual machine key of the encrypted virtual machine is configured by the security processor;

[0123] The security processor based on the embodiments of this application has the function of configuring corresponding keys for the encryption and decryption hardware corresponding to the memory controller and the encryption and decryption hardware corresponding to the disk controller. Therefore, after step S70, the following is also included:

[0124] Step S71: The disk controller configures the virtual machine key corresponding to the encrypted virtual machine based on the configuration information of the security processor.

[0125] Before step S73, the method further includes:

[0126] Step S72: The memory controller configures the virtual machine key corresponding to the encrypted virtual machine based on the configuration information of the security processor.

[0127] The configuration information for security processing may include virtual machine keys.

[0128] Optionally, in the initial state of the encrypted virtual machine, configuring the virtual machine key corresponding to the encrypted virtual machine based on the security processor's configuration information includes:

[0129] Obtain the virtual machine key randomly generated by the security processor based on the identifier of the encrypted virtual machine.

[0130] Optionally, while the encrypted virtual machine is running, configuring the virtual machine key corresponding to the encrypted virtual machine based on the security processor's configuration information includes:

[0131] Obtain the virtual machine history key corresponding to the encrypted virtual machine, determined by the security processor based on the virtual machine identifier of the encrypted virtual machine.

[0132] Optionally, the virtual machine key is pre-stored in a key information table by the security processor, and the key information table is created by the virtual machine monitor.

[0133] Optionally, the direct storage access command includes the virtual machine identifier of the encrypted virtual machine;

[0134] The configuration information based on the security processor configures the virtual machine key corresponding to the encrypted virtual machine, including:

[0135] Based on the virtual machine identifier of the encrypted virtual machine and the configuration information of the security processor, a virtual machine key corresponding to the virtual machine identifier of the encrypted virtual machine is configured.

[0136] As can be seen, the external pass-through device in this application embodiment can decrypt the ciphertext of the encrypted data that the encrypted virtual machine needs to access, and then transmit the plaintext of the encrypted data that the encrypted virtual machine needs to access to the memory controller through the input / output memory management unit. Furthermore, the memory controller can encrypt the plaintext data based on the pre-configured virtual machine key, so that the virtual machine data stored in memory is in ciphertext form. This realizes end-to-end encryption of data when the external pass-through device and the memory are directly transmitted, thereby improving data security.

[0137] The following description, from the perspective of an external pass-through device, introduces the apparatus for the direct storage access method provided in the embodiments of this application. The apparatus described below can be considered as the functional modules required by the external pass-through device to implement the direct storage access method provided in the embodiments of this application. The content described below can be referred to in correspondence with the content described above.

[0138] As an optional implementation Figure 8 An exemplary block diagram of an optional direct storage access device provided in an embodiment of this application is shown. This device can be applied to an external pass-through device. (Refer to...) Figure 8 The device may include:

[0139] Command receiving module 81 is used to receive direct storage access commands from the encrypted virtual machine, wherein the direct storage access commands at least indicate reading the encrypted memory data to be accessed from memory;

[0140] The response module 82 is used to respond to the direct memory access command by transmitting a direct memory access request to the input / output memory management unit, so that the memory controller receives the direct memory access request transmitted by the input / output memory management unit, decrypts the encrypted memory data to be accessed based on the virtual machine key of the encrypted virtual machine, and transmits the plaintext corresponding to the encrypted memory data to be accessed by the input / output memory management unit to the external pass-through device.

[0141] The encryption / decryption hardware 83 is used to receive the plaintext of the memory encryption data to be accessed transmitted by the input / output memory management unit, encrypt the plaintext of the memory encryption data to be accessed based on a pre-configured virtual machine key, and store the corresponding ciphertext data.

[0142] Optionally, the virtual machine key of the encrypted virtual machine is configured by the security processor;

[0143] After receiving the direct storage access command from the encrypted virtual machine, the command receiving module 81 further includes:

[0144] Based on the configuration information of the security processor, a virtual machine key corresponding to the encrypted virtual machine is configured; the configuration information includes the virtual machine key.

[0145] Optionally, in the initial state of the encrypted virtual machine, the command receiving module 81 configures the virtual machine key corresponding to the encrypted virtual machine based on the configuration information of the security processor, including:

[0146] Obtain the virtual machine key randomly generated by the security processor based on the identifier of the encrypted virtual machine.

[0147] Optionally, when the encrypted virtual machine is running, the command receiving module 81 configures the virtual machine key corresponding to the encrypted virtual machine based on the configuration information of the security processor, including:

[0148] Obtain the virtual machine history key corresponding to the encrypted virtual machine, determined by the security processor based on the virtual machine identifier of the encrypted virtual machine.

[0149] Optionally, the virtual machine key is pre-stored in a key information table by the security processor, and the key information table is created by the virtual machine monitor.

[0150] Optionally, the command receiving module 81 receives a direct storage access command that includes the virtual machine identifier of the encrypted virtual machine;

[0151] The command receiving module 81, based on the configuration information of the security processor, configures the virtual machine key corresponding to the encrypted virtual machine, including the following steps:

[0152] Based on the virtual machine identifier of the encrypted virtual machine and the configuration information of the security processor, a virtual machine key corresponding to the virtual machine identifier of the encrypted virtual machine is configured.

[0153] The following description, from the perspective of the memory controller, introduces the apparatus for the direct memory access method provided in the embodiments of this application. The apparatus described below can be considered as the functional modules required by the memory controller to implement the direct memory access method provided in the embodiments of this application. The content described below can be referred to in correspondence with the content described above.

[0154] As an optional implementation Figure 9 An exemplary diagram illustrates another optional block diagram of the direct memory access apparatus provided in this application embodiment, which can be applied to a memory controller, see reference to Figure 9 The device may include:

[0155] The request acquisition module 91 is used to acquire the direct storage access request of the external pass-through device transmitted by the input / output memory management unit. The direct storage access request corresponds to the direct storage access command for reading the encrypted memory data to be accessed in memory.

[0156] The memory encryption / decryption hardware 92 is used to read the encrypted memory data to be accessed according to the direct storage access request, and to decrypt the encrypted memory data to be accessed based on the virtual machine key of the encrypted virtual machine.

[0157] The transmission module 93 is used to transmit plaintext corresponding to the memory encryption data to be accessed to the input / output memory management unit, so that the external pass-through device receives the plaintext of the memory encryption data to be accessed transmitted by the input / output memory management unit, encrypts the plaintext of the memory encryption data to be accessed based on a pre-configured virtual machine key, and stores the corresponding ciphertext data.

[0158] Optionally, the virtual machine key of the encrypted virtual machine is configured by the security processor;

[0159] Before the request acquisition module 91 acquires the direct storage access request from the external pass-through device transmitted by the input / output memory management unit, it further includes:

[0160] Based on the configuration information of the security processor, configure the virtual machine key corresponding to the encrypted virtual machine; the configuration information includes the virtual machine key.

[0161] Optionally, in the initial state of the encrypted virtual machine, the step of the request acquisition module 91 configuring the virtual machine key corresponding to the encrypted virtual machine based on the configuration information of the security processor includes:

[0162] Obtain the virtual machine key randomly generated by the security processor based on the identification information of the encrypted virtual machine.

[0163] Optionally, when the encrypted virtual machine is running, the step of the request acquisition module 91 configuring the virtual machine key corresponding to the encrypted virtual machine based on the configuration information of the security processor includes:

[0164] Obtain the virtual machine history key corresponding to the encrypted virtual machine, determined by the security processor based on the virtual machine identifier of the encrypted virtual machine.

[0165] Optionally, the virtual machine key is pre-stored in a key information table by the security processor, and the key information table is created by the virtual machine monitor.

[0166] Optionally, the direct storage access command includes the virtual machine identifier of the encrypted virtual machine;

[0167] The step of configuring the virtual machine key corresponding to the encrypted virtual machine based on the configuration information of the security processor, as described in the request acquisition module 91, includes:

[0168] Based on the virtual machine identifier of the encrypted virtual machine and the configuration information of the security processor, a virtual machine key corresponding to the virtual machine identifier of the encrypted virtual machine is configured.

[0169] This application also provides a computer device that can implement the direct storage access method provided in this application by setting the direct storage access device described above. As an optional implementation, Figure 10 Optional block diagrams of the computer device provided in the embodiments of this application, such as Figure 10 As shown, the computer device may include: at least one processor 1, at least one communication interface 2, at least one memory 3, and at least one communication bus 4.

[0170] In this embodiment, the number of processor 1, communication interface 2, memory 3, and communication bus 4 is at least one, and processor 1, communication interface 2, and memory 3 communicate with each other through communication bus 4.

[0171] Optionally, communication interface 2 can be an interface for a communication module used for network communication.

[0172] Optionally, processor 1 may be a CPU (Central Processing Unit), GPU (Graphics Processing Unit), NPU (Embedded Neural Network Processor), FPGA (Field Programmable Gate Array), TPU (Tensor Processing Unit), AI chip, ASIC (Application Specific Integrated Circuit), or one or more integrated circuits configured to implement the embodiments of this application.

[0173] Memory 3 may include high-speed RAM, and may also include non-volatile memory, such as at least one disk drive.

[0174] The memory 3 stores one or more computer-executable instructions, and the processor 1 invokes the one or more computer-executable instructions to execute the direct memory access method of this application embodiment.

[0175] This application also provides a storage medium that stores one or more computer-executable instructions. When the one or more computer-executable instructions are executed, the direct storage access method as described in this application is implemented.

[0176] The foregoing describes multiple embodiment schemes provided by the embodiments of this application. The optional methods described in each embodiment scheme can be combined and cross-referenced with each other without conflict, thereby extending to a variety of possible embodiment schemes. These can all be considered as the embodiment schemes disclosed and published by the embodiments of this application.

[0177] While the embodiments disclosed above are described in this application, this application is not limited thereto. Any person skilled in the art can make various modifications and alterations without departing from the spirit and scope of this application; therefore, the scope of protection of this application should be determined by the scope defined in the claims.

Claims

1. A direct memory access method, characterized in that, Applied to external through-hole devices, the method includes: Receive a direct storage access command for an encrypted virtual machine, the direct storage access command indicating at least that the encrypted memory data to be accessed should be read from memory; In response to the direct memory access command, a direct memory access request is transmitted to the input / output memory management unit (I / O Memory Management Unit) so that the memory controller receives the direct memory access request transmitted by the I / O Memory Management Unit and decrypts the encrypted memory data to be accessed based on the virtual machine key of the encrypted virtual machine. The plaintext corresponding to the encrypted memory data to be accessed is then transmitted by the I / O Memory Management Unit to the external passthrough device. The virtual machine key of the encrypted virtual machine is configured by the security processor. The virtual machine key is a virtual machine key configured by the security processor based on the identifier of the encrypted virtual machine. The security processor configures the same virtual machine key for both the memory controller and the external passthrough device. The system receives the plaintext of the encrypted memory data to be accessed transmitted by the input / output memory management unit, encrypts the plaintext of the encrypted memory data to be accessed based on a pre-configured virtual machine key, and stores the corresponding ciphertext data.

2. The direct storage access method according to claim 1, characterized in that, After receiving the direct storage access command from the encrypted virtual machine, the method further includes: Based on the configuration information of the security processor, a virtual machine key corresponding to the encrypted virtual machine is configured; the configuration information includes the virtual machine key.

3. The direct storage access method according to claim 2, characterized in that, In the initial state of the encrypted virtual machine, configuring the virtual machine key corresponding to the encrypted virtual machine based on the security processor's configuration information includes: Obtain the virtual machine key randomly generated by the security processor based on the identifier of the encrypted virtual machine.

4. The direct storage access method according to claim 2, characterized in that, While the encrypted virtual machine is running, configuring the virtual machine key corresponding to the encrypted virtual machine based on the security processor's configuration information includes: Obtain the virtual machine history key corresponding to the encrypted virtual machine, determined by the security processor based on the virtual machine identifier of the encrypted virtual machine.

5. The direct storage access method according to claim 3 or 4, characterized in that, The virtual machine key is pre-stored in a key information table by the security processor, and the key information table is created by the virtual machine monitor.

6. The method according to claim 2, characterized in that, The direct storage access command includes the virtual machine identifier of the encrypted virtual machine; The configuration information based on the security processor configures the virtual machine key corresponding to the encrypted virtual machine, including: Based on the virtual machine identifier of the encrypted virtual machine and the configuration information of the security processor, a virtual machine key corresponding to the virtual machine identifier of the encrypted virtual machine is configured.

7. A direct memory access method, characterized in that, Applied to a memory controller, the method includes: The system acquires a direct storage access request from an external pass-through device transmitted by the input / output memory management unit. The direct storage access request corresponds to a direct storage access command that reads the encrypted memory data to be accessed from memory. According to the direct storage access request, the encrypted memory data to be accessed is read, and the encrypted memory data to be accessed is decrypted based on the virtual machine key of the encrypted virtual machine; the virtual machine key of the encrypted virtual machine is configured by the security processor; the virtual machine key is a virtual machine key configured by the security processor according to the identifier of the encrypted virtual machine; the security processor configures the same virtual machine key for the memory controller and the external passthrough device; The plaintext corresponding to the memory encryption data to be accessed is transmitted to the input / output memory management unit, so that the external pass-through device receives the plaintext of the memory encryption data to be accessed transmitted by the input / output memory management unit, encrypts the plaintext of the memory encryption data to be accessed based on a pre-configured virtual machine key, and stores the corresponding ciphertext data.

8. The direct storage access method according to claim 7, characterized in that, Before acquiring the direct storage access request from the external pass-through device transmitted by the input / output memory management unit, the method further includes: Based on the configuration information of the security processor, configure the virtual machine key corresponding to the encrypted virtual machine; the configuration information includes the virtual machine key.

9. The direct storage access method according to claim 8, characterized in that, In the initial state of the encrypted virtual machine, configuring the virtual machine key corresponding to the encrypted virtual machine based on the security processor's configuration information includes: Obtain the virtual machine key randomly generated by the security processor based on the identification information of the encrypted virtual machine.

10. The direct storage access method according to claim 8, characterized in that, While the encrypted virtual machine is running, configuring the virtual machine key corresponding to the encrypted virtual machine based on the security processor's configuration information includes: Obtain the virtual machine history key corresponding to the encrypted virtual machine, determined by the security processor based on the virtual machine identifier of the encrypted virtual machine.

11. The direct storage access method according to claim 9 or 10, characterized in that, The virtual machine key is pre-stored in a key information table by the security processor, and the key information table is created by the virtual machine monitor.

12. The direct storage access method according to claim 8, characterized in that, The direct storage access command includes the virtual machine identifier of the encrypted virtual machine; The configuration information based on the security processor configures the virtual machine key corresponding to the encrypted virtual machine, including: Based on the virtual machine identifier of the encrypted virtual machine and the configuration information of the security processor, a virtual machine key corresponding to the virtual machine identifier of the encrypted virtual machine is configured.

13. A direct memory access method, characterized in that, Applied to external through-hole devices, the method includes: Receive a direct storage access command from an encrypted virtual machine, the direct storage access command indicating at least that the encrypted data to be accessed should be written into memory; In response to the direct storage access command, the encrypted data to be accessed is read, and the encrypted data to be accessed is decrypted based on the pre-configured virtual machine key; A direct storage access request for writing the plaintext of the encrypted data to be accessed is transmitted to the input / output memory management unit, so that the memory controller receives the direct storage access request transmitted by the input / output memory management unit, and encrypts the plaintext of the encrypted data to be accessed based on the virtual machine key of the encrypted virtual machine according to the direct storage access request, and writes the corresponding ciphertext data into memory; the virtual machine key of the encrypted virtual machine is configured by the security processor; the virtual machine key is a virtual machine key configured by the security processor according to the identifier of the encrypted virtual machine; the security processor configures the same virtual machine key for the memory controller and the external passthrough device.

14. A direct memory access method, characterized in that, Applied to a memory controller, the method includes: The system acquires a direct storage access request from an external pass-through device transmitted by the input / output memory management unit. The direct storage access request corresponds to a direct storage access command that writes plaintext of the encrypted data to be accessed into memory. Based on the direct storage access request, the plaintext of the encrypted data to be accessed is encrypted using the virtual machine key of the encrypted virtual machine, and the corresponding ciphertext data is written into memory; the virtual machine key of the encrypted virtual machine is configured by the security processor; the virtual machine key is a virtual machine key configured by the security processor based on the identifier of the encrypted virtual machine; the security processor configures the same virtual machine key for the memory controller and the external passthrough device.

15. A direct memory access device, characterized in that, Applied to external through-hole devices, the device includes: The command receiving module is used to receive direct storage access commands from the encrypted virtual machine, wherein the direct storage access commands at least indicate that the encrypted memory data to be accessed should be read from memory; A response module is configured to respond to the direct memory access command by transmitting a direct memory access request to an input / output memory management unit (I / O Memory Management Unit), thereby enabling the memory controller to receive the direct memory access request transmitted by the I / O Memory Management Unit, decrypt the encrypted memory data to be accessed based on the virtual machine key of the encrypted virtual machine, and transmit the plaintext corresponding to the encrypted memory data to be accessed by the I / O Memory Management Unit to the external passthrough device. The virtual machine key of the encrypted virtual machine is configured by the security processor. The virtual machine key is a virtual machine key configured by the security processor based on the identifier of the encrypted virtual machine. The security processor configures the same virtual machine key for both the memory controller and the external passthrough device. Encryption and decryption hardware is used to receive the plaintext of the encrypted memory data to be accessed transmitted by the input / output memory management unit, encrypt the plaintext of the encrypted memory data to be accessed based on a pre-configured virtual machine key, and store the corresponding ciphertext data.

16. A direct memory access device, characterized in that, Applied to a memory controller, the device includes: The request acquisition module is used to acquire the direct storage access request of the external pass-through device transmitted by the input / output memory management unit. The direct storage access request corresponds to the direct storage access command for reading the encrypted memory data to be accessed in memory. The memory encryption / decryption hardware is used to read the encrypted memory data to be accessed according to the direct storage access request, and to decrypt the encrypted memory data to be accessed based on the virtual machine key of the encrypted virtual machine; the virtual machine key of the encrypted virtual machine is configured by the security processor; the virtual machine key is a virtual machine key configured by the security processor according to the identifier of the encrypted virtual machine; the security processor configures the same virtual machine key for the memory controller and the external passthrough device; The transmission module is used to transmit plaintext corresponding to the memory encryption data to be accessed to the input / output memory management unit, so that the external pass-through device receives the plaintext of the memory encryption data to be accessed transmitted by the input / output memory management unit, encrypts the plaintext of the memory encryption data to be accessed based on a pre-configured virtual machine key, and stores the corresponding ciphertext data.

17. A computer device, characterized in that, Includes the direct storage access device as described in claim 15 and / or claim 16.

18. A storage medium, characterized in that, The storage medium stores one or more computer-executable instructions, which, when executed, implement the direct storage access method as described in any one of claims 1-6 or 7-12, or the direct storage access method as described in claim 13 or 14.

Images