Method and system for using cross-domain virtual NVMe device, terminal and medium

Abstract

The invention discloses a using method and system of cross-domain virtual NVMe equipment, a terminal and a medium, and relates to the technical field of confidential computing. Obtaining an I / O command of the NVMe equipment through the control bridge, and judging whether to execute security enhancement operation according to a data address of the I / O command; if so, judging the operation type of the I / O command; if the operation type is a write operation, determining to-be-written data according to the I / O command, encrypting the to-be-written data, and then writing the encrypted to-be-written data into the NVMe storage unit; and if the operation type is read operation, reading data from the NVMe storage unit according to the I / O command, decrypting the read data, and outputting the decrypted data to an equipment lender bus. The security enhancement operation is added to the control bridge to encrypt the data written into the NVMe equipment, and the data read from the NVMe equipment is correspondingly decrypted and then sent out. The problem of data storage security in a cross-bus domain NVMe equipment virtual scene is solved.

Description

Technical Field

[0001] The present invention relates to the field of confidential computing technology, and in particular to a method, system, terminal and medium for using a cross-domain virtual NVMe device. Background Art

[0002] The device virtualization of the PCI-Express (PCIe) bus standard refers to the device borrower generating a corresponding virtual device locally through virtualization technology based on the physical device (i.e., virtualized device) in the device lender. In this cross-bus domain device virtualization scenario, the data actually used by the virtualized device is all in plain text, and there is no security issue in devices like GPUs that provide computing power but do not store persistent data. However, for NVMe devices (NVMExpress, NVMe, or non-volatile memory host controller interface specification), its purpose is to store persistent data. When the data stored in the NVMe device is in plain text, once the device borrower no longer uses the NVMe device, other access sources can easily obtain the plain text data stored in the NVMe, which is prone to data security issues.

[0003] Therefore, the existing technology still needs to be improved and developed. Summary of the invention

[0004] The technical problem to be solved by the present invention is that, in view of the above-mentioned defects of the prior art, a method, system, terminal and medium for using a cross-domain virtual NVMe device are provided, aiming to solve the data storage security problem in the virtual scenario of NVMe devices across bus domains in the prior art.

[0005] The technical solution adopted by the present invention to solve the problem is as follows: In a first aspect, an embodiment of the present invention provides a method for using a cross-domain virtual NVMe device, the method comprising: Obtaining an I / O command corresponding to the NVMe device through a control bridge, and determining whether to perform a security enhancement operation according to a data address of the I / O command; wherein the control bridge is used to connect a bus of a device lender and the NVMe device; If the security enhancement operation is performed, determining the operation type corresponding to the I / O command; If the operation type is a write operation, the data to be written is determined according to the I / O command, and the data to be written is encrypted before being written into the storage unit of the NVMe device; If the operation type is a read operation, data is read from the storage unit of the NVMe device according to the I / O command, and the read data is decrypted and then output to the bus of the device lender.

[0006] In one implementation, determining whether to perform a security enhancement operation according to a data address of the I / O command includes: Determining whether the data address of the I / O command is located in a preset security enhanced address area; If the data address of the I / O command is located in the security enhanced address area, a security enhanced operation is performed.

[0007] In one embodiment, the transmission data between the control bridge and the bus of the device lender is data encrypted with a first key, the data to be written is determined according to the I / O command, and the data to be written is encrypted and then written into the storage unit of the NVMe device, including: Determine the data to be written according to the I / O command, and decrypt the data to be written according to the first key to obtain the decrypted data to be written; The decrypted data to be written is encrypted according to a preset second key and then written into the storage unit of the NVMe device.

[0008] In one embodiment, reading data from the storage unit of the NVMe device according to the I / O command, decrypting the read data and then outputting it to the bus of the device lender includes: Reading data from a storage unit of the NVMe device according to the I / O command, and decrypting the read data according to the second key to obtain decrypted data to be sent; The decrypted data to be sent is encrypted according to the first key and then output to the bus of the device lender.

[0009] In one implementation, the device borrower includes a virtual NVMe device corresponding to the NVMe device, and the registration method corresponding to the security enhanced address area includes: Obtain a submission request for an I / O command of the virtual NVMe device intercepted by the device borrower; The data address of the intercepted I / O command is registered in the security enhanced address area.

[0010] In one implementation, the deregistration method corresponding to the security enhanced address area includes: Obtaining a status of an I / O command processed by a driver of the virtual NVMe device intercepted by the device borrower; Determine whether the state of the intercepted I / O command is a completion state, and if so, cancel the corresponding registration address in the security enhanced address area.

[0011] In one embodiment, the write operation and the read operation are performed by the controller and the DMA engine of the NVMe device; the DMA engine is used to read data from a source address through a bus of the device lender, or write data to a destination address through a bus of the device lender; the controller is used to write data to a storage unit of the NVMe device, or read data from a storage unit of the NVMe device.

[0012] In a second aspect, an embodiment of the present invention further provides a system for using a cross-domain virtual NVMe device, the system comprising: a device borrower, a device lender, a connection bridge and a control bridge, the device borrower comprising a virtual NVMe device, the device lender comprising a virtualized NVMe device, the connection bridge being used to connect buses corresponding to the device borrower and the device lender, respectively, the control bridge being used to connect the NVMe device and the bus of the device lender, wherein the control bridge comprises: A command analysis module, used to obtain an I / O command corresponding to the NVMe device through a control bridge, and determine whether to perform a security enhancement operation according to a data address of the I / O command; wherein the control bridge is used to connect a bus of a device lender and the NVMe device; A type determination module, configured to determine the type of operation corresponding to the I / O command if the security enhancement operation is performed; A write operation module, for determining the data to be written according to the I / O command if the operation type is a write operation, and encrypting the data to be written before writing it into the storage unit of the NVMe device; A read operation module is used to read data from the storage unit of the NVMe device according to the I / O command if the operation type is a read operation, decrypt the read data and then output it to the bus of the device lender.

[0013] In a third aspect, an embodiment of the present invention further provides a terminal, comprising a memory and one or more processors; the memory stores one or more programs; the program includes instructions for executing a method for using a cross-domain virtual NVMe device as described in any of the above; and the processor is used to execute the program.

[0014] In a fourth aspect, an embodiment of the present invention further provides a computer-readable storage medium on which a plurality of instructions are stored, wherein the instructions are suitable for being loaded and executed by a processor to implement the steps of a method for using a cross-domain virtual NVMe device as described in any of the above.

[0015] Beneficial effects of the present invention: The embodiment of the present invention adds a security enhancement operation to the control bridge for the NVMe device virtual scenario across bus domains, so as to encrypt the data written to the NVMe device by the device borrower. At the same time, in order to ensure the normal use of the read data, the data read from the NVMe device is decrypted accordingly before being sent out. By adding a security enhancement operation to the control bridge, the present invention additionally provides a security guarantee method for storing data in the NVMe device, thereby solving the data storage security problem in the NVMe device virtual scenario across bus domains. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0017] Figure 1 It is a flow chart of a method for using a cross-domain virtual NVMe device provided by an embodiment of the present invention.

[0018] Figure 2 It is a structural diagram of a system for using a cross-domain virtual NVMe device provided by an embodiment of the present invention.

[0019] Figure 3 It is a principle block diagram of a terminal provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0020] The present invention discloses a method, system, terminal and medium for using a cross-domain virtual NVMe device. In order to make the purpose, technical solution and effect of the present invention clearer and more specific, the present invention is further described in detail with reference to the accompanying drawings and examples. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0021] It will be understood by those skilled in the art that, unless expressly stated, the singular forms "one", "said", and "the" used herein may also include plural forms. It should be further understood that the term "comprising" used in the specification of the present invention refers to the presence of the features, integers, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or groups thereof. It should be understood that when we refer to an element as being "connected" or "coupled" to another element, it may be directly connected or coupled to the other element, or there may be intermediate elements. In addition, the "connection" or "coupling" used herein may include wireless connection or wireless coupling. The term "and / or" used herein includes all or any unit and all combinations of one or more associated listed items.

[0022] It will be understood by those skilled in the art that, unless otherwise defined, all terms (including technical and scientific terms) used herein have the same meaning as generally understood by those skilled in the art in the art to which the present invention belongs. It should also be understood that terms such as those defined in general dictionaries should be understood to have meanings consistent with the meanings in the context of the prior art, and will not be interpreted with idealized or overly formal meanings unless specifically defined as herein.

[0023] The device virtualization of the PCI-Express (PCIe) bus standard refers to the device borrower generating a corresponding virtual device locally through virtualization technology based on the physical device (i.e., virtualized device) in the device lender. In this cross-bus domain device virtualization scenario, the data actually used by the virtualized device is all in plain text, and there is no security issue in devices like GPUs that provide computing power but do not store persistent data. However, for NVMe devices, the purpose is to store persistent data. When the data stored in the NVMe device is in plain text, once the device borrower no longer uses the NVMe device, other access sources can easily obtain the plain text data stored in the NVMe, which is prone to data security issues.

[0024] In view of the above-mentioned defects of the prior art, the present invention provides a method for using a cross-domain virtual NVMe device, the method comprising: obtaining the I / O command corresponding to the NVMe device through a control bridge, and judging whether to perform a security enhancement operation according to the data address of the I / O command; wherein the control bridge is used to connect the bus of the device lender and the NVMe device; if the security enhancement operation is performed, the operation type corresponding to the I / O command is judged; if the operation type is a write operation, the data to be written is determined according to the I / O command, and the data to be written is encrypted and then written into the storage unit of the NVMe device; if the operation type is a read operation, the data is read from the storage unit of the NVMe device according to the I / O command, and the read data is decrypted and then output to the bus of the device lender. The present invention is aimed at the virtual scenario of NVMe devices across bus domains, and a security enhancement operation is added to the control bridge to realize the encryption of the data written to the NVMe device by the device borrower. At the same time, in order to ensure the normal use of the read data, the data read from the NVMe device is decrypted accordingly before being sent out. The present invention provides an additional security guarantee method for storing data in NVMe devices by adding security enhancement operations to the control bridge, thereby solving the data storage security problem in a virtual scenario of NVMe devices across bus domains.

[0025] For example, the bus of the device lender is mounted with a virtualized NVMe device through a control bridge. In order to borrow the NVMe device, the device borrower generates a virtual NVMe device corresponding to the NVMe device through virtualization technology. The device lender and the device borrower implement cross-bus domain device access through a connection bridge. In actual application scenarios, the control bridge of the NVMe device will first receive the I / O command of the NVMe device. When the control bridge determines that the data address corresponding to the I / O command is the device borrower, the security enhancement operation is started. After the security enhancement operation is started, the control bridge will encrypt all data written to the NVMe device and decrypt all data read from the NVMe device, thereby ensuring data storage security and normal data use in the cross-bus domain NVMe device virtual scenario.

[0026] like Figure 1 As shown, the method specifically comprises the following steps: Step S100, obtaining an I / O command corresponding to the NVMe device through a control bridge, and determining whether to perform a security enhancement operation according to a data address of the I / O command; wherein the control bridge is used to connect a bus of a device lender with the NVMe device.

[0027] Specifically, this embodiment uses a control bridge to mount the NVMe device in the device lender to the bus, and the NVMe device implements data storage through the NVMe storage unit. In actual application scenarios, when the control bridge receives an I / O command from the NVMe device, it first parses the data address of the operation command, and determines whether the security enhancement operation needs to be started based on the data address, so as to start the security enhancement operation for the specific data address in time to ensure the data security of the device borrower.

[0028] In one implementation, determining whether to perform a security enhancement operation according to a data address of the I / O command includes: Determining whether the data address of the I / O command is located in a preset security enhanced address area; If the data address of the I / O command is located in the security enhanced address area, a security enhanced operation is performed.

[0029] Specifically, the control bridge provides a security-enhanced address area, and the security-enhanced address area can be stored through registers. In actual application scenarios, the virtualized NVMe device accesses all external PCIe devices through the control bridge. As long as the address is within the range of the security-enhanced address area, the control bridge will perform security-enhanced operations on the payload (actual data) of the access. Similarly, access to all external PCIe devices also needs to be forwarded to the NVMe device through the control bridge. As long as the data address of the I / O command received by the control bridge is within the range of the security-enhanced address area, the control bridge will also start to implement the security-enhanced operation.

[0030] Furthermore, the design of the security enhancement operation in this embodiment is based on the working mode and command processing mode of NVMe. The working mode of NVMe is: the NVMe device completes data interaction with the host (Host) through a queue pair, including SQ (Submission Queue) and CQ (Completion Queue). SQ is used to store commands sent by the host, and CQ is used to record command execution results. The host submits commands through SQ, and at the same time writes the DB register (Doorbell Register) in the NVMe controller (NVMe Controller) to notify the NVMe controller to process. The NVMe controller submits the command completion status through CQ, and at the same time notifies the host to process CQ in an interrupt manner. After the host completes the processing, it writes the DB register to notify the NVMe controller of the completion of the processing.

[0031] Furthermore, NVMe devices can also have two queue pairs, Admin queue and I / O queue (or NVMe queue). The Admin queue is used to process Admin instructions, and the I / O queue is used to process I / O instructions. Among them, the Admin instruction is mainly responsible for managing the NVMe controller, and also includes some control instructions for NVMe, including: creating output I / O queues, obtaining logs, setting feature parameters (features), firmware management, etc. There is only one Admin queue, which is configured by the host through the registers of SSD (Solid State Drives, SSD, solid state drive), including Admin Queue Attributes (AQA, Admin queue attributes, including SQ size and CQ size), Admin Submission Queue Base Address (ASQ, Admin SQ base address) and Admin Completion Queue Base Address (ACQ, Admin CQ base address). I / O instructions are mainly responsible for completing data transmission, including: Flush (request to change the contents of the volatile write cache to non-volatile), Write (write data), Read (read data), Write Uncorrectable (write error), Compare (read data and compare the read data with the incoming comparison data buffer), Dataset Management (specify the properties of the logical block address range), etc. The maximum number of I / O queues is 65536, which is configured by the host through the Admin command. The command format of NVMe is: the size of each command is 64 bytes, and the corresponding completion message (completion message) is 16 bytes long.

[0032] Furthermore, the NVMe command processing method is: a. The host writes commands to SQ; b. The host writes to the DB register to notify the SSD to obtain instructions; c. SSD receives notification from DB and obtains instructions from SQ; d.SSD executes instructions; e. SSD completes instruction execution and writes instruction completion status to CQ; f. The SSD notifies the Host through an interrupt (such as MSI-X) to obtain the instruction completion status; g. The host obtains the instruction completion status through CQ and processes it; h. The host writes to the DB register to notify the SSD of the command completion status and the processing is complete.

[0033] In one implementation, the device borrower includes a virtual NVMe device corresponding to the NVMe device, and the registration method corresponding to the security enhanced address area includes: Obtain a submission request for an I / O command of the virtual NVMe device intercepted by the device borrower; The data address of the intercepted I / O command is registered in the security enhanced address area.

[0034] Specifically, the device borrower generates a virtual NVMe device corresponding to the NVMe device through virtualization technology. When the device borrower needs to access the NVMe device, it will first send an I / O command submission request to the driver of the virtual NVMe device. In order to ensure the data security of the device borrower, the device borrower will intercept the request of the driver of the virtual NVMe device to submit the I / O command through the "Submission Queue", and then parse the command, register the actual data address area in the command to the security enhanced address area of ​​the control bridge, and then submit the I / O command. This ensures that when the command is executed, the address area actually accessed by the command has been registered in the security enhanced address area of ​​the control bridge. Since the relevant address area has been marked as requiring security protection, the control bridge will initiate a security enhancement operation for the I / O command to ensure that the device borrower can safely access the virtualized NVMe device and the security of the data written to the NVMe device.

[0035] In one implementation, the deregistration method corresponding to the security enhanced address area includes: Obtaining a status of an I / O command processed by a driver of the virtual NVMe device intercepted by the device borrower; Determine whether the state of the intercepted I / O command is a completion state, and if so, cancel the corresponding registration address in the security enhanced address area.

[0036] Specifically, when an I / O command is completed, the corresponding address area needs to be deregistered in time to release resources and ensure the normal execution of other subsequent I / O commands that need to be securely protected. When an I / O command is completed, the completion status of the I / O command is placed in the Completion Queue so that the driver can retrieve and process these states. The device borrower intercepts the driver of the virtual NVMe device's processing of the I / O command completion status in the Completion Queue, and after the processing is completed, deregisters the address area registered by the I / O command in the security-enhanced address area.

[0037] Step S200: If the security enhancement operation is performed, determine the operation type corresponding to the I / O command.

[0038] Step S300: If the operation type is a write operation, the data to be written is determined according to the I / O command, and the data to be written is encrypted and then written into the storage unit of the NVMe device.

[0039] Step S400: If the operation type is a read operation, data is read from the storage unit of the NVMe device according to the I / O command, and the read data is decrypted and then output to the bus of the device lender.

[0040] Specifically, security enhancement operation refers to additional measures taken to improve the security of data when executing specific I / O commands. Before executing the security enhancement operation, it is first necessary to determine the operation type of the I / O command, which is generally divided into read operation and write operation. If the operation type of the I / O command is a write operation, the data needs to be encrypted before it is written to the NVMe storage unit, so that the write data corresponding to the I / O command in the NVMe storage unit is stored in ciphertext form, so that even if the data is illegally obtained, the true content of the data cannot be directly read, thereby ensuring the security of the data during the storage process. If the operation type of the I / O command is a read operation, the relevant data needs to be read from the NVMe storage unit. Since the read data is in ciphertext form, in order to ensure the normal use of the data, it needs to be decrypted after reading and then output to the bus of the device lender. The encryption and decryption operations of the security enhancement operation can be implemented through a preset communication key. In short, if the data transmitted between the control bridge and the virtualized NVMe device is in plain text, when the device borrower no longer uses the virtualized NVMe device (or the user directly installs the NVMe device on other machines), the data stored on the NVMe device by the device borrower can be easily stolen, so additional security methods are needed to ensure the security of the data stored on the NVMe device by the device borrower. In this embodiment, the data that needs to be security enhanced is the data stored in NVMe, and the commands that actually read and write the NVMe storage unit in the I / O commands need to be security enhanced, that is, the data written to the NVMe storage unit is encrypted, and the data read from the NVMe storage unit is decrypted.

[0041] In one implementation, the transmission data between the control bridge and the bus of the device lender is data encrypted with a first key, the data to be written is determined according to the I / O command, and the data to be written is encrypted before being written into the storage unit of the NVMe device, including: Determine the data to be written according to the I / O command, and decrypt the data to be written according to the first key to obtain the decrypted data to be written; The decrypted data to be written is encrypted according to a preset second key and then written into the storage unit of the NVMe device.

[0042] In one implementation, data is read from the storage unit of the NVMe device according to the I / O command, and the read data is decrypted and then output to the bus of the device lender, including: Reading data from a storage unit of the NVMe device according to the I / O command, and decrypting the read data according to the second key to obtain decrypted data to be sent; The decrypted data to be sent is encrypted according to the first key and then output to the bus of the device lender.

[0043] Specifically, in order to better ensure data security, this embodiment can simultaneously implement security operations between the control bridge and the bus of the device lender, as well as additional security enhancement operations of the control bridge itself. The security operation between the control bridge and the bus of the device lender is to encrypt and decrypt the transmitted data through a preset first key; the security enhancement operation of the control bridge is to encrypt the data written to the NVMe storage unit through a preset second key, and to decrypt the data read from the NVMe storage unit. The first key and the second key are independent communication keys, but can be obtained using similar acquisition methods. In the data input scenario (i.e., write operation), the security operation between the control bridge and the bus of the device lender occurs before the security enhancement operation of the control bridge, that is, after the bus transfers the data to the control bridge, the control bridge first decrypts the data through the first key, and then encrypts the decrypted data through the second key, and then writes the encrypted data into the NVMe storage unit. In the data output scenario (i.e., read operation), the security enhancement operation of the control bridge occurs before the security operation between the control bridge and the bus of the device lender, that is, after reading the data from the NVMe storage unit, the control bridge first decrypts the data using the second key, then encrypts the decrypted data using the first key, and then transmits the encrypted data to the bus. In short, the security operation between the control bridge and the bus of the device lender provides a method for the safe use of virtual devices across bus domains, which solves the security problem in the data calculation process. The additional security enhancement operation of the control bridge itself provides a method for the safe use of virtual NVMe devices across bus domains, which solves the security problem of the data stored in the NVMe device by the device borrower when the virtual device is an NVMe device.

[0044] In one implementation, the write operation and the read operation are performed by the controller and DMA engine of the NVMe device; the DMA engine is used to read data from a source address through a bus of the device lender, or write data to a destination address through a bus of the device lender; the controller is used to write data to a storage unit of the NVMe device, or read data from a storage unit of the NVMe device.

[0045] Specifically, the read and write operations of the NVMe storage unit are actually completed by the NVMe controller and DMA engine. The write operation is specifically: the DMA engine reads data from the source address through the PCIe bus, and then the controller writes it to the NVMe storage unit; the read operation is specifically: the controller reads data from the NVMe storage unit, and then the DMA engine writes the data to the destination address through the PCIe bus.

[0046] Based on the above embodiments, the present invention also provides a system for using a cross-domain virtual NVMe device, such as Figure 2 As shown, the system includes: a device borrower, a device lender, a connection bridge and a control bridge, the device borrower includes a virtual NVMe device, the device lender includes a virtualized NVMe device, the connection bridge is used to connect the buses corresponding to the device borrower and the device lender respectively, and the control bridge is used to connect the NVMe device and the bus of the device lender.

[0047] Specifically, the control bridge at least includes: A command analysis module, used to obtain an I / O command corresponding to the NVMe device through a control bridge, and determine whether to perform a security enhancement operation according to a data address of the I / O command; wherein the control bridge is used to connect a bus of a device lender and the NVMe device; A type determination module, configured to determine the type of operation corresponding to the I / O command if the security enhancement operation is performed; A write operation module, for determining the data to be written according to the I / O command if the operation type is a write operation, and encrypting the data to be written before writing it into the storage unit of the NVMe device; A read operation module is used to read data from the storage unit of the NVMe device according to the I / O command if the operation type is a read operation, decrypt the read data and then output it to the bus of the device lender.

[0048] Based on the above embodiment, the present invention further provides a terminal, whose principle block diagram can be shown as follows: Figure 3 As shown. The terminal includes a processor, a memory, a network interface, and a display screen connected through a system bus. Among them, the processor of the terminal is used to provide computing and control capabilities. The memory of the terminal includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The network interface of the terminal is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a method for using a cross-domain virtual NVMe device is implemented. The display screen of the terminal can be a liquid crystal display screen or an electronic ink display screen.

[0049] Those skilled in the art will understand that Figure 3 The principle block diagram shown in the figure is only a block diagram of a partial structure related to the scheme of the present invention, and does not constitute a limitation on the terminal to which the scheme of the present invention is applied. The specific terminal may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0050] In one implementation, one or more programs are stored in the memory of the terminal, and the one or more programs are configured to be executed by one or more processors, and the one or more programs include instructions for using a cross-domain virtual NVMe device.

[0051] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided by the present invention can include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

[0052] In summary, the present invention discloses a method, system, terminal and medium for using a cross-domain virtual NVMe device, and relates to the field of confidential computing technology. The method comprises: obtaining an I / O command corresponding to an NVMe device through a control bridge, and judging whether to perform a security enhancement operation according to the data address of the I / O command; wherein the control bridge is used to connect the bus of the device lender and the NVMe device; if the security enhancement operation is performed, the operation type corresponding to the I / O command is judged; if the operation type is a write operation, the data to be written is determined according to the I / O command, and the data to be written is encrypted and then written to the storage unit of the NVMe device; if the operation type is a read operation, the data is read from the storage unit of the NVMe device according to the I / O command, and the read data is decrypted and then output to the bus of the device lender. The present invention is aimed at the virtual scenario of NVMe devices across bus domains, and a security enhancement operation is added to the control bridge to realize encryption of data written to the NVMe device by the device borrower. At the same time, in order to ensure the normal use of the read data, the data read from the NVMe device is decrypted accordingly before being sent out. The present invention provides an additional security guarantee method for storing data in NVMe devices by adding security enhancement operations to the control bridge, thereby solving the data storage security problem in a virtual scenario of NVMe devices across bus domains.

[0053] It should be understood that the application of the present invention is not limited to the above examples. For ordinary technicians in this field, improvements or changes can be made based on the above description. All these improvements and changes should fall within the scope of protection of the claims attached to the present invention.

Claims

1. A method for using a cross-domain virtual NVMe device, characterized in that: The method comprises: Obtaining an I / O command corresponding to the NVMe device through a control bridge, and determining whether to perform a security enhancement operation according to a data address of the I / O command; wherein the control bridge is used to connect a bus of a device lender and the NVMe device; If the security enhancement operation is performed, determining the operation type corresponding to the I / O command; If the operation type is a write operation, the data to be written is determined according to the I / O command, and the data to be written is encrypted before being written into the storage unit of the NVMe device; If the operation type is a read operation, data is read from the storage unit of the NVMe device according to the I / O command, and the read data is decrypted and then output to the bus of the device lender.

2. The method for using a cross-domain virtual NVMe device according to claim 1, wherein: Determining whether to perform a security enhancement operation according to a data address of the I / O command includes: Determining whether the data address of the I / O command is located in a preset security enhanced address area; If the data address of the I / O command is located in the security enhanced address area, a security enhanced operation is performed.

3. The method for using a cross-domain virtual NVMe device according to claim 1, wherein: The transmission data between the control bridge and the bus of the device lender is data encrypted with a first key, the data to be written is determined according to the I / O command, and the data to be written is encrypted and then written into the storage unit of the NVMe device, including: Determine the data to be written according to the I / O command, and decrypt the data to be written according to the first key to obtain the decrypted data to be written; The decrypted data to be written is encrypted according to a preset second key and then written into the storage unit of the NVMe device.

4. The method for using a cross-domain virtual NVMe device according to claim 3, wherein: Reading data from the storage unit of the NVMe device according to the I / O command, decrypting the read data and then outputting it to the bus of the device lender, including: Reading data from a storage unit of the NVMe device according to the I / O command, and decrypting the read data according to the second key to obtain decrypted data to be sent; The decrypted data to be sent is encrypted according to the first key and then output to the bus of the device lender.

5. The method for using a cross-domain virtual NVMe device according to claim 2, wherein: The device borrower includes a virtual NVMe device corresponding to the NVMe device, and the registration method corresponding to the security enhanced address area includes: Obtain a submission request for an I / O command of the virtual NVMe device intercepted by the device borrower; The data address of the intercepted I / O command is registered in the security enhanced address area.

6. The method for using a cross-domain virtual NVMe device according to claim 5, characterized in that: The deregistration method corresponding to the security enhanced address area includes: Obtaining a status of an I / O command processed by a driver of the virtual NVMe device intercepted by the device borrower; Determine whether the state of the intercepted I / O command is a completion state, and if so, cancel the corresponding registration address in the security enhanced address area.

7. The method for using a cross-domain virtual NVMe device according to claim 6, wherein: The write operation and the read operation are performed by the controller and the DMA engine of the NVMe device; the DMA engine is used to read data from a source address through a bus of the device lender, or write data to a destination address through a bus of the device lender; The controller is used to write data to the storage unit of the NVMe device, or read data from the storage unit of the NVMe device.

8. A system for using a cross-domain virtual NVMe device, characterized in that: The system comprises: a device borrower, a device lender, a connection bridge and a control bridge, wherein the device borrower comprises a virtual NVMe device, the device lender comprises a virtualized NVMe device, the connection bridge is used to connect buses corresponding to the device borrower and the device lender respectively, and the control bridge is used to connect the NVMe device and the bus of the device lender, wherein the control bridge comprises: A command analysis module, used to obtain an I / O command corresponding to the NVMe device through a control bridge, and determine whether to perform a security enhancement operation according to a data address of the I / O command; wherein the control bridge is used to connect a bus of a device lender and the NVMe device; A type determination module, configured to determine the type of operation corresponding to the I / O command if the security enhancement operation is performed; A write operation module, for determining the data to be written according to the I / O command if the operation type is a write operation, and encrypting the data to be written before writing it into the storage unit of the NVMe device; A read operation module is used to read data from the storage unit of the NVMe device according to the I / O command if the operation type is a read operation, decrypt the read data and then output it to the bus of the device lender.

9. A terminal, characterized in that: The terminal includes a memory and one or more processors; the memory stores one or more programs; the program includes instructions for executing a method for using a cross-domain virtual NVMe device as described in any one of claims 1-7; and the processor is used to execute the program.

10. A computer-readable storage medium having a plurality of instructions stored thereon, characterized in that: The instructions are suitable for being loaded and executed by a processor to implement the steps of the method for using a cross-domain virtual NVMe device as described in any one of claims 1-7.

Images