Method and system for transferring encrypted memory

Abstract

The application provides a method and system for transmitting encrypted memory, comprising: a sender establishing a communication channel with a receiver; setting a common key as a root key of an integrity protection tree; the sender informing the receiver of data size, and the receiver allocating a receiving buffer; the sender setting a state of a corresponding integrity protection tree of data as read-only and setting the root key, and the receiver setting a state of a corresponding integrity protection tree of the receiving buffer as waiting and setting the same root key; the sender transmitting a root node of the integrity protection tree to the receiver after encrypting the root node with a key; the sender transmitting encrypted memory and all intermediate nodes of the integrity protection tree to the receiver; and the receiver returning an ACK signal to the sender after receiving all data. The application proposes and designs an efficient remote encrypted memory transmission mode, reduces redundant software encryption, greatly improves the efficiency of encrypted data transmission, and reduces the time required for one transmission.

Description

Technical Field

[0001] This invention relates to the technical field of data information security, and more specifically, to a method and system for transmitting encrypted memory. Background Technology

[0002] With the advent of the information age and the era of big data, and the widespread application of cloud computing, data security has become a focal point of public concern, and privacy data protection has become a crucial topic in the computer field. Private data generated by users during computation, such as passwords and encryption keys used for data transmission, can cause significant losses if obtained by potential attackers. The security of this critical data depends on all software and hardware that stores and uses it. Currently, attackers employ numerous attacks targeting computer hardware and software, such as privilege escalation attacks, control flow hijacking, and code injection. Therefore, ensuring the security of user privacy data is a central focus of current computer security. Simultaneously, as users' computing demands increase, user data needs to be uploaded to the cloud and used in collaborative computing with big data, which introduces new data security risks. To address data leakage and achieve privacy-preserving computing, current mainstream processors employ a trusted processor architecture design, using hardware expansion to ensure that user data is confined to a trusted range. In the cloud, to protect user privacy data, cloud developers aim to provide computing power without requiring users to trust cloud service administrators. In communications, because network infrastructure exists in an untrusted environment, attackers can easily launch attacks such as tampering and theft against network data. Therefore, users use cryptography to protect their private data. Utilizing a trusted processor architecture, sensitive user data can be encrypted and stored in a trusted memory region, which only a trusted processor can decrypt. Under a trusted processor architecture, users only need to trust that the processor (CPU and security hardware extensions) is free of security vulnerabilities. Even if other software and hardware involved in data storage and processing, such as the operating system, memory, or disk, have vulnerabilities that can be exploited by attackers, the user's sensitive private data can still be protected. Currently, mainstream trusted processor architectures mainly include three aspects: CPU security, memory security, and I / O security. Regarding CPU security, it is necessary to ensure that when processing sensitive user data, the CPU is in a secure mode, and the CPU in non-secure mode cannot access sensitive data. Furthermore, in secure mode, no untrusted code will be executed. Regarding memory security, current mainstream architectures generally employ cryptographic methods such as memory isolation, memory encryption, and memory integrity checks to ensure that data in memory is not stored in plaintext and cannot be tampered with, considering physical attacks. For I / O security, trusted processor architectures need to ensure that I / O channels are either exclusive and isolated, or also encrypted. I / O channels often connect to untrusted environments, making them the most vulnerable to attacks.

[0003] Intel SGX is a new trusted processor architecture proposed by Intel. Using this technology, user-space applications can create private memory regions called Enclaves. Data within the Enclave is stored in encrypted form in memory and is only decrypted into plaintext once it enters the processor. This is achieved through the processor's corresponding encryption algorithm. Furthermore, the data within the Enclave can only be modified by the data holder. If an attacker exploits system vulnerabilities, such as directly replacing memory modules to modify the data within the Enclave, the processor will terminate the entire program. This is achieved through a corresponding Integrity Tree structure.

[0004] However, because the memory is encrypted, direct memory access via DMA / RDMA (Remote / Direct Memory Access) presents new challenges. For ordinary, unencrypted memory, devices can directly read data from memory through the DMA controller without going through the CPU. DMA has greatly reduced data transfer overhead and is widely used in high-performance devices. However, for encrypted memory, the data read by direct memory access is encrypted, and the device cannot decrypt it; therefore, DMA cannot be used in encrypted memory. Meanwhile, RDMA (Remote Direct Memory Access), an extension of DMA, is widely adopted in high-performance network centers. RDMA allows network cards to directly read or write data to the memory of remote machines; the most advanced RDMA network cards currently available can achieve bandwidths of 400Gbps.

[0005] To securely transmit encrypted memory to a remote node, the current Trusted Execution Environment (TEE) employs software encryption for transmitting sensitive data. The process is as follows: 1) The encrypted memory is decrypted and read into the system cache; 2) The plaintext data is re-encrypted using software encryption; 3) The software-encrypted data is copied to insecure memory; 4) The RDMA network card transmits the software-encrypted data to the remote node; 5) The remote node copies the data to secure memory; 6) The data is first decrypted by hardware and read into the system cache; 7) The enclave program within the remote TEE decrypts the data using software to obtain the final plaintext data. We refer to this process as establishing a Secure Channel between two TEE systems.

[0006] Establishing a trusted channel is extremely costly. The process described above involves multiple rounds of data re-encryption and decryption (both hardware and software perform encryption and decryption). Furthermore, even the fastest encryption / decryption engines are orders of magnitude slower than the data transmission itself. For example, Intel AES-NI instructions offer a 20Gbps encryption bandwidth, while an AES-GCM accelerator compiled using an FPGA can achieve 40Gbps, and remote memory access bandwidth can reach 400Gbps. Therefore, the encryption process becomes the bottleneck for transmitting confidential data through a trusted channel.

[0007] Therefore, a new technical solution is needed to improve the above-mentioned technical problems. Summary of the Invention

[0008] In view of the deficiencies in the prior art, the purpose of this invention is to provide a method and system for transmitting encrypted memory.

[0009] According to the present invention, a method for transferring encrypted memory includes the following steps:

[0010] Step S1: The initiator of the source device establishes a communication channel with the receiver of the target device;

[0011] Step S2: Set a common key as the root key of the integrity protection tree;

[0012] Step S3: The initiator informs the receiver of the data size, and the receiver allocates a receive buffer;

[0013] Step S4: The initiator sets the status of the integrity protection tree corresponding to the data to read-only and sets the root key; the receiver sets the status of the integrity protection tree corresponding to the receive cache to wait and sets the same root key.

[0014] Step S5: The initiator encrypts the root node of the integrity protection tree with a key and sends it to the receiver. The receiver uses the same key to verify the integrity of the root node data and decrypt the root node. If the verification is successful, proceed to step S6. If the verification fails, reject the subsequent operation.

[0015] Step S6: The initiator sends the encrypted memory and all intermediate nodes of the integrity protection tree to the receiver;

[0016] Step S7: After receiving all the data, the receiver returns an ACK signal to the initiator.

[0017] Preferably, step S1 establishes a routing channel using the target device ID and program function name, and returns a communication handle.

[0018] Preferably, the process of adding a node to the integrity protection forest is called global verification. Global verification extends remote verification, which is used to measure whether the remote operating environment is a trusted environment. In global verification, the node being verified prepares the state of its platform and the measurement values ​​of its software, signs it with the hardware identity key, and initiates a global verification request. An authoritative node will receive the request and judge the identity information in it. If the request comes from a trusted node and the measurement of the privileged software running in it meets the expectations, then all integrity protection subtrees in that node are added to the integrity protection forest. The authoritative node assigns a node ID to each node added to the integrity protection forest. This identifier is used to generate a globally unique address information.

[0019] Preferably, the integrity protection tree records the data required for encrypting and decrypting memory. Expanding the root node of the integrity protection tree adds three new data elements: state, key, and globally unique address.

[0020] Preferably, the method proposes an encrypted data closure design, which allows for the decryption of encrypted data within the data closure without requiring additional information. The data closure is the smallest unit for transmitting encrypted data across multiple machines. The data closure consists of encrypted data and a corresponding portable integrity protection tree. The portable integrity protection tree consists of a root node and all intermediate nodes. Upon receiving a memory access request, the corresponding memory data and the metadata of the integrity protection tree are indexed through the physical address in the request.

[0021] The present invention also provides a system for transmitting encrypted memory, the system comprising the following modules:

[0022] Module M1: The communication channel established by the initiator of the source device and the receiver of the target device;

[0023] Module M2: Sets a common key, which serves as the root key for the integrity protection tree;

[0024] Module M3: The initiator informs the receiver of the data size, and the receiver allocates a receive buffer;

[0025] Module M4: The initiator sets the state of the integrity protection tree corresponding to the data to read-only and sets the root key; the receiver sets the state of the integrity protection tree corresponding to the receive buffer to wait and sets the same root key.

[0026] Module M5: The initiator encrypts the root node of the integrity protection tree with a key and sends it to the receiver. The receiver uses the same key to verify the integrity of the root node data and decrypt the root node. If the verification is successful, module M6 is triggered to perform its work. If the verification fails, subsequent operations are rejected.

[0027] Module M6: The initiator sends the encrypted memory and all intermediate nodes of the integrity protection tree to the receiver;

[0028] Module M7: After receiving all the data, the receiver returns an ACK signal to the initiator.

[0029] Preferably, module M1 establishes a routing channel using the target device ID and program function name, and returns a communication handle.

[0030] Preferably, the process of adding a node to the integrity protection forest is called global verification. Global verification extends remote verification, which is used to measure whether the remote operating environment is a trusted environment. In global verification, the node being verified prepares the state of its platform and the measurement values ​​of its software, signs it with the hardware identity key, and initiates a global verification request. An authoritative node will receive the request and judge the identity information in it. If the request comes from a trusted node and the measurement of the privileged software running in it meets the expectations, then all integrity protection subtrees in that node are added to the integrity protection forest. The authoritative node assigns a node ID to each node added to the integrity protection forest. This identifier is used to generate a globally unique address information.

[0031] Preferably, the integrity protection tree records the data required for encrypting and decrypting memory. Expanding the root node of the integrity protection tree adds three new data elements: state, key, and globally unique address.

[0032] Preferably, the system proposes an encrypted data closure design, which allows for the decryption of encrypted data within the data closure without requiring additional information. The data closure is the smallest unit for transmitting encrypted data between multiple machines. The data closure consists of encrypted data and a corresponding portable integrity protection tree. The portable integrity protection tree consists of a root node and all intermediate nodes. Upon receiving a memory access request, the corresponding memory data and the metadata of the integrity protection tree are indexed through the physical address in the request.

[0033] Compared with the prior art, the present invention has the following beneficial effects:

[0034] 1. This invention proposes and designs an efficient remote encrypted memory transfer method, which reduces redundant software encryption, thereby greatly improving the efficiency of encrypted data transfer and reducing the time required for a single transmission.

[0035] 2. This invention designs a novel integrity protection tree structure, which extends secure memory from a single node to multiple nodes, supporting scenarios such as distributed confidential computing;

[0036] 3. This invention proposes a new abstraction of encrypted data closure, thereby solving the problem in traditional memory encryption where remote machines cannot decrypt locally encrypted memory. Attached Figure Description

[0037] Other features, objects, and advantages of the present invention will become more apparent from the following detailed description of non-limiting embodiments with reference to the accompanying drawings:

[0038] Figure 1 This is a structural diagram of the Intel SGX integrity protection tree of the present invention;

[0039] Figure 2 Forest map for integrity protection in this invention;

[0040] Figure 3 This is a data closure diagram for the integrity protection of this invention;

[0041] Figure 4 This is a diagram of the data closure migration protocol of the present invention. Detailed Implementation

[0042] The present invention will now be described in detail with reference to specific embodiments. These embodiments will help those skilled in the art to further understand the present invention, but do not limit the invention in any way. It should be noted that those skilled in the art can make several changes and improvements without departing from the concept of the present invention. These all fall within the protection scope of the present invention.

[0043] Example 1:

[0044] According to the present invention, a method for transferring encrypted memory includes the following steps:

[0045] Step S1: The initiator of the source device establishes a communication channel with the receiver of the target device; a routing channel is established through the target device ID and the program function name, and a communication handle is returned.

[0046] Step S2: Set a common key as the root key of the integrity protection tree;

[0047] Step S3: The initiator informs the receiver of the data size, and the receiver allocates a receive buffer;

[0048] Step S4: The initiator sets the status of the integrity protection tree corresponding to the data to read-only and sets the root key; the receiver sets the status of the integrity protection tree corresponding to the receive cache to wait and sets the same root key.

[0049] Step S5: The initiator encrypts the root node of the integrity protection tree with a key and sends it to the receiver. The receiver uses the same key to verify the integrity of the root node data and decrypt the root node. If the verification is successful, proceed to step S6. If the verification fails, reject the subsequent operation.

[0050] Step S6: The initiator sends the encrypted memory and all intermediate nodes of the integrity protection tree to the receiver;

[0051] Step S7: After receiving all the data, the receiver returns an ACK signal to the initiator.

[0052] The process of adding a node to the integrity protection forest is called global verification. Global verification extends remote verification, which is used to measure whether the remote runtime environment is a trusted environment. In global verification, the node being verified prepares the state of its platform and the measurement values ​​of its software, signs it with the hardware identity key, and initiates a global verification request. An authoritative node will receive the request and judge the identity information in it. If the request comes from a trusted node and the measurement of the privileged software running on it meets the expectations, then all integrity protection subtrees in that node are added to the integrity protection forest. The authoritative node assigns a node ID to each node added to the integrity protection forest. This identifier is used to generate globally unique address information.

[0053] The integrity protection tree records the necessary data for encrypting and decrypting memory. Expanding the root node of the integrity protection tree adds three new data elements: state, key, and globally unique address.

[0054] The method proposes the design of encrypted data closures, which, once the data closure is acquired, can decrypt the encrypted data without requiring any additional information. The data closure is the smallest unit for transmitting encrypted data between multiple machines. The data closure consists of encrypted data and a corresponding portable integrity protection tree. The portable integrity protection tree consists of a root node and all intermediate nodes. When a memory access request is received, the corresponding memory data and the metadata of the integrity protection tree are indexed through the physical address in the request.

[0055] The present invention also provides a system for transmitting encrypted memory, which can be implemented by executing the process steps of the method for transmitting encrypted memory. That is, those skilled in the art can understand the method for transmitting encrypted memory as a preferred embodiment of the system for transmitting encrypted memory.

[0056] Example 2:

[0057] The present invention also provides a system for transmitting encrypted memory, the system comprising the following modules:

[0058] Module M1: The initiator of the source device establishes a communication channel with the receiver of the target device; it establishes a routing channel through the target device ID and the program function name, and returns a communication handle.

[0059] Module M2: Sets a common key, which serves as the root key for the integrity protection tree;

[0060] Module M3: The initiator informs the receiver of the data size, and the receiver allocates a receive buffer;

[0061] Module M4: The initiator sets the state of the integrity protection tree corresponding to the data to read-only and sets the root key; the receiver sets the state of the integrity protection tree corresponding to the receive buffer to wait and sets the same root key.

[0062] Module M5: The initiator encrypts the root node of the integrity protection tree with a key and sends it to the receiver. The receiver uses the same key to verify the integrity of the root node data and decrypt the root node. If the verification is successful, module M6 is triggered to perform its work. If the verification fails, subsequent operations are rejected.

[0063] Module M6: The initiator sends the encrypted memory and all intermediate nodes of the integrity protection tree to the receiver;

[0064] Module M7: After receiving all the data, the receiver returns an ACK signal to the initiator.

[0065] The process of adding a node to the integrity protection forest is called global verification. Global verification extends remote verification, which is used to measure whether the remote runtime environment is a trusted environment. In global verification, the node being verified prepares the state of its platform and the measurement values ​​of its software, signs it with the hardware identity key, and initiates a global verification request. An authoritative node will receive the request and judge the identity information in it. If the request comes from a trusted node and the measurement of the privileged software running on it meets the expectations, then all integrity protection subtrees in that node are added to the integrity protection forest. The authoritative node assigns a node ID to each node added to the integrity protection forest. This identifier is used to generate globally unique address information.

[0066] The integrity protection tree records the necessary data for encrypting and decrypting memory. Expanding the root node of the integrity protection tree adds three new data elements: state, key, and globally unique address.

[0067] The system proposes an encrypted data closure design. Once the data closure is acquired, the encrypted data within it can be decrypted without requiring any additional information. The data closure is the smallest unit for transmitting encrypted data between multiple machines. The data closure consists of encrypted data and a corresponding portable integrity protection tree. The portable integrity protection tree consists of a root node and all intermediate nodes. Upon receiving a memory access request, the corresponding memory data and the metadata of the integrity protection tree are indexed through the physical address in the request.

[0068] Example 3:

[0069] This invention proposes a portable integrity protection tree that directly transmits ciphertext without requiring encryption verification. Compared to existing trusted channel mechanisms, the portable integrity protection tree greatly reduces the overhead of transmitting confidential data, making the performance of ciphertext transmission essentially equivalent to that of plaintext transmission.

[0070] This invention designs a mechanism for mutual authentication among multiple nodes. After authentication, a node can join a trusted computing cluster and generate a unique identifier. It proposes the concept of a cross-node integrity protection forest, extending the single-node integrity protection tree to multiple nodes, thus realizing multi-node distributed trusted memory. It designs a portable integrity protection tree structure, enabling the integrity protection tree to migrate between multiple nodes while simultaneously performing normal encryption and decryption of the protected memory. Finally, it proposes a protection protocol for trusted memory migration, ensuring the security, confidentiality, integrity, and protection against replay attacks for both confidential data and metadata such as integrity protection trees during untrusted network transmission.

[0071] In Intel SGX technology, the root node of the integrity protection tree is stored in the processor. Because processor space is precious and limited, only a limited amount of data can be stored. Therefore, the metadata for the entire integrity protection system is organized in a tree structure. Each node in the tree structure consists of eight 56-bit version numbers and a 64-bit hash value. In the Intel SGX integrity protection tree, a parent node can store the version numbers of eight child nodes and the hash value used to verify data integrity; therefore, each level of nodes can represent eight child nodes.

[0072] In the integrity protection tree, the hash value of all nodes except the root node is calculated by combining the version numbers of the current node and the version number of the corresponding parent node. For the root node and intermediate nodes, each version number is responsible for the information of one child node; for leaf nodes, each version number in the node is responsible for a data block, the size of which is 64 bytes. The content of the data block and the corresponding version number can be used to calculate the Message Authentication Code (MAC) stored in memory for integrity checks during data read and write operations.

[0073] This invention proposes the concept of a cross-node integrity protection forest, extending the integrity protection tree in SGX to multiple nodes / machines, enabling distributed trusted memory. First, the integrity protection forest consists of numerous subtrees, which are the smallest units within the forest. Different subtrees can reside on the same node or on different nodes. When a subtree is added to the integrity protection forest, it signifies that the memory it corresponds to is safe memory. Of course, when integrity protection subtrees from different nodes are added to the integrity protection forest, a strict authentication mechanism is required to ensure the security of the entire integrity protection forest.

[0074] Global Validation: The process of adding a node to the integrity protection forest is called global validation. Global validation extends remote attestation, which is used to measure whether a remote runtime environment is trusted (the code runs on a specified hardware platform, and the software code is the expected code). In global validation, the node being validated first prepares the state of its platform and the metrics of its software, then signs the request with its hardware identity key and initiates a global validation request. An authoritative node receives the request and determines the identity information within it. If the request originates from a trusted node and the privileged software running on it meets the expected metrics, then all integrity protection subtrees of that node can be added to the integrity protection forest. The authoritative node assigns a node ID to each node added to the integrity protection forest; this identifier is later used to generate a globally unique address.

[0075] Globally Unique Address: In the related technical background and issues section, the crucial role of OTP in memory encryption was explained. When we extend memory encryption from a single node to multiple nodes, addresses may be duplicated across different machines, thus compromising the properties of OTP. Therefore, we need to improve the single-node OTP to ensure its spatiotemporal uniqueness across multiple nodes (multiple machines). Here, we introduce the concept of a globally unique address, which is composed of a globally unique identifier (node ​​ID) plus a locally auto-incrementing address. For a given node (single machine), because the local address is auto-incrementing, there is no possibility of duplication. For different nodes (multiple machines), because the globally unique identifier is different, there is also no possibility of duplication. The globally unique address guarantees the availability of OTP in distributed scenarios.

[0076] Portable Integrity Protection Tree Structure: To enable encrypted memory to be directly migrated across different machines, this invention designs a portable integrity protection tree structure. The integrity protection tree records the necessary data elements for encrypting and decrypting memory (counter value and MAC value). However, existing integrity protection trees cannot be migrated between different machine nodes; when an integrity protection tree is migrated to another machine, the data in the corresponding encrypted memory cannot be decrypted. To enable the integrity protection tree to be migrated across different machine nodes, we extend the root node of the integrity protection tree by adding three new data elements: state, key, and globally unique address.

[0077] The integrity protection tree has four states: valid, invalid, read-only, and waiting. Valid and invalid indicate whether the physical memory corresponding to the integrity protection tree is safe memory. The read-only state means the corresponding physical memory is safe and cannot be modified. The waiting state means the physical memory is safe but does not contain data; its data is waiting to be transferred from a remote node.

[0078] Integrity protection tree key: This key is user-defined and is consistent with the user-negotiated key in the TLS / SSL protocol.

[0079] Globally unique address: as explained in the previous paragraph.

[0080] Encrypted Data Closure: This invention proposes the design of an encrypted data closure. Once the data closure is obtained, the encrypted data within can be decrypted without requiring any additional information. The data closure is the smallest unit for transmitting encrypted data between multiple machines. For example... Figure 3As shown in the diagram, the integrity protection data closure consists of encrypted data and a corresponding portable integrity protection tree. The portable integrity protection tree itself comprises a root node and all intermediate nodes. Upon receiving a memory access request, the corresponding memory data and the metadata of the integrity protection tree can be indexed using the physical address in the request.

[0081] Encrypted Data Closure Migration Protocol: While data closures ensure that remote nodes can directly decrypt the encrypted memory, they do not guarantee data security during transmission. Therefore, this invention designs a protocol framework to protect the confidentiality and integrity of data closures transmitted over untrusted networks, as well as to defend against replay attacks. Figure 4 The data closure migration protocol illustrates that there are two parties involved: the initiator at the source and the receiver at the target. The initiator needs to send confidential data to the receiver via an untrusted high-speed network. The specific process is as follows:

[0082] A. The initiator of the source device establishes a communication channel with the receiver of the target device. The routing channel is established through the target device ID and the program function name, and a communication handle is returned.

[0083] B. Both parties agree on a common key, which will be used as the root key of the integrity protection tree.

[0084] C. The initiator informs the receiver of the data size, and the receiver allocates a receiving buffer.

[0085] D. The initiator sets the status of the integrity protection tree corresponding to the sent data to read-only and sets the root key. The receiver sets the status of the integrity protection tree corresponding to the received cache to wait and sets the same root key.

[0086] E. The initiator encrypts the root node of the integrity protection tree with a key and sends it to the receiver. The receiver uses the same key to verify the integrity of the root node data and decrypt the root node. If the verification is successful, proceed to F; if the verification fails, reject the subsequent operation.

[0087] F. The initiator sends the encrypted memory and all intermediate nodes of the integrity protection tree to the receiver.

[0088] G. After receiving all the data, the receiver returns an ACK signal to the initiator.

[0089] Programming Models Based on Encrypted Data Closure Migration: For data closure migration protocols, this invention designs two programming models: the ownership transfer model and the sender-receiver model.

[0090] Ownership Transfer Model: In this model, the initiator transfers ownership of its confidential data to the receiver. Once the receiver receives the data, the initiator no longer owns it, meaning the initiator cannot modify the data after it has been sent. This model ensures that at any given time, there is only one owner for the data, guaranteeing data security.

[0091] Sender-receiver pattern: In this pattern, the sender delivers a read-only backup of the data to the receiver. The receiver can only read the content; if it wants to modify it, it needs to make a writable copy. This pattern does not involve intrusive modifications to the sender and is suitable for current network communication methods where the sender needs to send messages to the receiver in multiple rounds, i.e., the sender-receiver pattern.

[0092] The data closure migration protocol designed in this invention supports both programming modes mentioned above. By setting different ACK return messages and integrity protection tree states, ownership of the integrity protection tree can be transferred, and read-only data backups can be delivered.

[0093] Hardware Extensions for Encrypted Data Closure Migration: The hardware extensions involved in this invention mainly include: a memory controller, a memory encryption engine, and a remote memory access controller (RDMA controller). This invention requires implementing functions such as verification and encryption of the migrateable integrity protection tree within the memory controller. Since the state and key of the integrity protection tree root node can be defined by software, the memory controller can set relevant metadata through specific memory instructions. For the memory encryption engine, a structure similar to traditional counter-type integrity protection trees (e.g., Intel SGX, Penglai memory security architecture, etc.) is adopted, but the root node composition is extended. Simultaneously, to achieve data closure migration, this invention requires extending the remote memory access controller. For a single encrypted data packet migration request, the remote memory controller not only needs to send the memory data itself but also needs to index the corresponding integrity protection tree metadata and pass the data closure to the remote node. Furthermore, the root node of the integrity protection tree needs to be encrypted before being sent to the remote node. Similarly, the remote node needs to perform corresponding decryption and verification operations.

[0094] Software Interface for Encrypted Data Closure Migration: To better enable hardware expansion, this invention proposes a software interface for encrypted data closure migration. We provide three high-level abstractions: connection, preparation, and delegation. In the connection interface, the initiator sends a connection request based on the target IP and receiver ID. After the connection is established, the initiator and receiver agree on the same key through key negotiation. In the preparation interface, the initiator sends the size of the data to be transferred to the receiver, and the receiver returns the target address. Both parties set their respective integrity protection trees to read-only and wait states, respectively. The delegation interface supports two different programming modes: ownership transfer and sender-receiver mode. The initiator determines the data to be transferred, the target node, and the remote address through the corresponding API, sends the corresponding memory data and metadata to the remote machine, and confirms whether the remote machine has received the data. These three high-level software interfaces provide excellent encapsulation of the underlying hardware interfaces, facilitating direct code calling and porting by developers.

[0095] SSL / TLS encrypted channel technology is currently the mainstream encrypted communication method. Establishing a confidential channel mainly involves the following steps: 1.) Both parties establish separate connections and negotiate a common key pair through a key exchange protocol for subsequent encryption and decryption operations; 2. Both parties choose the same encryption and decryption algorithm, with AES-GCM being the primary encryption and verification algorithm. This algorithm uses a counter mode, supporting concurrent encryption operations on data blocks without relying on previous data blocks. To ensure integrity, a corresponding MAC value is sent with each message, ensuring that the ciphertext is not tampered with during transmission (key not leaked); 3. The sender encrypts the data using the encryption algorithm and writes it to the communication channel. Upon receiving the ciphertext, the receiver uses the same key and encryption / decryption algorithm to decrypt it, thus obtaining the plaintext data. Encrypted channel technology allows two parties to send confidential data using untrusted communication channels without worrying about the confidentiality and integrity of the data.

[0096] VAULT technology is a state-of-the-art integrity protection scheme. Through a heterogeneous tree node structure, different levels of the integrity protection tree have different fan-outs, thus expanding the scope of integrity protection. VAULT performs memory integrity checks based on memory version and MAC (Memory Access Code). Compared to traditional Merkle trees, version-based integrity protection trees can have a larger fan-out. However, because version numbers can be exhausted, it poses a security risk. Therefore, VAULT uses more version numbers for higher-level nodes to slow down the rate of version number exhaustion. Although VAULT improves the size of memory integrity protection, like other integrity protection trees, it only supports single nodes and cannot achieve encrypted memory transfer across nodes.

[0097] An efficient method for transmitting encrypted memory includes: proposing a cross-node integrity protection forest structure that supports encrypted memory across nodes, thereby extending memory integrity protection from a single node to multiple nodes; proposing a global verification method to verify whether a remote node is a trusted node and can join the integrity protection forest, while designing a globally unique address generation method to ensure that the integrity protection trees in different nodes have globally unique identifiers; proposing a new root node structure for the integrity protection tree, enabling it to migrate to different nodes, which discards metadata bound to a specific CPU; proposing an encrypted data closure design, which allows decryption of encrypted data without relying on other metadata, and the encrypted data closure is the key aspect to be protected in this invention; and to ensure the security of encrypted data closure transmission in untrusted networks, this invention designs an encrypted data closure transmission protocol that protects the confidentiality, integrity, and replay attack prevention of closures in untrusted environments.

[0098] This invention proposes two modes of encrypted memory transfer: an ownership transfer model and a sender-receiver model, enabling it to cope with different distributed processing scenarios.

[0099] Those skilled in the art can understand this embodiment as a more specific description of Embodiment 1 and Embodiment 2.

[0100] Those skilled in the art will understand that, besides implementing the system and its various devices, modules, and units provided by this invention in the form of purely computer-readable program code, the same functions can be achieved entirely through logical programming of the method steps, making the system and its various devices, modules, and units of this invention function in the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers. Therefore, the system and its various devices, modules, and units provided by this invention can be considered as a hardware component, and the devices, modules, and units included therein for implementing various functions can also be considered as structures within the hardware component; alternatively, the devices, modules, and units for implementing various functions can be considered as both software modules implementing the method and structures within the hardware component.

[0101] Specific embodiments of the present invention have been described above. It should be understood that the present invention is not limited to the specific embodiments described above, and those skilled in the art can make various changes or modifications within the scope of the claims, which do not affect the essence of the present invention. Unless otherwise specified, the embodiments and features described in this application can be arbitrarily combined with each other.

Claims

1. A method of passing encrypted memory, characterized by, The method comprises the following steps: Step S1: an initiator of a source device establishes a communication channel with a receiver of a target device; Step S2: a common key is set as a root key of an integrity protection tree; Step S3: the initiator informs the receiver of a data size, and the receiver allocates a receiving buffer; Step S4: the initiator sets a state of an integrity protection tree corresponding to data as read-only and sets the root key, and the receiver sets a state of an integrity protection tree corresponding to the receiving buffer as waiting and sets the same root key; Step S5: the initiator transmits a root node of the integrity protection tree to the receiver after encrypting the root node with a key, the receiver verifies the integrity of the root node data and decrypts the root node with the same key, if the verification is passed, the step S6 is performed, and if the verification is not passed, subsequent operations are rejected; Step S6: the initiator transmits encrypted memory and all intermediate nodes of the integrity protection tree to the receiver; Step S7: the receiver returns an ACK signal to the initiator after receiving all data.

2. The method of transferring encrypted memory of claim 1, wherein, The step S1 establishes a routing channel through a target device ID and a program function name, and returns a communication handle.

3. The method of transferring encrypted memory of claim 1, wherein, The process of adding a node to the integrity protection forest is called global verification. The global verification is extended from remote verification. The remote verification is used to measure whether a remote running environment is a trusted environment. In the global verification, a node to be verified prepares a state of a platform and a measurement value of software of the node, signs the state and the measurement value with a hardware identity key, and initiates a global verification request. An authoritative node receives the request and judges identity information in the request. If the request is from a trusted node and a measurement of privileged software running in the node meets an expectation, all integrity protection sub-trees in the node are added to the integrity protection forest. The authoritative node allocates a node ID to each node added to the integrity protection forest. The node ID is used to generate a globally unique address information.

4. The method of transferring encrypted memory of claim 1, wherein, The integrity protection tree records required element data of encrypted and decrypted memory. The root node of the integrity protection tree is extended, and three new element data, i.e., a state, a key, and a globally unique address, are added.

5. The method of transferring encrypted memory of claim 1, wherein, The method proposes a design of encrypted data closure. After the data closure is obtained, encrypted data in the data closure can be decrypted without other additional information. The data closure is a minimum unit of encrypted data transferred between multiple machines. The data closure is composed of encrypted data and a corresponding migratable integrity protection tree. The migratable integrity protection tree is composed of a root node and all intermediate nodes. When a memory access request is received, a physical address in the request is used to index corresponding memory data and metadata of the integrity protection tree.

6. A system for delivering encrypted memory, the system comprising: The system comprises the following modules: Module M1: an initiator of a source device establishes a communication channel with a receiver of a target device; Module M2: a common key is set as a root key of an integrity protection tree; Module M3: the initiator informs the receiver of a data size, and the receiver allocates a receiving buffer; Module M4: the initiator sets a state of an integrity protection tree corresponding to data as read-only and sets the root key, and the receiver sets a state of an integrity protection tree corresponding to the receiving buffer as waiting and sets the same root key; Module M5: the initiator transmits the root node of the integrity protection tree to the receiver after encrypting it with a key, the receiver verifies the integrity of the root node data and decrypts the root node with the same key, if the verification is passed, triggers module M6 to perform work, if the verification is not passed, rejects the subsequent operation; Module M6: the initiator sends the encrypted memory and all intermediate nodes of the integrity protection tree to the receiver; Module M7: the receiver returns an ACK signal to the initiator after receiving all the data.

7. The system for passing encrypted memory according to claim 6, wherein, The module M1 establishes a routing channel through the target end device ID and the program function name, and returns a communication handle.

8. The system for passing encrypted memory of claim 6, wherein, The process of adding a node to the integrity protection forest is called global verification, which is an extension of remote verification. Remote verification is used to measure whether the remote running environment is a trusted environment. In global verification, the node to be verified prepares the state of its platform and the measurement value of the software, signs it with a hardware identity key, and initiates a global verification request. An authoritative node will receive the request and judge the identity information in it. If the request comes from a trusted node and the measurement of the privileged software running in it meets the expectations, all integrity protection sub-trees in the node will be added to the integrity protection forest. The authoritative node assigns a node id to each node added to the integrity protection forest. This identifier is used to generate a globally unique address information.

9. The system for passing encrypted memory of claim 6, wherein, The integrity protection tree records the required element data of the encrypted and decrypted memory. The root node of the extended integrity protection tree adds three new elements: state, key, and globally unique address.

10. The system for passing encrypted memory of claim 6, wherein, The system proposes the design of encrypted data closure. Once the data closure is obtained, the encrypted data in it can be decrypted without additional information. Data closure is the smallest unit of encrypted data transmission between multiple machines. Data closure is composed of encrypted data and corresponding migratable integrity protection trees. The migratable integrity protection tree is composed of a root node and all intermediate nodes. When receiving a memory access request, the corresponding memory data and integrity protection tree metadata are indexed through the physical address in the request.

Images