Memory controller, data writing and reading method and computer system

Abstract

The embodiment of the invention provides a memory controller, a data writing method, a data reading method and a computer system.The memory controller comprises a request obtaining module used for obtaining a memory access request carrying an address space identifier of an encrypted virtual machine so as to conduct data access operation on a safe memory space corresponding to the encrypted virtual machine, the safe memory space is a randomly distributed physical memory space; the key determination module is used for determining an integrity verification key according to the address space identifier, and the key determination module is configured by the security processor; the memory integrity verification information determination module is used for determining memory integrity verification information based on the physical access address and the access data of the memory access request and the integrity verification key determined by the key determination module; the memory integrity verification information is used for verifying the integrity of the secure memory space. According to the technical scheme provided by the embodiment of the invention, the flexibility of memory allocation of the encrypted virtual machine can be improved.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of computer technology, and in particular to a memory controller, a data writing and reading method, and a computer system. Background Art

[0002] The secure memory isolation management unit (SIMU) is a hardware module used to provide memory isolation functions for encrypted virtual machines. However, the use of SIMU will impose certain restrictions and impacts on the memory allocation of encrypted virtual machines.

[0003] In this context, how to provide a technical solution to improve the flexibility of memory space allocation of the encrypted virtual machine has become a technical problem that technical personnel in this field urgently need to solve. Summary of the invention

[0004] In view of this, an embodiment of the present invention provides a memory controller, a data writing and reading method, and a computer system to improve the flexibility of memory space allocation of an encrypted virtual machine.

[0005] To achieve the above objectives, the embodiments of the present invention provide the following technical solutions.

[0006] In a first aspect, an embodiment of the present invention provides a memory controller, including:

[0007] A request acquisition module, used to acquire a memory access request of an encrypted virtual machine, wherein the memory access request is used to perform a data access operation on a secure memory space corresponding to the encrypted virtual machine, wherein the secure memory space is an arbitrarily allocated physical memory space; and the memory access request carries an address space identifier of the encrypted virtual machine;

[0008] A key determination module, used to determine the integrity verification key corresponding to the encrypted virtual machine according to the address space identifier, the key determination module being configured by a security processor;

[0009] A memory integrity verification information determination module is used to determine memory integrity verification information based on the physical access address of the memory access request, access data and the integrity verification key determined by the key determination module; the memory integrity verification information is used to verify the integrity of the secure memory space.

[0010] In a second aspect, an embodiment of the present invention provides a data writing method, which is applied to the memory controller as described in the first aspect, comprising:

[0011] Get the data writing request of the encrypted virtual machine;

[0012] Determining a write integrity verification key corresponding to the encrypted virtual machine based on the address space identifier carried by the data write request;

[0013] Determine write memory integrity verification information according to the write data determined by the data write request, the write integrity verification key, and the physical write address of the data write request, wherein the write memory integrity verification information is used to verify the integrity of the secure memory space of the encrypted virtual machine;

[0014] At least the write memory integrity verification information and the write data are written into the physical write address.

[0015] In a third aspect, an embodiment of the present invention provides a data reading method, comprising:

[0016] Get the data read request of the encrypted virtual machine;

[0017] Determining a read integrity verification key corresponding to the encrypted virtual machine based on the address space identifier carried by the data read request;

[0018] Re-determining the read memory integrity verification information according to the read data read from the physical read address of the data read request, the read integrity verification key and the physical read address;

[0019] When it is determined that the read memory integrity verification information is equal to the write memory integrity verification information read based on the physical read address, determining that the integrity verification of the secure memory space of the encrypted virtual machine has passed;

[0020] Send read data;

[0021] The memory integrity verification information is written based on the data writing method described in the second aspect, and the read data is written based on the data writing method described in the second aspect.

[0022] In a fourth aspect, an embodiment of the present invention provides a data writing device, including:

[0023] A data writing request acquisition module, used to acquire a data writing request of an encrypted virtual machine, wherein the data writing request carries an address space identifier of the encrypted virtual machine;

[0024] A write integrity verification key determination module, used to determine a write integrity verification key corresponding to the encrypted virtual machine based on the address space identifier carried by the data write request;

[0025] A memory write integrity verification information determination module, used to determine the memory write integrity verification information according to the write data corresponding to the data write request, the write integrity verification key and the physical write address of the data write request; the memory write integrity verification information is used to verify the integrity of the secure memory space of the encrypted virtual machine;

[0026] A writing module, used for writing at least the write memory integrity verification information and the write data into the physical write address;

[0027] Among them, the data write request is a memory access request of the encrypted virtual machine; the memory access request is used to perform a data access operation on the secure memory space corresponding to the encrypted virtual machine, and the secure memory space is an arbitrarily allocated physical memory space.

[0028] In a fifth aspect, an embodiment of the present invention provides a data reading device, including:

[0029] A data reading request acquisition module, used to acquire a data reading request of an encrypted virtual machine, wherein the data reading request carries an address space identifier of the encrypted virtual machine;

[0030] A read integrity verification key determination module, used to determine a read integrity verification key corresponding to the encrypted virtual machine based on the address space identifier carried by the data read request;

[0031] A read memory integrity verification information determination module, configured to determine the read memory integrity verification information according to the read data read by the physical read address of the data read request, the read integrity verification key and the physical read address;

[0032] An integrity verification module, configured to determine that the integrity verification of the secure memory space of the encrypted virtual machine has passed when it is determined that the read memory integrity verification information is equal to the write memory integrity verification information read based on the physical read address;

[0033] Sending module, used to send read data;

[0034] Among them, the written memory integrity verification information and the read data are written based on the data writing device described in the fourth aspect, and the data reading request is a memory access request of the encrypted virtual machine described in the data writing device.

[0035] In a sixth aspect, an embodiment of the present invention provides a computer system, including:

[0036] The memory controller as described in the first aspect;

[0037] a security processor, configured to configure a key determination module of the memory controller;

[0038] The memory includes a secure memory space, wherein the secure memory space is used to store or provide access to data, and the secure memory space is a physical memory space in the memory that is arbitrarily allocated.

[0039] A memory controller provided by an embodiment of the present invention includes: a request acquisition module, used to acquire a memory access request of an encrypted virtual machine, the memory access request is used to perform a data access operation on a secure memory space corresponding to the encrypted virtual machine, wherein the secure memory space is an arbitrarily allocated physical memory space; the memory access request carries an address space identifier of the encrypted virtual machine; a key determination module, used to determine an integrity verification key corresponding to the encrypted virtual machine according to the address space identifier, the key determination module being configured by a security processor; a memory integrity verification information determination module, used to determine memory integrity verification information based on a physical access address of the memory access request, access data and the integrity verification key determined by the key determination module; the memory integrity verification information is used to verify the integrity of the secure memory space.

[0040] It can be seen that the technical solution provided by the embodiment of the present invention can utilize the key determination module and the memory integrity verification information determination module in the memory controller to determine the integrity verification key and the memory integrity verification information based on the memory access request after the request acquisition module of the memory controller obtains the memory access request of the encrypted virtual machine, and finally complete the verification of the integrity of the secure memory space of the encrypted virtual machine through the memory controller; thereby avoiding the restriction that the secure memory space allocated to the encrypted virtual machine must be a physical memory space with a continuous address due to the usage characteristics of the SIMU when the integrity of the secure memory space of the encrypted virtual machine is protected; that is, by designing the internal structure of the memory controller, the memory controller replaces the SIMU to protect the integrity of the secure memory space of the encrypted virtual machine, so that when allocating secure memory space for the encrypted virtual machine, it is no longer subject to the restriction that the physical memory space with a continuous address must be allocated, thereby improving the allocation flexibility of the secure memory space of the encrypted virtual machine. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0042] Figure 1is a schematic diagram of the structure of a memory controller provided by an embodiment of the present invention;

[0043] Figure 2 is a structural diagram of a key determination module in a memory controller provided by an embodiment of the present invention;

[0044] Figure 3 It is a structural schematic diagram of a secure memory isolation management unit provided by an embodiment of the present invention;

[0045] Figure 4 This is a schematic diagram of the operation of ECC error correction technology when data is written;

[0046] Figure 5 This is a schematic diagram of the operation of ECC error correction technology when data is read;

[0047] Figure 6 is a flow chart of a data writing method provided by an embodiment of the present invention;

[0048] Figure 7 is another flow chart of the data writing method provided by an embodiment of the present invention;

[0049] Figure 8 is a flow chart of a data reading method provided by an embodiment of the present invention;

[0050] Fig. 9 is another flow chart of the data reading method provided by an embodiment of the present invention;

[0051] Fig.10 is a structural schematic diagram of a data writing device provided by an embodiment of the present invention;

[0052] Fig.11 is a structural schematic diagram of a data reading device provided by an embodiment of the present invention;

[0053] Fig.12 is a schematic diagram of the structure of a computer system provided by an embodiment of the present invention;

[0054] Fig.13 It is a schematic diagram of a configuration structure of a secure memory isolation management unit provided by an embodiment of the present invention;

[0055] Fig.14 is a schematic diagram of a working process of a computer system provided by an embodiment of the present invention;

[0056] Fig.15 It is another schematic diagram of the working process of the computer system provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0057] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0058] In virtualization technology, virtual machines fully trust the virtual machine monitor (VMM), for example, the hypervisor. The hypervisor can access all data of the virtual machine, including the virtual machine control block program (VMCB), nested page table (NPT), and memory space of the virtual machine. For the virtual machine, there is no confidentiality at all. Among them, VMCB is a data structure used in virtualization technology to store the status and control information of the virtual machine. NPT is a page table mechanism used in virtualization technology to achieve deeper virtualization (nested virtualization). The memory space is used to implement data access of the virtual machine.

[0059] With the development of information technology, data protection is becoming more and more important. In the field of virtualization technology, confidential computing has become an indispensable feature of the services provided by major cloud computing platforms. In order to protect the data confidentiality of virtual machines, encrypted virtual machine technology can be used. With the help of memory encryption technology, the operating system encrypts the memory space of the virtual machine using the key bound to it (configured by the security processor), forming a secure memory space that can only be accessed by the encrypted virtual machine and the security processor. The data stored in the secure memory space cannot be obtained by other virtual machines and hypervisors except the encrypted virtual machine. Furthermore, on the basis of ensuring the confidentiality of the secure memory space, the CPU register state of the encrypted virtual machine is encrypted to prevent the hypervisor from reading or modifying the registers of the encrypted virtual machine, further enhancing the confidentiality of the encrypted virtual machine.

[0060] At the same time, based on the confidentiality protection of the above-mentioned encrypted virtual machine, the SIMU hardware module is further used to isolate the memory space of the VMCB of the encrypted virtual machine, the memory space of the NPT of the encrypted virtual machine, and the secure memory space of the encrypted virtual machine, so as to prevent the Hypervisor or other virtual machines from reading or tampering with the VMCB, NPT and secure memory space of the encrypted virtual machine.

[0061] It should be noted that the secure memory space of the encrypted virtual machine may refer to: the memory space of the encrypted virtual machine used to store data is encrypted to ensure the security of the data stored in the physical memory RAM.

[0062] The memory space of the VMCB of the encrypted virtual machine may refer to: data in the VMCB is encrypted. When encrypting the VMCB memory, the information in the data structure of the VMCB may be encrypted to protect the state and control information of the encrypted virtual machine from unauthorized access, and the encrypted virtual machine itself is encrypted and protected in the memory space.

[0063] Encrypting the memory space of the NPT of a virtual machine may refer to: memory encryption of a nested page table (NPT). NPT is a mechanism used in virtualization technology to implement address translation, allowing a virtual machine to have its own page table. Encrypting the memory space of the NPT of a virtual machine means encrypting the information in these page tables to ensure the security of the address space of the encrypted virtual machine and prevent potential attacks during the address translation process.

[0064] However, due to the use and setting characteristics of SIMU, when it implements security and integrity protection for secure memory space, the address of the protected secure memory space needs to be a continuous address. In other words, when the virtual machine monitor allocates physical memory space for the encrypted virtual machine to convert it into the secure memory space of the encrypted virtual machine, the address of the physical memory space must be continuous. After a long period of operation, the physical memory space of the system OS running the Hypervisor will be fragmented. Even if the system has enough free physical memory space, the allocation of physical memory space with continuous addresses may fail, resulting in usage restrictions when using SIMU to implement security and integrity protection of the encrypted memory physical space, thereby limiting the application of hardware modules with SIMU.

[0065] Based on this, an embodiment of the present invention provides a memory controller to improve the flexibility of allocating secure memory space of an encrypted virtual machine while ensuring the integrity of the secure memory space of the encrypted virtual machine.

[0066] Please refer to Figure 1 , Figure 1 It is a structural schematic diagram of a memory controller provided by an embodiment of the present invention.

[0067] like Figure 1 As shown, the memory controller 1 includes:

[0068] A request acquisition module 11 is used to acquire a memory access request of an encrypted virtual machine, wherein the memory access request is used to perform a data access operation on a secure memory space corresponding to the encrypted virtual machine, wherein the secure memory space is an arbitrarily allocated physical memory space; and the memory access request carries an address space identifier of the encrypted virtual machine;

[0069] A key determination module 12, configured to determine an integrity verification key corresponding to the encrypted virtual machine according to the address space identifier, wherein the key determination module is configured by a security processor;

[0070] The memory integrity verification information determination module 13 is used to determine the memory integrity verification information based on the physical access address of the memory access request, the access data and the integrity verification key determined by the key determination module; the memory integrity verification information is used to verify the integrity of the secure memory space.

[0071] The request acquisition module 11 may be an interface of the memory controller 1 , and is used to implement data interaction between the memory controller 1 and an external hardware module.

[0072] The key determination module 12 queries the integrity verification key corresponding to the encrypted virtual machine according to the address space identifier (ASID, Address Space Identifier) ​​carried in the memory access request.

[0073] In the encrypted virtual machine technology, ASID is used to associate the data encryption key of each virtual machine to ensure that only the corresponding encrypted virtual machine can decrypt the data in its secure memory space. In the embodiment of the present invention, the association between ASID and encrypted virtual machine is further utilized to ensure that each encrypted virtual machine has its own integrity verification key, so as to ensure the reliability of the subsequent verification of the integrity of the secure memory space of the encrypted virtual machine. Among them, the host Host or Hypervisor can only use ASID with a value of 0, and the virtual machine can use ASID of 0 or non-0, so the integrity verification key of the encrypted virtual machine associated with the ASID can be found by using ASID.

[0074] The security processor (PSP, Platform Security Processor) is a coprocessor integrated inside the processor. The security processor has its own independent resources, which are inaccessible to the outside (including the CPU core). At the same time, the security processor has high system permissions and can access all resources in the system, including controlling the CPU, accessing system memory and I / O. Therefore, using the security processor to configure the key determination module 12 can further ensure the security of the integrity verification key in the key determination module 12.

[0075] The memory integrity verification information determination module 13 calculates memory integrity verification information for performing integrity verification.

[0076] In one implementation, the memory integrity verification information may be a message authentication code (MAC, Message Authentication Code).

[0077] Taking the memory integrity verification information as a message verification code as an example, the structure of the key determination module 12 can refer to Figure 2 , Figure 2 The invention is a schematic diagram of a key determination module in a memory controller according to an embodiment of the invention.

[0078] like Figure 2 As shown, when the memory integrity verification information is MAC, in order to determine the message authentication code, the key determination module 12 added in the memory controller 1 may include an address space identification table entry (ASID) and an integrity verification key table entry (MAC key).

[0079] When the memory controller 1 is working, according to the received data access request, in the key determination module 12 (MAC key table), the ASID of the encrypted virtual machine of the data access request is used as the index to query the corresponding integrity verification key MAC key from the integrity verification key table item.

[0080] The MAC key table entry stores the integrity verification key, which can be 128 bits long and is used to determine the MAC.

[0081] The key determination module 12 can only be configured by the security processor. When the system starts, the security processor initializes the content stored in the key determination module 12 to all 0s.

[0082] When starting a virtual machine (including an encrypted virtual machine), the security processor initializes the table entry corresponding to the virtual machine's ASID. If the virtual machine is an encrypted virtual machine, a randomly generated integrity verification key is recorded in the MAC key table entry corresponding to the encrypted virtual machine's ASID, otherwise the MAC key table entry corresponding to the non-encrypted virtual machine's ASID is initialized to 0. When the encrypted virtual machine is destroyed, the MAC key table entry corresponding to the encrypted virtual machine's ASID is configured to all 0s.

[0083] When the memory integrity verification information is MAC, the memory integrity verification information determination module 13 takes the physical access address (HPA, Host Physical Address) of the memory access request, access data (data), and integrity verification key (MAC key) as input when determining the MAC, uses a hash algorithm to calculate a hash value, and truncates the calculated hash value to n bits as the MAC value (i.e., the memory integrity verification information).

[0084] When calculating the hash value using the hash algorithm, the calculation formula used can be:

[0085] MAC=hash_n(HPA, data, MAC key), where MAC key is not 0.

[0086] When MAC key = 0, the calculated MAC value is 0.

[0087] The hash algorithm used can be:

[0088] SM3 algorithm, SM3 algorithm is a cryptographic hash function standard that can be used for digital signatures, message authentication code generation and verification, and random number generation; the output result of the SM3 algorithm is a 256-bit (32-byte) hash value;

[0089] SHA-2 (Secure Hash Algorithm 2), including SHA-256, SHA-512, etc., providing hash values ​​of different lengths;

[0090] SHA-3 (Secure Hash Algorithm 3), SHA-3 is the successor algorithm of SHA-2. It is different from SHA-2 in design and provides more scalability and security;

[0091] BLAKE2, a newer cryptographic hash function designed to provide better performance and security;

[0092] bcrypt, a hash function designed for password storage that uses salt to protect passwords from rainbow table attacks;

[0093] Argon2 is one of the most secure password hashing algorithms currently available, and it resists many known password attack techniques.

[0094] When calculating the above MAC value, for example, the SM3 algorithm may be used. The SM3 algorithm is applicable not only to software implementation but also to hardware implementation and has good flexibility.

[0095] The key determination module 12 and the memory integrity verification information determination module 13 are used to implement integrity verification of the secure memory space of the encrypted virtual machine, thereby avoiding the use of SIMU to supervise and protect the secure memory space. Therefore, the secure memory space supervised by SIMU is no longer subject to the restriction that the secure memory space must be a physical memory space with continuous addresses. When allocating secure memory space to the encrypted virtual machine, it can be allocated arbitrarily from the physical memory space of the memory, thereby improving the flexibility of allocating secure memory space.

[0096] To understand the working characteristics of SIMU, please refer to Figure 3 , Figure 3 It is a structural diagram of a secure memory isolation management unit provided in an embodiment of the present invention. Figure 3The following describes the encrypted virtual machine CSV3 (China Secure Virtualization 3, the third generation of China Secure Virtualization) as an example.

[0097] In the CSV3 encrypted virtual machine technology, such as Figure 3 As shown, by integrating some control registers and SPOT tables (Secure Page Ownership Table: secure page owner configuration table) in the SIMU of the system CS (Client-Server: client-server network architecture), the control registers and SPOT tables can only be read and written by the security processor.

[0098] In SIMU, on the one hand, the Protect_base and Protect_size of the control register respectively define the starting physical address and size of the protected memory area (complete secure memory space) of the encrypted virtual machine, thereby defining the Protect limit of the complete secure memory space. SIMU divides the complete secure memory space into N parts, each of which is an independently configurable area, called SMR (secure memory region).

[0099] Among them, the complete secure memory space is allocated from the physical memory space DRAM limit of the memory, and the physical memory space of the memory is defined by the starting physical address DRAM base and size DRAM size of the memory.

[0100] On the other hand, the SPOT table contains N entries, among which the two more important fields in each entry are V and ASID. V=1 means that the protected memory area corresponding to the SMR (or SMCR: the SMR that protects the memory space used by the VMCB and NPT of the virtual machine is called SMCR) pointed to by the entry needs to be supervised by SIMU when accessed; V=0 means that the protected memory area corresponding to the SMR (or SMCR) pointed to by the entry does not need to be supervised when accessed, and the protected memory area corresponding to the SPOT entry is called NMR (normal memory area). In other words, SIMU supervises the complete secure memory space of the encrypted virtual machine, and in the complete secure memory space, it can be determined according to usage requirements which parts need to be supervised by SIMU and which parts do not need to be supervised by SIMU.

[0101] ASID defines the ASID of the owner of the SMR corresponding to the entry. For example, if the ASID of an entry in the SPOT table is 1 and V=1, then only the virtual machine with ASID 1 can access the corresponding SMR, and the access of other ASIDs will be blocked by SIMU.

[0102] Assuming that the SPOT table contains 8192 entries and the size of the protected memory area is 64G, the average size of the protected memory area protected by each SMR is 8M (64 / 8192*1024). To start an 8G CSV3 virtual machine (encrypted virtual machine), the Hypervisor needs to allocate 1024 8M continuous physical memory areas (physical memory space), and the security processor configures the SPOT table entries corresponding to these physical memory areas to have V set to 1 (that is, the complete secure memory space of the CSV3 virtual machine is fully supervised and protected by the SIMU), and the ASID value is the ASID assigned by the system to the CSV3 virtual machine. Therefore, the complete secure memory space of the encrypted virtual machine must use a physical memory space with a continuous address when allocating it.

[0103] It should be noted that the secure memory space of the encrypted virtual machine described in the embodiment of the present invention refers to the secure memory space in the complete secure memory space of the encrypted virtual machine, except for the secure memory space corresponding to the SMCR supervised by the SIMU.

[0104] It can be seen that the technical solution provided by the embodiment of the present invention can utilize the key determination module 12 and the memory integrity verification information determination module 13 in the memory controller 1 to determine the integrity verification key and the memory integrity verification information based on the memory access request after the request acquisition module 11 of the memory controller obtains the memory access request of the encrypted virtual machine, and finally completes the verification of the integrity of the secure memory space of the encrypted virtual machine through the memory controller 1; thereby avoiding the restriction that the secure memory space allocated to the encrypted virtual machine is a physical memory space with a continuous address due to the use characteristics of the SIMU when the integrity of the secure memory space of the encrypted virtual machine is protected; that is, by designing the internal structure of the memory controller 1, the memory controller 1 replaces the SIMU to implement the protection of the integrity of the secure memory space, so that when allocating secure memory space for the encrypted virtual machine, it is no longer subject to the restriction that the physical memory space with a continuous address must be allocated, thereby improving the allocation flexibility of the secure memory space of the encrypted virtual machine.

[0105] Please continue to refer to Figure 1 In one implementation, the memory controller 1 provided in the embodiment of the present invention may further include:

[0106] An error correction information determination module 14, configured to calculate data error correction information based on the access data and the memory integrity verification information;

[0107] The data error correction information is stored in a data error correction information storage space in a secure memory space, and free bits of the data error correction information storage space are used to store the memory integrity verification information.

[0108] In the memory controller 1, the error correction code (ECC) error correction technology is introduced to improve the stability of the memory. The implementation process of the ECC error correction technology can be referred to Figure 4 and Figure 5 , Figure 4 This is a working diagram of ECC error correction technology when writing data. Figure 5 This is a working diagram of ECC error correction technology when realizing data reading.

[0109] like Figure 4 As shown, when the memory controller 1 (Memory Controller) performs a data write operation to the memory 3 (DRAM, such as DDR5), that is, writes the access data (data) of the memory access request (this is a data write request) to the memory 3, the error correction information determination module 14 (such as an ECC controller) uses the access data to calculate the corresponding data error correction information (ECC); then, the access data and the calculated data error correction information (ECC) are stored in the memory 3 at the same time.

[0110] like Figure 5 As shown, when the memory controller 1 performs a read operation on the memory 3, the access data and data error correction information (ECC) stored in the memory 3 are read at the same time, and the data error correction information is recalculated based on the access data read, and the recalculated data error correction information is compared with the data error correction information read from the memory. If the two are equal, it means that the access data stored in the memory 3 has not been bit flipped, and the access data read can be directly returned. If they are not equal, the ECC controller attempts to correct the flipped bits in the access data read out. If the access data can be corrected by the ECC controller, the corrected data is returned. If it cannot be corrected, the erroneous access data read out is returned, and an ECC error signal is issued.

[0111] The ECC bits used to store data error correction information in memory 3 (data error correction information storage space in the secure memory space) have some idle bits, and these idle bits can be used to store other data information, such as storing MAC values ​​(memory integrity verification information).

[0112] Please continue to refer to Figure 1 In order to ensure the confidentiality of access data stored in the secure memory space, in some implementations, the memory controller 1 may further include:

[0113] The data protection module 15 is used to determine whether to encrypt the write data of the data write request based on the encryption identification bit carried by the data write request when the memory access request is a data write request.

[0114] Or, when the memory access request is a data read request, it is determined whether to decrypt the read data read from the secure memory space based on an encryption identification bit carried by the data read request.

[0115] The implementation of the secure memory space of the encrypted virtual machine is based on memory encryption technology. Memory encryption technology provides a simple and efficient memory encryption capability, allowing the system to resist some attacks. For example, some disks can store data after encryption, but these data become plain text when loaded into the memory. After using memory encryption technology, these data are encrypted in the memory. Therefore, based on memory encryption technology, the protection of the secure memory space of the encrypted virtual machine is implemented, so that the data stored in the secure memory space is encrypted and protected.

[0116] When encrypting the memory space of the encrypted virtual machine to form a secure memory space, a high-performance encryption and decryption engine (data protection module 15) is integrated in the memory controller 1. The keys (data encryption keys and data decryption keys) used by the data protection module 15 to encrypt and decrypt access data are randomly generated by the security processor and saved in specific registers of the memory controller 1. Software running on the CPU core (such as other virtual machines and VMM) cannot access the key.

[0117] Based on memory encryption technology, the encryption of the memory space of the encrypted virtual machine is realized, and the process of forming a secure memory space can be expressed as:

[0118] After receiving a memory access request (for example, a data write request is received at this time), the memory controller 1 first checks whether the encryption identification bit (C bit, such as the 47th bit of the physical write address) carried by the data write request is set. If the encryption identification bit is set, the data protection module 15 in the memory controller 1 determines the corresponding data encryption key according to the ASID identification carried by the data write request, and encrypts the access data (write data at this time). If the encryption identification bit is not set, the write data is not encrypted.

[0119] When the memory controller 1 receives a data read request, it first checks whether the encryption flag (C bit, such as the 47th bit of the physical read address) carried by the data read request is set. If the encryption flag is set, the data protection module 15 of the memory controller 1 determines the corresponding data decryption key according to the ASID flag carried by the data read request, thereby decrypting the read data read from the physical read address. If the encryption flag is not set, the read data is not decrypted.

[0120] Since the encryption flag bit can be set or not set, the access data is the encrypted or unencrypted write data output by the data protection module, or the access data is the read data read from the secure memory space.

[0121] When the memory access request is a data write request, the access data is the write data encrypted by the data protection module 15 or the unencrypted write data (i.e., the initial write data); when the memory access request is a data read request, the access data is directly the read data read from the secure memory space. The read data at this time can be the encrypted or unencrypted write data written based on the physical write address during the process of the memory controller 1 processing the data write request.

[0122] To verify memory integrity, please refer to Figure 1 , the memory controller 1 may further include:

[0123] A first comparison module 16 is used to compare whether the memory integrity verification information read from the secure memory space and the re-determined memory integrity verification information are the same; if yes, confirming that the integrity verification of the secure memory space of the encrypted virtual machine has passed; if not, sending an integrity verification failure signal; the re-determined memory integrity verification information is determined based on the integrity verification key determined by the key determination module 12, the access data read from the secure memory space, and the physical access address;

[0124] The integrity check failure signal is used to enable the security processor to set the virtual machine state of the encrypted virtual machine to prevent the encrypted virtual machine from running again.

[0125] The first comparison module 16 is used when the memory controller 1 receives and processes a data read request, and is used to determine whether the memory integrity verification information read from the secure memory space is damaged, thereby verifying whether the secure memory space is complete.

[0126] The re-determined memory integrity verification information is also implemented by the memory integrity verification information determination module 13, which takes the data physical access address (this is the physical read address), the access data (this is the read data read from the physical read address), and the integrity verification key (determined based on the ASID carried by the data read request) as input to recalculate the memory integrity verification information.

[0127] The integrity of the secure memory space of the encrypted virtual machine is ensured by the verification of the memory integrity verification information (such as the MAC message verification code). If the secure memory space of the encrypted virtual machine is tampered with, when the encrypted virtual machine issues a data read request and the memory controller 1 processes the data read request, the memory integrity verification information verification fails, and the memory controller 1 then sends an integrity verification failure signal integrity error to the security processor. The security processor can set the state of the corresponding encrypted virtual machine based on the received integrity error. When the encrypted virtual machine executes the VMRUN (virtual machine run) instruction next time, it will detect that the state of the encrypted virtual machine is wrong, so that it can exit in time and set an exit code, indicating that the encrypted virtual machine has an integrity error. The incorrect use of the encrypted virtual machine can be terminated in time.

[0128] In some other implementations, in order to ensure the accuracy of the access data (read data in this case) read, the memory controller 1 may further include:

[0129] The second comparison module 17 is used to compare whether the data error correction information read from the secure memory space and the re-determined data error correction information are the same; if so, confirm that the data verification is passed; if not, send a data error signal; the re-determined data error correction information is determined based on the access data and memory integrity verification information read from the secure memory space.

[0130] When the data error correction information ECC is re-determined, it can be implemented by the error correction information determination module 14, which takes the read access data (i.e., read data) and the read memory integrity verification information as input, and recalculates the data error correction information when processing the data read request, thereby comparing it with the data error correction information directly read from the secure memory space to determine whether the read data has errors.

[0131] An embodiment of the present invention further provides a data writing method, which is implemented based on the memory controller provided by the above embodiment.

[0132] Please refer to Figure 6 , Figure 6 It is a flowchart of a data writing method provided by an embodiment of the present invention.

[0133] like Figure 6 As shown, the method may include the following steps:

[0134] Step S101, obtaining a data write request of an encrypted virtual machine.

[0135] Step S101 may be implemented by a request acquisition module of a memory controller.

[0136] Step S102: determining a write integrity verification key corresponding to the encrypted virtual machine based on the address space identifier carried in the data write request.

[0137] Step S102 can be implemented by the key determination module in the memory controller. The data write request is issued by the encryption virtual machine, and the ASID is associated with the encryption virtual machine. Therefore, the ASID carried in the data write request is used to determine the write integrity verification key corresponding to the encryption virtual machine.

[0138] The write integrity verification key is configured in the key determination module by the security processor.

[0139] Step S103, determining write memory integrity verification information according to the write data corresponding to the data write request, the write integrity verification key, and the physical write address of the data write request.

[0140] The written memory integrity verification information is used to verify the integrity of the secure memory space of the encrypted virtual machine.

[0141] Step S103 may be implemented by a memory integrity verification information determination module within the memory controller. For example, the memory integrity verification information determination module calculates the write memory integrity verification information using the SM3 algorithm, the write integrity verification key, the write data determined based on the data write request, and the physical write address.

[0142] Step S104, writing at least the write memory integrity verification information and the write data into the physical write address.

[0143] After obtaining the write memory integrity verification information, the write memory integrity verification information and the write data can be written into the secure memory space indicated by the physical write address of the data write request.

[0144] It can be seen that the technical solution provided by the embodiment of the present invention, when the memory access request is a data write request, after the memory controller obtains the data write request of the encrypted virtual machine, it can use the address space identifier carried by the data write request to determine the write integrity verification key, and then use the write integrity verification key, write data, and physical write address to obtain write memory integrity verification information; so as to use the write memory integrity verification information to verify the integrity of the secure memory space; thereby avoiding the restriction that the secure memory space allocated to the encrypted virtual machine is a physical memory space with continuous addresses due to the use characteristics of the SIMU when using SIMU to protect the integrity of the secure memory space of the encrypted virtual machine; that is, by designing the internal structure of the memory controller, the memory controller replaces the SIMU to implement the protection of the integrity of the secure memory space, so that when allocating secure memory space for the encrypted virtual machine, it is no longer subject to the restriction that the physical memory space with continuous addresses must be allocated, thereby improving the allocation flexibility of the secure memory space of the encrypted virtual machine.

[0145] In one implementation, initialization processing may also be performed. Figure 7 , Figure 7 It is another flowchart diagram of the data writing method provided by an embodiment of the present invention.

[0146] like Figure 7 As shown, the method may include the following steps:

[0147] Step S200: sending an initialization signal.

[0148] The initialization signal is used to initialize the memory integrity verification information determination module of the memory controller.

[0149] Initializing the memory integrity verification information determination module, namely initializing the memory integrity verification information (MAC), can ensure that all data is verified before the encrypted virtual machine accesses the secure memory space, thereby preventing the data from being tampered with during transmission.

[0150] In order to achieve data security protection for processing data write requests, in one implementation, the stored write data may be encrypted data. Figure 7 ,like Figure 7 As shown, the method also includes:

[0151] Step S201, obtaining a data write request of an encrypted virtual machine.

[0152] Step S202: determining a write integrity verification key corresponding to the encrypted virtual machine based on the address space identifier carried in the data write request.

[0153] Step S203, determining whether the encryption identification bit carried in the data write request is set, if yes, executing step S204, if not, executing step S205.

[0154] Step S204: determine the data encryption key corresponding to the encrypted virtual machine using the address space identifier, and encrypt the initial write data of the data write request using the data encryption key, so as to use the encrypted initial write data as the write data.

[0155] Step S205: initial write data of the data write request is not encrypted, so that the initial write data is used as write data.

[0156] Steps S203 to S205 may be implemented by a data protection module inside the memory controller.

[0157] By judging whether the encryption identification bit (C bit) carried by the data write request is set, it is determined whether the content of the initial write data is confidential, thereby ensuring that the initial write data that needs to be kept confidential cannot be directly read even if it is obtained by unauthorized visitors, thereby ensuring the security of the content of the written write data.

[0158] Please continue to refer to Figure 7 , the method may further include:

[0159] Step S206, determine whether the write integrity verification key is 0, if yes, execute step 207, if not, execute step S208.

[0160] Step S207, determine that the memory integrity verification information written is 0.

[0161] When the security processor configures the key determination module, the configured integrity verification key value will be 0. Therefore, when the obtained integrity verification key (write integrity verification key) is 0, the calculated write memory integrity verification information is 0.

[0162] Step S208, determining write memory integrity verification information according to the write data, the write integrity verification key and the physical write address of the data write request.

[0163] The written memory integrity verification information is used to verify the integrity of the secure memory space of the encrypted virtual machine.

[0164] Step S209: determining write data error correction information according to the write memory integrity verification information and the write data.

[0165] Step S209 may be implemented by an error correction information determination module within the memory controller.

[0166] Step S210, writing the write memory integrity verification information, the write data, and the write data error correction information into the physical write address.

[0167] The written data error correction information is stored in a data error correction information storage space in a secure memory space, and the free bits of the data error correction information storage space are used to store the written memory integrity verification information.

[0168] The calculation and storage of the written data error correction information facilitates the subsequent error detection and correction of the written data, thereby improving the reliability of data storage and the stability of the system.

[0169] In the above process of executing the data write request, the memory integrity verification information used is called write memory integrity verification information, the data error correction information used is called write data error correction information, and the integrity verification key used is called write integrity verification key.

[0170] An embodiment of the present invention further provides a data reading method, which completes the verification of the integrity of the secure memory space during the data reading process based on the implementation of the data writing method provided by the aforementioned embodiment.

[0171] Please refer to Figure 8 , Figure 8 It is a flow chart of a data reading method provided by an embodiment of the present invention.

[0172] like Figure 8 Said method may include the following steps:

[0173] Step S301: obtaining a data reading request of an encrypted virtual machine.

[0174] Step S301 may be implemented by a request acquisition module of the memory controller.

[0175] Step S302: determining a read integrity verification key corresponding to the encrypted virtual machine based on the address space identifier carried in the data read request.

[0176] Step S302 may be implemented by a key determination module inside the memory controller.

[0177] Step S303, determining read memory integrity verification information according to the read data read from the physical read address of the data read request, the read integrity verification key and the physical read address.

[0178] Step S303 may be implemented by a memory integrity verification information determination module of the memory controller.

[0179] When executing a data read request, the input of the memory integrity verification information determination module is: the read integrity verification key determined based on the address space identifier carried by the data read request, the read data read according to the physical read address, the physical read address, and the recalculation of the read memory integrity verification information during the reading process.

[0180] Step S304: When it is determined that the read memory integrity verification information is equal to the write memory integrity verification information read based on the physical read address, it is determined that the integrity verification of the secure memory space of the encrypted virtual machine has passed.

[0181] Step S304 may be implemented by a first comparison module inside the memory controller.

[0182] The first comparison module takes the read memory integrity verification information and the write memory integrity verification information as input, and compares the two. If they are equal, it means that the security memory space integrity verification has passed.

[0183] Step S305, sending read data.

[0184] The written memory integrity verification information is written based on the data writing method described in any of the foregoing embodiments, and the read data is written based on the data writing method described in any of the foregoing embodiments. The read data at this time can be encrypted or unencrypted write data written based on the physical write address during the process of the memory controller 1 processing the data write request.

[0185] It can be seen that the technical solution provided by the embodiment of the present invention, when the memory access request is a data read request, after the memory controller obtains the data read request of the encrypted virtual machine, can use the address space identifier carried by the data read request to determine the read integrity verification key, and then use the read integrity verification key, read data, and physical read address to recalculate and obtain the read memory integrity verification information; so as to use the read memory integrity verification information and the write memory integrity verification information written in the data writing method to verify the integrity of the secure memory space; thereby avoiding the restriction that the secure memory space allocated to the encrypted virtual machine is a physical memory space with a continuous address due to the use characteristics of the SIMU when the integrity of the secure memory space of the encrypted virtual machine is protected by the SIMU; that is, by designing the internal structure of the memory controller, the memory controller replaces the SIMU to implement the protection of the integrity of the secure memory space, so that when allocating secure memory space for the encrypted virtual machine, it is no longer subject to the restriction that the physical memory space with a continuous address must be allocated, thereby improving the allocation flexibility of the secure memory space of the encrypted virtual machine.

[0186] In other implementations, when the secure memory space verification fails, an integrity check failure signal may be sent to the security processor to prevent the encrypted virtual machine from running again.

[0187] Please refer to Fig. 9 , Fig. 9 is another flowchart diagram of the data reading method provided by an embodiment of the present invention.

[0188] like Fig. 9 Said method may include the following steps:

[0189] Step S401: obtaining a data reading request of an encrypted virtual machine.

[0190] Step S402: determining a read integrity verification key corresponding to the encrypted virtual machine based on the address space identifier carried in the data read request.

[0191] Step S403, determining whether the read integrity verification key is 0, if yes, executing step S404, if no, executing step S405.

[0192] Step S404, determining that the read memory integrity verification information is 0.

[0193] When the security processor configures the key determination module, the configured integrity verification key value will be 0. Therefore, when the obtained integrity verification key (read integrity verification key) is 0, the calculated read memory integrity verification information is 0.

[0194] Step S405 , determining read memory integrity verification information according to the read data read from the physical read address of the data read request, the read integrity verification key and the physical read address.

[0195] Step S406, determining whether the read memory integrity verification information is equal to the written memory integrity verification information, if not, executing step S407, if yes, executing step S408.

[0196] Step S407: Sending an integrity check failure signal.

[0197] The integrity check failure signal integrity error is used to enable the security processor to set the virtual machine state of the encrypted virtual machine to prevent the encrypted virtual machine from running again.

[0198] After the first comparison module of the memory controller determines that a verification error has occurred, the first comparison module will send an integrity error signal to the security processor. The security processor sets the virtual machine state of the corresponding encrypted virtual machine so that the encrypted virtual machine will detect an encrypted virtual machine state error when it executes a VMRUN (virtual machine startup) instruction next time, and will exit in time and set an exit code, indicating that an integrity error has occurred in the encrypted virtual machine, thereby making the overall system work stable.

[0199] Step S408, determining whether the integrity verification of the secure memory space of the encrypted virtual machine has passed.

[0200] Please continue to refer to Fig. 9 , the method may further include:

[0201] Step S409: determining read data error correction information according to the read data and the write memory integrity verification information.

[0202] Step S409 may be implemented by an error correction information determination module of the memory controller.

[0203] Step S410, comparing whether the read data error correction information and the write data error correction information are equal, if not, executing step S411, if yes, executing step S412.

[0204] Wherein, the written data error correction information is written based on any of the aforementioned data writing methods.

[0205] Step S411, sending a data read error signal.

[0206] Step S412, determining whether the read data verification passes.

[0207] Step S410 can be implemented by the second comparison module of the memory controller. The second comparison module takes the read write data error correction information and the re-determined read data error correction information as input, and compares whether the two are equal. When the two are equal, it means that the read data has not been tampered with. When the two are not equal, it means that the read data has been damaged, so a data error signal can be issued to notify the system that an error has occurred in the read data.

[0208] In one embodiment, please continue to refer to Fig. 9 ,like Fig. 9 As shown, the method may also include:

[0209] Step S413, determining whether the encryption identification bit carried in the data read request is set, if yes, executing step S414, if not, executing step S415.

[0210] Step S413 may be implemented by a data protection module of the memory controller.

[0211] Step S414: using the address space identifier carried in the data read request, determine the corresponding data decryption key, and use the read data decrypted by the data decryption key as the read data to be sent.

[0212] Step S415, sending read data.

[0213] The read data obtained from the physical read address of the secure memory space passes through the data protection module. If the C bit is set, the read data will be decrypted by the data protection module using the data decryption key corresponding to the ASID in the data write request, and the decrypted read data will be returned. If the C bit is not set, the read data can be returned directly without decryption.

[0214] In the above process of executing the data read request, the memory integrity verification information used is called read memory integrity verification information, the data error correction information used is called read data error correction information, and the integrity verification key used is called read integrity verification key.

[0215] The embodiment of the present invention further provides a data writing device as a schematic diagram of an implementation structure of the data writing method described in the above embodiment.

[0216] Please refer to Fig.10 , Fig.10 It is a structural schematic diagram of a data writing device provided by an embodiment of the present invention.

[0217] like Fig.10 As shown, the data writing device may include:

[0218] A data writing request acquisition module 21 is used to acquire a data writing request of an encrypted virtual machine, wherein the data writing request carries an address space identifier of the encrypted virtual machine;

[0219] A write integrity verification key determination module 22, configured to determine a write integrity verification key corresponding to the encrypted virtual machine based on the address space identifier carried by the data write request;

[0220] A memory write integrity verification information determination module 23 is used to determine the memory write integrity verification information according to the write data corresponding to the data write request, the write integrity verification key and the physical write address of the data write request; the memory write integrity verification information is used to verify the integrity of the secure memory space of the encrypted virtual machine;

[0221] A writing module 24, used for writing at least the write memory integrity verification information and the write data into the physical write address;

[0222] Among them, the data write request is a memory access request of the encrypted virtual machine; the memory access request is used to perform a data access operation on the secure memory space corresponding to the encrypted virtual machine, and the secure memory space is an arbitrarily allocated physical memory space.

[0223] It can be seen that the technical solution provided by the embodiment of the present invention, when the memory access request is a data write request, after obtaining the data write request of the encrypted virtual machine, can use the address space identifier carried by the data write request to determine the write integrity verification key, and then use the write integrity verification key, write data, and physical write address to obtain write memory integrity verification information; so as to use the write memory integrity verification information to verify the integrity of the secure memory space; thereby avoiding the restriction that the secure memory space allocated to the encrypted virtual machine is a physical memory space with continuous addresses due to the use characteristics of SIMU when using SIMU to protect the integrity of the secure memory space of the encrypted virtual machine; that is, the technical solution provided by the embodiment of the present invention can replace SIMU to realize the protection of the integrity of the secure memory space, so that when allocating secure memory space for the encrypted virtual machine, it is no longer subject to the restriction that the physical memory space with continuous addresses must be allocated, thereby improving the allocation flexibility of the secure memory space of the encrypted virtual machine.

[0224] The embodiment of the present invention further provides a data reading device as a schematic diagram of an implementation structure of the data reading method described in the above embodiment.

[0225] Please refer to Fig.11 , Fig.11 It is a structural schematic diagram of a data reading device provided by an embodiment of the present invention.

[0226] like Fig.11 As shown, the data reading device may include:

[0227] A data reading request acquisition module 31 is used to acquire a data reading request of an encrypted virtual machine, wherein the data reading request carries an address space identifier of the encrypted virtual machine;

[0228] A read integrity verification key determination module 32, configured to determine a read integrity verification key corresponding to the encrypted virtual machine based on the address space identifier carried in the data read request;

[0229] A read memory integrity verification information determination module 33, configured to determine the read memory integrity verification information according to the read data read by the physical read address of the data read request, the read integrity verification key and the physical read address;

[0230] The integrity verification module 34 is used to determine that the integrity verification of the secure memory space of the encrypted virtual machine has passed when it is determined that the read memory integrity verification information is equal to the write memory integrity verification information read based on the physical read address;

[0231] A sending module 35, used for sending read data;

[0232] The written memory integrity verification information and the read data are written based on the data writing device described in the aforementioned embodiment, and the data read request is a memory access request of the encrypted virtual machine described in the data writing device.

[0233] It can be seen that the technical solution provided by the embodiment of the present invention, when the memory access request is a data write request, after obtaining the data write request of the encrypted virtual machine, can use the address space identifier carried by the data write request to determine the write integrity verification key, and then use the write integrity verification key, write data, and physical write address to obtain write memory integrity verification information; so as to use the write memory integrity verification information to verify the integrity of the secure memory space; thereby avoiding the restriction that the secure memory space allocated to the encrypted virtual machine is a physical memory space with continuous addresses due to the use characteristics of SIMU when using SIMU to protect the integrity of the secure memory space of the encrypted virtual machine; that is, the technical solution provided by the embodiment of the present invention can replace SIMU to realize the protection of the integrity of the secure memory space, so that when allocating secure memory space for the encrypted virtual machine, it is no longer subject to the restriction that the physical memory space with continuous addresses must be allocated, thereby improving the allocation flexibility of the secure memory space of the encrypted virtual machine.

[0234] The embodiment of the present invention further provides a computer system, which is based on the memory controller provided by the above embodiment, to improve the flexibility of memory allocation of the encrypted virtual machine while ensuring the integrity of the memory of the encrypted virtual machine.

[0235] Please refer to Fig.12 , Fig.12 It is a structural diagram of a computer system provided by an embodiment of the present invention.

[0236] like Fig.12 As shown, the computer system may include:

[0237] The memory controller 1 described in any one of the aforementioned embodiments;

[0238] A security processor 2, used for configuring a key determination module of the memory controller 1;

[0239] Memory 3, including a secure memory space corresponding to the encrypted virtual machine, the secure memory space is used to store or provide access data of the encrypted virtual machine, and the secure memory space is a physical memory space in the memory that is arbitrarily allocated.

[0240] The security processor 2 is responsible for configuring the key determination module in the memory controller 1 to ensure the security of the integrity verification key.

[0241] The secure memory space used by the encrypted virtual machine is in the ordinary memory 3 and is arbitrarily allocated from the physical memory space of the memory 3 by the virtual machine monitor (eg, Hypervisor) and is no longer supervised by the SIMU.

[0242] When allocating the secure memory space of the encrypted virtual machine, the hypervisor may allocate 4K small pages or large pages from the physical memory space of the memory 3 as pages of the secure memory space of the encrypted virtual machine during the process of the secure processor 2 establishing the NPT page table for the encrypted virtual machine (the secure processor 2 establishes the NPT for the encrypted virtual machine). Therefore, the size of the secure memory space of the encrypted virtual machine is no longer constrained by the physical memory space of the SIMU requiring continuous addresses, so that the secure memory space of the encrypted virtual machine can be flexibly allocated.

[0243] In one embodiment, the computer system may further include:

[0244] A secure memory isolation management unit is used to isolate and protect the physical memory space of the virtual machine control block program of the encrypted virtual machine and the physical memory space of the nested page table of the encrypted virtual machine.

[0245] Continue to use the secure memory isolation management unit (SIMU) to isolate and protect the physical memory space occupied by VMCB and NPT of the encrypted virtual machine, so that the physical memory space occupied by VMCB and NPT is inaccessible to the Hypervisor and other virtual machines, fully ensuring the security of the physical memory space occupied by VMCB and NPT.

[0246] like Figure 3The structural diagram of SIMU shown in the figure, the complete secure memory space of the encrypted virtual machine is supervised in SIMU. If V in the SPOT table is 1, the memory area indicated by the table entry is SMR. In the use of SIMU, in addition to being used to protect the secure memory space of the encrypted virtual machine described in the embodiment of the present invention, SMR can also be used to protect the physical memory space used by the VMCB and NPT of the encrypted virtual machine (including the physical memory space used by the VMCB and NPT of the virtual machine). This kind of SMR is called SMCR, and the ASID field of the corresponding SPOT table entry is configured with a special value 0x1FE, indicating that the protected memory area is the memory area used by the VMCB and NPT of the encrypted virtual machine.

[0247] Among them, the starting address of SMCR is recorded in the SMCR_START_ADDR register, and the ending address is recorded in the SMCR_END_ADDR register. The security processor can access the SMCR memory using the ASID value of 0x1FE. Ucode (Ucode: user-defined code or user-defined script, allowing users to expand the functions of SIMU according to their own needs) determines whether the virtual machine is an encrypted virtual machine by judging whether the address of the virtual machine's VMCB is in the SMCR. If it is an encrypted virtual machine, Ucode uses ASID 0x1FE to access the VMCB in the SMCR. During the operation of the encrypted virtual machine, the kernel uses the ASID of 0x1FE to access the NPT in the SMCR.

[0248] Therefore, although SIMU is no longer used to supervise the complete secure memory space of the encrypted virtual machine in the embodiment of the present invention, SIMU continues to be used to supervise the physical memory space of the virtual machine control block program of the encrypted virtual machine and the physical memory space of the nested page table of the encrypted virtual machine.

[0249] Please refer to Fig.13 , Fig.13 It is a schematic diagram of the configuration structure of a secure memory isolation management unit provided in an embodiment of the present invention.

[0250] like Fig.13 As shown, SIMU is integrated on the system CS, which can enhance the security of the system.

[0251] Among them, the data protection module is an encryption engine, which is set in the UMC (Unified Memory Controller), which can reduce the delay of data transmission and improve system performance. The CPU chip with integrated memory controller can directly manage the memory, thereby improving data access speed and overall computing efficiency. The unified memory controller can make the memory controller and the CPU core work at the same frequency, which can effectively reduce transmission delay.

[0252] It should be noted that Fig.13 The figure shows a computer system using UMC. In this case, the SM4 module can be set in the UMC. If the computer system does not use UMC technology, the Figure 1 As shown, the SM4 module is directly set in the memory controller 1.

[0253] Please refer to Fig.14 , Fig.14 It is a schematic diagram of a working process of a computer system provided by an embodiment of the present invention.

[0254] like Fig.14 As shown, when the computer system writes write data to the memory 3 (DRAM), the data write request includes ASID, C bit, physical write address HPA and initial write data data of the plain text to be written.

[0255] First, the data write request is transmitted to the SM4 engine (data protection module) through the request acquisition module 11. If the C bit is detected to be set, the initial write data data will first be encrypted by the SM4 engine with the data encryption key corresponding to the ASID in the data write request. If the C bit is not set, the plaintext initial write data is not encrypted; Fig.14 The write data data' output by the SM4 engine shown in includes encrypted data or unencrypted data (ie, plaintext initial write data data).

[0256] Then, according to the ASID in the data write request, the corresponding MACkey (write integrity verification key) is found in the MAC key table (key determination module), and the physical write address HPA and the write data data' and MAC key output by the SM4 engine are used as the input of MAC hash (memory integrity verification information determination module) to obtain a MAC with a length of n bits (write memory integrity verification information).

[0257] Next, the write data data' output by the SM4 engine and the MAC obtained by MAC hash calculation pass through the ECC controller (error correction information determination module) to calculate the data error correction information ECC (write data error correction information).

[0258] Finally, the memory controller 1 writes the write data data' output by the SM4 engine, the MAC calculated by the MAC hash, and the ECC calculated by the ECCcontroller to the physical write address HPA in the memory 3.

[0259] Security processor 2 is responsible for configuring the SM4 encryption engine and MAC key table.

[0260] Please refer to Fig.15 , Fig.15 It is another schematic diagram of the working process of the computer system provided by an embodiment of the present invention.

[0261] like Fig.15 As shown, when the computer system reads data from the memory 3, the data read request includes ASID, Cbit, and physical read address HPA.

[0262] First, the memory controller 1 reads the read data data' at the physical read address HPA from the memory 3 (data' is the write data after encryption or unencryption based on the initial write data data during the writing process).

[0263] Then, using the ASID in the data read request as the index, the corresponding MAC key (read integrity verification key) is searched in the MAC key table (key determination module); the read integrity verification key MAC key, the physical read address HPA and data' are used as the input of the MAC hash (memory integrity verification information determination module) to calculate the hash, and calculate the MAC' (read memory integrity verification information) with a length of n bits. The first comparison module 16 is used to compare the calculated MAC' with the MAC read from the memory 3 (write memory integrity verification information). If the two are not equal, an integrity error signal is sent to the security processor 2.

[0264] Next, the read data data' and MAC (write memory integrity verification information) read from the memory 3 are used as inputs of the error correction information determination module 14 (ECC controller), and the ECC' (read data error correction information) is recalculated by the error correction information determination module 14; and the second comparison module 17 is used to compare the ECC (write data error correction information) read from the memory 3 and the calculated ECC'. If the two are not equal, an ECC error signal is sent to the kernel (x86 core) to trigger an MCA (Machine Check Architecture) exception, that is, it is determined that the read data verification read at this time has failed, and a read data error signal is sent.

[0265] Finally, the read data data' obtained from memory 3 passes through the SM4 engine. If the C bit of the data read request is detected to be set, the read data data' will be decrypted by the SM4 engine using the data decryption key corresponding to the ASID in the data read request, and the decrypted read data data will be returned. If the C bit is not set, the read data data (data at this time is data') is directly returned without decryption.

[0266] The above describes multiple implementation schemes provided by the embodiments of the present invention. The various optional methods introduced in the implementation schemes can be combined and cross-referenced with each other without conflict, thereby extending a variety of possible implementation schemes, which can all be considered as implementation schemes disclosed and open in the embodiments of the present invention.

[0267] Although the embodiments of the present invention are disclosed above, the present invention is not limited thereto. Any person skilled in the art can make various changes and modifications without departing from the spirit and scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the scope defined by the claims.

Claims

1. A memory controller, characterized in that: include: A request acquisition module, used to acquire a memory access request of an encrypted virtual machine, wherein the memory access request is used to perform a data access operation on a secure memory space corresponding to the encrypted virtual machine, wherein the secure memory space is an arbitrarily allocated physical memory space; and the memory access request carries an address space identifier of the encrypted virtual machine; A key determination module, used to determine the integrity verification key corresponding to the encrypted virtual machine according to the address space identifier, the key determination module being configured by a security processor; A memory integrity verification information determination module is used to determine memory integrity verification information based on the physical access address of the memory access request, access data and the integrity verification key determined by the key determination module; the memory integrity verification information is used to verify the integrity of the secure memory space.

2. The memory controller according to claim 1, wherein: Also includes: an error correction information determination module, configured to calculate data error correction information based on the access data and the memory integrity verification information; The data error correction information is stored in a data error correction information storage space in a secure memory space, and free bits of the data error correction information storage space are used to store the memory integrity verification information.

3. The memory controller according to claim 2, wherein: Also includes: a data protection module, configured to determine whether to encrypt write data of the data write request based on an encryption identification bit carried by the data write request when the memory access request is a data write request; Or, when the memory access request is a data read request, it is determined whether to decrypt the read data read from the secure memory space based on an encryption identification bit carried by the data read request.

4. The memory controller according to claim 3, wherein: The access data is encrypted or unencrypted write data output by the data protection module, or the access data is read data read from the secure memory space.

5. The memory controller according to claim 4, wherein: Also includes: A first comparison module, used for comparing whether the memory integrity verification information read from the secure memory space and the re-determined memory integrity verification information are the same; If yes, confirming that the integrity verification of the secure memory space of the encrypted virtual machine has passed; if no, sending an integrity verification failure signal; the re-determined memory integrity verification information is determined based on the integrity verification key determined by the key determination module, the access data read from the secure memory space, and the physical access address; The integrity check failure signal is used to enable the security processor to set the virtual machine state of the encrypted virtual machine to prevent the encrypted virtual machine from running again.

6. The memory controller according to claim 5, wherein: Also includes: A second comparison module is used to compare whether the data error correction information read from the secure memory space and the re-determined data error correction information are the same; If yes, confirm that the data verification is passed; if no, send a data error signal; the re-determined data error correction information is determined based on the access data and memory integrity verification information read from the secure memory space.

7. A data writing method, characterized in that: The memory controller according to any one of claims 1 to 6 comprises: Get the data writing request of the encrypted virtual machine; Determining a write integrity verification key corresponding to the encrypted virtual machine based on the address space identifier carried by the data write request; Determine write memory integrity verification information according to the write data corresponding to the data write request, the write integrity verification key and the physical write address of the data write request; the write memory integrity verification information is used to verify the integrity of the secure memory space of the encrypted virtual machine; At least the write memory integrity verification information and the write data are written into the physical write address.

8. The data writing method according to claim 7, characterized in that: Before the step of determining the write memory integrity verification information according to the write data corresponding to the data write request, the write integrity verification key and the physical write address of the data write request, the step further includes: Determining whether the encryption flag bit carried by the data writing request is set; If yes, determining the data encryption key corresponding to the encrypted virtual machine using the address space identifier, and encrypting the initial write data of the data write request using the data encryption key, so as to use the encrypted initial write data as the write data; If not, the initial write data of the data write request is not encrypted, so as to use the initial write data as the write data.

9. The data writing method according to claim 8, characterized in that: Also includes: Determining write data error correction information according to the write memory integrity verification information and the write data; The step of writing at least the write memory integrity verification information and the write data into the physical write address includes: Writing the written memory integrity verification information, the written data, and the written data error correction information into the physical write address; The written data error correction information is stored in a data error correction information storage space in a secure memory space, and the free bits of the data error correction information storage space are used to store the written memory integrity verification information.

10. The data writing method according to claim 9, characterized in that: Before the step of obtaining the data writing request of the encrypted virtual machine, the method further includes: An initialization signal is sent to initialize a memory integrity verification information determination module of the memory controller.

11. A data reading method, characterized in that: include: Get the data read request of the encrypted virtual machine; Determining a read integrity verification key corresponding to the encrypted virtual machine based on the address space identifier carried by the data read request; Determining read memory integrity verification information according to the read data read from the physical read address of the data read request, the read integrity verification key, and the physical read address; When it is determined that the read memory integrity verification information is equal to the write memory integrity verification information read based on the physical read address, determining that the integrity verification of the secure memory space of the encrypted virtual machine has passed; Send read data; The written memory integrity verification information is written based on the data writing method described in any one of claims 7-10, and the read data is written based on the data writing method described in any one of claims 7-10.

12. The data reading method according to claim 11, characterized in that: The method further comprises: When it is determined that the read memory integrity verification information is not equal to the write memory integrity verification information, an integrity check failure signal is issued; The integrity check failure signal is used to enable the security processor to set the virtual machine state of the encrypted virtual machine to prevent the encrypted virtual machine from running again.

13. The data reading method according to claim 11, characterized in that: Also includes: Determining read data error correction information according to the read data and the write memory integrity verification information; Comparing whether the read data error correction information and the write data error correction information are equal; If yes, then determining that the read data verification passes; If not, a read data error signal is issued; Wherein, the written data error correction information is written based on the data writing method.

14. The data reading method according to claim 13, characterized in that: After the step of determining that the read data verification is passed and before the step of sending the read data, the method further includes: Determine whether the encryption flag bit carried by the data read request is set, If yes, determine the corresponding data decryption key using the address space identifier carried in the data read request, and use the read data decrypted using the data decryption key as the read data to be sent; If not, the step of sending the read data is performed.

15. A data writing device, characterized in that: include: A data writing request acquisition module, used to acquire a data writing request of an encrypted virtual machine, wherein the data writing request carries an address space identifier of the encrypted virtual machine; A write integrity verification key determination module, used to determine a write integrity verification key corresponding to the encrypted virtual machine based on the address space identifier carried by the data write request; A write memory integrity verification information determination module, used to determine the write memory integrity verification information according to the write data corresponding to the data write request, the write integrity verification key and the physical write address of the data write request; The written memory integrity verification information is used to verify the integrity of the secure memory space of the encrypted virtual machine; A writing module, used for writing at least the write memory integrity verification information and the write data into the physical write address; Wherein, the data write request is a memory access request of the encrypted virtual machine; The memory access request is used to perform a data access operation on a secure memory space corresponding to the encrypted virtual machine, where the secure memory space is an arbitrarily allocated physical memory space.

16. A data reading device, characterized in that: include: A data reading request acquisition module, used to acquire a data reading request of an encrypted virtual machine, wherein the data reading request carries an address space identifier of the encrypted virtual machine; A read integrity verification key determination module, used to determine a read integrity verification key corresponding to the encrypted virtual machine based on the address space identifier carried by the data read request; A read memory integrity verification information determination module, configured to determine the read memory integrity verification information according to the read data read by the physical read address of the data read request, the read integrity verification key and the physical read address; An integrity verification module, configured to determine that the integrity verification of the secure memory space of the encrypted virtual machine has passed when it is determined that the read memory integrity verification information is equal to the write memory integrity verification information read based on the physical read address; Sending module, used to send read data; The written memory integrity verification information and the read data are written based on the data writing device described in claim 15, and the data read request is a memory access request of the encrypted virtual machine described in the data writing device.

17. A computer system, characterized in that: include: The memory controller according to any one of claims 1 to 6; a security processor, configured to configure a key determination module of the memory controller; The memory includes a secure memory space corresponding to the encrypted virtual machine, the secure memory space is used to store or provide access data of the encrypted virtual machine, and the secure memory space is a physical memory space in the memory that is arbitrarily allocated.

18. The computer system of claim 17, wherein: Also includes: A secure memory isolation management unit is used to isolate and protect the physical memory space of the virtual machine control block program of the encrypted virtual machine and the physical memory space of the nested page table of the encrypted virtual machine.

Images