Memory controller, data writing and reading method, and computer system

Abstract

An embodiment of the present invention provides a memory controller, a data writing and reading method, and a computer system. The memory controller includes: a request acquisition module for acquiring a memory access request carrying an address space identifier of an encrypted virtual machine to perform data access operations on the secure memory space corresponding to the encrypted virtual machine, where the secure memory space is an arbitrarily allocated physical memory space; a key determination module for determining an integrity verification key based on the address space identifier, where the key determination module is configured by a security processor; a memory integrity verification information determination module for determining memory integrity verification information based on the physical access address of the memory access request, access data, and the integrity verification key determined by the key determination module; the memory integrity verification information is used to verify the integrity of the secure memory space. The technical solution provided by the embodiment of the present invention can improve the flexibility of memory allocation of encrypted virtual machines.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of computer technology, and in particular to a memory controller, data writing and reading methods, and a computer system. Background Art

[0002] The Secure Memory Isolation Management Unit (SIMU) is a hardware module used to provide memory isolation for encrypted VMs. However, the use of the SIMU imposes certain restrictions and impacts on the memory allocation of encrypted VMs.

[0003] In this context, how to provide a technical solution to improve the flexibility of memory space allocation of the encrypted virtual machine has become a technical problem that those skilled in the art urgently need to solve. Summary of the Invention

[0004] In view of this, embodiments of the present invention provide a memory controller, data writing and reading methods, and a computer system to improve the flexibility of memory space allocation of an encrypted virtual machine.

[0005] To achieve the above objectives, the embodiments of the present invention provide the following technical solutions.

[0006] In a first aspect, an embodiment of the present invention provides a memory controller, comprising:

[0007] a request acquisition module, configured to acquire a memory access request of an encrypted virtual machine, wherein the memory access request is used to perform a data access operation on a secure memory space corresponding to the encrypted virtual machine, wherein the secure memory space is an arbitrarily allocated physical memory space; and the memory access request carries an address space identifier of the encrypted virtual machine;

[0008] a key determination module, configured to determine an integrity verification key corresponding to the encrypted virtual machine according to the address space identifier, the key determination module being configured by a security processor;

[0009] A memory integrity verification information determination module is used to determine memory integrity verification information based on the physical access address of the memory access request, the access data and the integrity verification key determined by the key determination module; the memory integrity verification information is used to verify the integrity of the secure memory space.

[0010] In a second aspect, an embodiment of the present invention provides a data writing method, which is applied to the memory controller as described in the first aspect, comprising:

[0011] Get the data write request of the encrypted virtual machine;

[0012] Determining a write integrity verification key corresponding to the encrypted virtual machine based on the address space identifier carried in the data write request;

[0013] Determining write memory integrity verification information based on the write data determined by the data write request, the write integrity verification key, and the physical write address of the data write request, wherein the write memory integrity verification information is used to verify the integrity of the secure memory space of the encrypted virtual machine;

[0014] At least the write memory integrity verification information and the write data are written into the physical write address.

[0015] In a third aspect, an embodiment of the present invention provides a data reading method, comprising:

[0016] Get the data read request of the encrypted virtual machine;

[0017] Determining a read integrity verification key corresponding to the encrypted virtual machine based on the address space identifier carried in the data read request;

[0018] re-determining read memory integrity verification information based on the read data read from the physical read address of the data read request, the read integrity verification key, and the physical read address;

[0019] When it is determined that the read memory integrity verification information is equal to the write memory integrity verification information read based on the physical read address, determining that the integrity verification of the secure memory space of the encrypted virtual machine has passed;

[0020] Send read data;

[0021] The memory integrity verification information is written based on the data writing method described in the second aspect, and the read data is written based on the data writing method described in the second aspect.

[0022] In a fourth aspect, an embodiment of the present invention provides a data writing device, comprising:

[0023] A data writing request obtaining module, configured to obtain a data writing request of an encrypted virtual machine, wherein the data writing request carries an address space identifier of the encrypted virtual machine;

[0024] A write integrity verification key determination module, configured to determine a write integrity verification key corresponding to the encrypted virtual machine based on the address space identifier carried in the data write request;

[0025] a write memory integrity verification information determination module, configured to determine write memory integrity verification information based on the write data corresponding to the data write request, the write integrity verification key, and the physical write address of the data write request; the write memory integrity verification information is used to verify the integrity of the secure memory space of the encrypted virtual machine;

[0026] A writing module, configured to write at least the write memory integrity verification information and the write data into the physical write address;

[0027] The data write request is a memory access request of the encrypted virtual machine; the memory access request is used to perform a data access operation on the secure memory space corresponding to the encrypted virtual machine, and the secure memory space is an arbitrarily allocated physical memory space.

[0028] In a fifth aspect, an embodiment of the present invention provides a data reading device, comprising:

[0029] A data read request acquisition module, configured to acquire a data read request from an encrypted virtual machine, wherein the data read request carries an address space identifier of the encrypted virtual machine;

[0030] a read integrity verification key determination module, configured to determine a read integrity verification key corresponding to the encrypted virtual machine based on the address space identifier carried in the data read request;

[0031] a read memory integrity verification information determination module, configured to determine read memory integrity verification information based on read data read from a physical read address of the data read request, the read integrity verification key, and the physical read address;

[0032] an integrity verification module, configured to determine that the integrity verification of the secure memory space of the encrypted virtual machine has passed when it is determined that the read memory integrity verification information is equal to the write memory integrity verification information read based on the physical read address;

[0033] Sending module, used to send read data;

[0034] The written memory integrity verification information and the read data are written based on the data writing device described in the fourth aspect, and the data read request is a memory access request of the encrypted virtual machine described in the data writing device.

[0035] In a sixth aspect, an embodiment of the present invention provides a computer system, including:

[0036] The memory controller as described in the first aspect;

[0037] a security processor, configured to configure a key determination module of the memory controller;

[0038] The memory includes a secure memory space, where the secure memory space is used to store or provide access to data, and the secure memory space is a physical memory space in the memory that is arbitrarily allocated.

[0039] A memory controller provided by an embodiment of the present invention includes: a request acquisition module, used to obtain a memory access request of an encrypted virtual machine, the memory access request is used to perform a data access operation on a secure memory space corresponding to the encrypted virtual machine, wherein the secure memory space is an arbitrarily allocated physical memory space; the memory access request carries an address space identifier of the encrypted virtual machine; a key determination module, used to determine an integrity verification key corresponding to the encrypted virtual machine based on the address space identifier, the key determination module being configured by a security processor; a memory integrity verification information determination module, used to determine memory integrity verification information based on the physical access address of the memory access request, access data, and the integrity verification key determined by the key determination module; the memory integrity verification information is used to verify the integrity of the secure memory space.

[0040] It can be seen that the technical solution provided by the embodiment of the present invention is that after the request acquisition module of the memory controller obtains the memory access request of the encrypted virtual machine, the key determination module and the memory integrity verification information determination module in the memory controller can be used to determine the integrity verification key and the memory integrity verification information based on the memory access request, and finally complete the verification of the integrity of the secure memory space of the encrypted virtual machine through the memory controller; thereby avoiding the restriction that the secure memory space allocated to the encrypted virtual machine must be a physical memory space with continuous addresses due to the usage characteristics of the SIMU when using the SIMU to protect the integrity of the secure memory space of the encrypted virtual machine; that is, by designing the internal structure of the memory controller, the memory controller replaces the SIMU to protect the integrity of the secure memory space of the encrypted virtual machine, so that when allocating secure memory space for the encrypted virtual machine, it is no longer subject to the usage restriction that the physical memory space with continuous addresses must be allocated, thereby improving the allocation flexibility of the secure memory space of the encrypted virtual machine. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are merely embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.

[0042] Figure 11 is a schematic structural diagram of a memory controller provided by an embodiment of the present invention;

[0043] Figure 2 1 is a structural diagram of a key determination module in a memory controller provided by an embodiment of the present invention;

[0044] Figure 3 This is a schematic diagram of the structure of a secure memory isolation management unit provided by an embodiment of the present invention;

[0045] Figure 4 This is a schematic diagram of the working of ECC error correction technology when data is written;

[0046] Figure 5 This is a schematic diagram of the working of ECC error correction technology when data is read;

[0047] Figure 6 1 is a flow chart of a data writing method provided by an embodiment of the present invention;

[0048] Figure 7 is another flowchart of the data writing method provided by an embodiment of the present invention;

[0049] Figure 8 1 is a flow chart of a data reading method provided by an embodiment of the present invention;

[0050] Figure 9 is another flow chart of the data reading method provided by an embodiment of the present invention;

[0051] Figure 10 1 is a structural diagram of a data writing device provided by an embodiment of the present invention;

[0052] Figure 11 1 is a schematic structural diagram of a data reading device provided by an embodiment of the present invention;

[0053] Figure 12 is a schematic structural diagram of a computer system provided by an embodiment of the present invention;

[0054] Figure 13 This is a schematic diagram of a configuration structure of a secure memory isolation management unit provided by an embodiment of the present invention;

[0055] Figure 14 This is a schematic diagram of a working process of a computer system provided by an embodiment of the present invention;

[0056] Figure 15 This is another schematic diagram of the working process of the computer system provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0057] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0058] In virtualization technology, virtual machines (VMs) fully trust the Virtual Machine Monitor (VMM), such as the hypervisor. The hypervisor has access to all VM data, including the VM's Virtual Machine Control Block (VMCB), Nested Page Table (NPT), and memory space, rendering the VM completely confidential. The VMCB is a data structure used in virtualization technology to store VM status and control information. The NPT is a page table mechanism used to implement deeper virtualization (nested virtualization). The memory space is used to access VM data.

[0059] With the development of information technology, data protection is becoming increasingly important. In the field of virtualization technology, confidential computing has become an indispensable feature of services provided by major cloud computing platforms. To protect the confidentiality of virtual machine data, encrypted virtual machine technology can be used. With the help of memory encryption technology, the operating system encrypts the virtual machine's memory space using a key bound to it (configured by the security processor), forming a secure memory space accessible only to the encrypted virtual machine and the security processor. Data stored in the secure memory space is inaccessible to other virtual machines and hypervisors except the encrypted virtual machine. Furthermore, while ensuring the confidentiality of the secure memory space, the CPU register state of the encrypted virtual machine is encrypted to prevent the hypervisor from reading or modifying the encrypted virtual machine's registers, further enhancing the confidentiality of the encrypted virtual machine.

[0060] At the same time, based on the confidentiality protection of the above-mentioned encrypted virtual machine, the SIMU hardware module is further used to isolate the memory space of the encrypted virtual machine's VMCB, the memory space of the encrypted virtual machine's NPT, and the secure memory space of the encrypted virtual machine, preventing the Hypervisor or other virtual machines from reading or tampering with the VMCB, NPT, and secure memory space of the encrypted virtual machine.

[0061] It should be noted that the secure memory space of the encrypted virtual machine may refer to: the memory space used by the encrypted virtual machine to store data is encrypted to ensure the security of data stored in the physical memory RAM.

[0062] The memory space of the VMCB of an encrypted virtual machine may refer to data in the VMCB being encrypted. When encrypting the VMCB memory, information in the VMCB data structure may be encrypted to protect the encrypted virtual machine's state and control information from unauthorized access. This encryption protects the encrypted virtual machine's own data in the encrypted memory space.

[0063] Encrypting the NPT memory space of a virtual machine refers to encrypting the memory of the Nested Page Table (NPT). NPT is a mechanism used in virtualization technology to implement address translation, allowing virtual machines to have their own page tables. Encrypting the NPT memory space of a virtual machine means encrypting the information in these page tables to ensure the security of the encrypted virtual machine's address space and prevent potential attacks during the address translation process.

[0064] However, due to the use and setting characteristics of SIMU, when it implements security and integrity protection for secure memory space, the addresses of the protected secure memory space need to be continuous addresses. In other words, when the virtual machine monitor allocates physical memory space for the encrypted virtual machine to convert it into the secure memory space of the encrypted virtual machine, the addresses of the physical memory space must be continuous. After the system OS running the hypervisor has run for a long time, the physical memory space will become fragmented. Even if the system has enough free physical memory space, the allocation of physical memory space with continuous addresses may fail, resulting in usage restrictions when using SIMU to implement security and integrity protection of the encrypted memory physical space, thereby limiting the application of hardware modules with SIMU.

[0065] Based on this, an embodiment of the present invention provides a memory controller to improve the flexibility of allocating the secure memory space of the encrypted virtual machine while ensuring the integrity of the secure memory space of the encrypted virtual machine.

[0066] Please refer to Figure 1 , Figure 1 It is a structural diagram of a memory controller provided by an embodiment of the present invention.

[0067] like Figure 1 As shown, the memory controller 1 includes:

[0068] A request acquisition module 11 is configured to acquire a memory access request of an encrypted virtual machine, wherein the memory access request is used to perform a data access operation on a secure memory space corresponding to the encrypted virtual machine, wherein the secure memory space is an arbitrarily allocated physical memory space; and the memory access request carries an address space identifier of the encrypted virtual machine;

[0069] a key determination module 12, configured to determine an integrity verification key corresponding to the encrypted virtual machine according to the address space identifier, the key determination module being configured by a security processor;

[0070] The memory integrity verification information determination module 13 is used to determine memory integrity verification information based on the physical access address of the memory access request, the access data and the integrity verification key determined by the key determination module; the memory integrity verification information is used to verify the integrity of the secure memory space.

[0071] The request acquisition module 11 may be an interface of the memory controller 1 , and is used to implement data interaction between the memory controller 1 and an external hardware module.

[0072] The key determination module 12 queries the integrity verification key corresponding to the encrypted virtual machine according to the address space identifier (ASID) carried in the memory access request.

[0073] In encrypted virtual machine technology, an ASID is used to associate the data encryption key of each virtual machine, ensuring that only the corresponding encrypted virtual machine can decrypt data in its secure memory space. Embodiments of the present invention further utilize the association between the ASID and the encrypted virtual machine to ensure that each encrypted virtual machine has its own integrity verification key, thereby ensuring the reliability of subsequent verification of the integrity of the encrypted virtual machine's secure memory space. The host or hypervisor can only use an ASID value of 0, while virtual machines can use ASIDs of 0 or non-zero. Therefore, the ASID can be used to find the integrity verification key of the encrypted virtual machine associated with that ASID.

[0074] The Platform Security Processor (PSP) is a coprocessor integrated within the processor. The PSP has its own independent resources, inaccessible to the outside world (including the CPU core). Furthermore, the PSP possesses high system privileges and can access all system resources, including CPU control, system memory, and I / O. Therefore, configuring the key determination module 12 with the PSP further ensures the security of the integrity verification key within the module.

[0075] The memory integrity verification information determination module 13 calculates memory integrity verification information for performing integrity verification.

[0076] In one embodiment, the memory integrity verification information may be a message authentication code (MAC).

[0077] Taking the memory integrity verification information as a message verification code as an example, the structure of the key determination module 12 can refer to Figure 2 , Figure 2 The present invention provides a schematic diagram of a key determination module in a memory controller according to an embodiment of the present invention.

[0078] like Figure 2 As shown, when the memory integrity verification information is MAC, in order to determine the message authentication code, the key determination module 12 added to the memory controller 1 may include an address space identification table entry (ASID) and an integrity verification key table entry (MAC key).

[0079] When the memory controller 1 is working, according to the received data access request, in the key determination module 12 (MAC key table), the ASID of the encryption virtual machine of the data access request is used as the index to query the corresponding integrity verification key MAC key from the integrity verification key table item.

[0080] The MAC key table entry stores the integrity verification key, which can be 128 bits long and is used to determine the MAC.

[0081] The key determination module 12 can only be configured by the security processor. When the system starts, the security processor initializes the contents stored in the key determination module 12 to all 0s.

[0082] When a virtual machine (including an encrypted virtual machine) is started, the security processor initializes the table entry corresponding to the virtual machine's ASID. If the virtual machine is an encrypted virtual machine, a randomly generated integrity verification key is recorded in the MAC key table entry corresponding to the encrypted virtual machine's ASID. Otherwise, the MAC key table entry corresponding to the non-encrypted virtual machine's ASID is initialized to 0. When the encrypted virtual machine is terminated, the MAC key table entry corresponding to the encrypted virtual machine's ASID is configured to all 0s.

[0083] When the memory integrity verification information is MAC, the memory integrity verification information determination module 13 takes the host physical address (HPA) of the memory access request, access data, and integrity verification key (MAC key) as input when determining the MAC, uses a hash algorithm to calculate a hash value, and truncates the calculated hash value to n bits as the MAC value (i.e., the memory integrity verification information).

[0084] When using a hash algorithm to calculate a hash value, the calculation formula used can be:

[0085] MAC=hash_n(HPA, data, MAC key), where MAC key is not 0.

[0086] When MAC key = 0, the calculated MAC value is 0.

[0087] The hash algorithm used can be:

[0088] SM3 algorithm, SM3 algorithm is a cryptographic hash function standard that can be used for digital signatures, message authentication code generation and verification, and random number generation; the output of the SM3 algorithm is a 256-bit (32-byte) hash value;

[0089] SHA-2 (Secure Hash Algorithm 2), including SHA-256, SHA-512, etc., provides hash values ​​of different lengths;

[0090] SHA-3 (Secure Hash Algorithm 3), SHA-3 is the successor algorithm to SHA-2. It is designed differently from SHA-2 and provides greater scalability and security.

[0091] BLAKE2, a newer cryptographic hash function designed to provide better performance and security;

[0092] bcrypt, a hash function designed for password storage that uses salt to protect passwords from rainbow table attacks;

[0093] Argon2 is one of the most secure password hashing algorithms currently available, and it resists many known password attack techniques.

[0094] When calculating the above MAC value, for example, the SM3 algorithm may be used. The SM3 algorithm is applicable not only to software implementation but also to hardware implementation and has good flexibility.

[0095] The key determination module 12 and the memory integrity verification information determination module 13 are used to implement integrity verification of the secure memory space of the encrypted virtual machine, thereby avoiding the use of SIMU to supervise and protect the secure memory space. Therefore, the secure memory space supervised by SIMU is no longer subject to the restriction that the secure memory space must be a physical memory space with continuous addresses. When allocating secure memory space to the encrypted virtual machine, it can be allocated arbitrarily from the physical memory space of the memory, thereby improving the flexibility of allocating secure memory space.

[0096] To understand the working characteristics of SIMU, please refer to Figure 3 , Figure 3 It is a structural diagram of the secure memory isolation management unit provided by an embodiment of the present invention. Figure 3The following describes the encrypted virtual machine CSV3 (China Secure Virtualization 3, the third generation of China Secure Virtualization) as an example.

[0097] In CSV3 encryption virtual machine technology, such as Figure 3 As shown, by integrating some control registers and SPOT tables (Secure Page Ownership Table: secure page owner configuration table) in the SIMU of the system CS (Client-Server: client-server network architecture), the control registers and SPOT tables can only be read and written by the security processor.

[0098] In the SIMU, the Protect_base and Protect_size control registers define the starting physical address and size of the encrypted virtual machine's protected memory area (the complete secure memory space), respectively, thereby defining the Protect limit for the complete secure memory space. The SIMU divides the complete secure memory space into N equal parts, each of which is an independently configurable region called an SMR (secure memory region).

[0099] The complete secure memory space is allocated from the physical memory space DRAM limit of the memory, and the physical memory space of the memory is defined by the starting physical address DRAM base and size DRAM size of the memory.

[0100] On the other hand, the SPOT table contains N entries, among which the two more important fields in each entry are V and ASID. V=1 means that the protected memory area corresponding to the SMR (or SMCR: the SMR that protects the memory space used by the VMCB and NPT of the virtual machine is called SMCR) pointed to by the entry needs to be supervised by SIMU when accessed; V=0 means that the protected memory area corresponding to the SMR (or SMCR) pointed to by the entry does not need to be supervised when accessed. At this time, the protected memory area corresponding to the SPOT entry is called NMR (normal memory area). In other words, SIMU supervises the complete secure memory space of the encrypted virtual machine, and in the complete secure memory space, it can be determined which parts need to be supervised by SIMU and which parts do not need to be supervised by SIMU according to usage requirements.

[0101] The ASID defines the ASID of the owner of the SMR corresponding to the entry. For example, if the ASID of a SPOT table entry is 1 and V=1, then only the virtual machine with ASID 1 can access the corresponding SMR, and access by other ASIDs will be blocked by the SIMU.

[0102] Assuming the SPOT table contains 8192 entries and the size of the protected memory area is 64GB, the average size of the protected memory area protected by each SMR is 8MB (64 / 8192*1024). To start an 8GB CSV3 virtual machine (encrypted virtual machine), the hypervisor needs to allocate 1024 8MB continuous physical memory areas (physical memory space). The security processor configures the SPOT table entries corresponding to these physical memory areas with V set to 1 (indicating that the complete secure memory space of the CSV3 virtual machine is entirely supervised and protected by the SIMU), and the ASID value is the ASID assigned by the system to the CSV3 virtual machine. Therefore, the complete secure memory space of the encrypted virtual machine must be allocated using physical memory space with continuous addresses.

[0103] It should be noted that the secure memory space of the encrypted virtual machine described in the embodiment of the present invention refers to the secure memory space in the complete secure memory space of the encrypted virtual machine, except for the secure memory space corresponding to the SMCR supervised by the SIMU.

[0104] It can be seen that the technical solution provided by the embodiment of the present invention is that after the request acquisition module 11 of the memory controller obtains the memory access request of the encrypted virtual machine, the key determination module 12 and the memory integrity verification information determination module 13 in the memory controller 1 can be used to determine the integrity verification key and the memory integrity verification information based on the memory access request, and finally the integrity verification of the secure memory space of the encrypted virtual machine is completed through the memory controller 1; thereby avoiding the restriction that the secure memory space allocated to the encrypted virtual machine is a physical memory space with continuous addresses due to the usage characteristics of the SIMU when using the SIMU to protect the integrity of the secure memory space of the encrypted virtual machine; that is, by designing the internal structure of the memory controller 1, the memory controller 1 replaces the SIMU to implement the protection of the integrity of the secure memory space, so that when allocating secure memory space for the encrypted virtual machine, it is no longer subject to the usage restriction that the physical memory space with continuous addresses must be allocated, thereby improving the allocation flexibility of the secure memory space of the encrypted virtual machine.

[0105] Please continue to refer to Figure 1 In one embodiment, the memory controller 1 provided by the embodiment of the present invention may further include:

[0106] an error correction information determination module 14, configured to calculate data error correction information based on the access data and the memory integrity verification information;

[0107] The data error correction information is stored in a data error correction information storage space in a secure memory space, and the idle bits of the data error correction information storage space are used to store the memory integrity verification information.

[0108] Error-Correcting Code (ECC) is introduced into the memory controller 1 to improve the stability of the memory. The implementation process of ECC error correction technology can be referred to Figure 4 and Figure 5 , Figure 4 This is a working diagram of ECC error correction technology when writing data. Figure 5 This is a working diagram of ECC error correction technology when data is read.

[0109] like Figure 4 As shown, when the memory controller 1 (Memory Controller) performs a data write operation to the memory 3 (DRAM, such as DDR5), that is, when the access data (data) of the memory access request (in this case, a data write request) is written to the memory 3, the error correction information determination module 14 (such as an ECC controller) uses the access data to calculate the corresponding data error correction information (ECC); then, the access data and the calculated data error correction information (ECC) are stored in the memory 3 at the same time.

[0110] like Figure 5 As shown, when the memory controller 1 performs a read operation on the memory 3, it simultaneously reads the access data and data error correction information (ECC) stored in the memory 3, recalculates the data error correction information based on the read access data, and compares the recalculated data error correction information with the data error correction information read from the memory. If the two are equal, it indicates that the access data stored in the memory 3 has not been bit flipped, and the read access data can be directly returned. If they are not equal, the ECC controller attempts to correct the flipped bits in the read access data. If the access data can be corrected by the ECC controller, the corrected data is returned. If the access data cannot be corrected, the erroneous access data is returned and an ECC error signal is issued.

[0111] The ECC bits used to store data error correction information in memory 3 (data error correction information storage space in the secure memory space) have some idle bits, which can be used to store other data information, such as storing MAC values ​​(memory integrity verification information).

[0112] Please continue to refer to Figure 1 In order to ensure the confidentiality of access data stored in the secure memory space, in some embodiments, the memory controller 1 may further include:

[0113] The data protection module 15 is configured to determine whether to encrypt the write data of the data write request based on the encryption identification bit carried by the data write request when the memory access request is a data write request.

[0114] Or, when the memory access request is a data read request, it is determined whether to decrypt the read data read from the secure memory space based on the encryption identification bit carried by the data read request.

[0115] The secure memory space of an encrypted virtual machine is implemented using memory encryption technology. Memory encryption technology provides a simple and efficient way to encrypt memory, enabling the system to defend against certain attacks. For example, some disks can store data encrypted, but this data becomes plaintext when loaded into memory. With memory encryption technology, this data remains encrypted in memory. Therefore, memory encryption technology is used to protect the secure memory space of an encrypted virtual machine, ensuring that data stored in the secure memory space is encrypted and protected.

[0116] When encrypting the memory space of the encrypted virtual machine to form a secure memory space, a high-performance encryption and decryption engine (data protection module 15) is integrated in the memory controller 1. The keys (data encryption key and data decryption key) used by the data protection module 15 to encrypt and decrypt access data are randomly generated by the security processor and stored in specific registers of the memory controller 1. Software running on the CPU core (such as other virtual machines and VMM) cannot access the key.

[0117] Based on memory encryption technology, the process of encrypting the memory space of the encrypted virtual machine and forming a secure memory space can be expressed as follows:

[0118] After receiving a memory access request (for example, a data write request), the memory controller 1 first checks whether the encryption flag (C bit, such as bit 47 of the physical write address) carried in the data write request is set. If the encryption flag is set, the data protection module 15 in the memory controller 1 determines the corresponding data encryption key based on the ASID carried in the data write request and encrypts the access data (in this case, the write data). If the encryption flag is not set, the write data is not encrypted.

[0119] When the memory controller 1 receives a data read request, it first checks whether the encryption flag (C bit, such as bit 47 of the physical read address) carried in the data read request is set. If the encryption flag is set, the data protection module 15 of the memory controller 1 determines the corresponding data decryption key based on the ASID carried in the data read request, thereby decrypting the read data read from the physical read address. If the encryption flag is not set, the read data is not decrypted.

[0120] Since the encryption flag can be set or not set, the access data is the encrypted or unencrypted write data output by the data protection module, or the access data is the read data read from the secure memory space.

[0121] When the memory access request is a data write request, the access data is the write data encrypted by the data protection module 15 or the unencrypted write data (i.e., the initial write data); when the memory access request is a data read request, the access data is directly the read data read from the secure memory space. At this time, the read data can be the encrypted or unencrypted write data written based on the physical write address during the process of the memory controller 1 processing the data write request.

[0122] To verify memory integrity, please refer to Figure 1 , the memory controller 1 may further include:

[0123] a first comparison module 16, configured to compare the memory integrity verification information read from the secure memory space and the re-determined memory integrity verification information to determine whether they are the same; if so, confirming that the integrity verification of the secure memory space of the encrypted virtual machine has passed; if not, issuing an integrity verification failure signal; the re-determined memory integrity verification information is determined based on the integrity verification key determined by the key determination module 12, the access data read from the secure memory space, and the physical access address;

[0124] The integrity check failure signal is used to enable the security processor to set the virtual machine state of the encrypted virtual machine to prevent the encrypted virtual machine from running again.

[0125] The first comparison module 16 is used when the memory controller 1 receives and processes a data read request to determine whether the memory integrity verification information read from the secure memory space is damaged, thereby verifying whether the secure memory space is complete.

[0126] The re-determined memory integrity verification information is also implemented by the memory integrity verification information determination module 13, which uses the data physical access address (in this case, the physical read address), the access data (in this case, the read data read from the physical read address), and the integrity verification key (determined based on the ASID carried by the data read request) as input to recalculate the memory integrity verification information.

[0127] The integrity of the secure memory space of the encrypted virtual machine is guaranteed by the verification of the memory integrity verification information (such as the MAC message authentication code). If the secure memory space of the encrypted virtual machine is tampered with, when the encrypted virtual machine issues a data read request and the memory controller 1 processes the data read request, the memory integrity verification information verification fails, and the memory controller 1 then sends an integrity verification failure signal integrity error to the security processor. The security processor can set the status of the corresponding encrypted virtual machine based on the received integrity error. When the encrypted virtual machine executes the VMRUN (virtual machine run) instruction next time, it will detect the status error of the encrypted virtual machine, so that it can exit in time and set the exit code to indicate that the encrypted virtual machine has an integrity error. The incorrect use of the encrypted virtual machine can be terminated in time.

[0128] In other embodiments, in order to ensure the accuracy of the access data (read data in this case), the memory controller 1 may further include:

[0129] The second comparison module 17 is used to compare whether the data error correction information read from the secure memory space and the re-determined data error correction information are the same; if so, confirming that the data verification is passed; if not, issuing a data error signal; the re-determined data error correction information is determined based on the access data and memory integrity verification information read from the secure memory space.

[0130] When the data error correction information ECC is re-determined, it can be implemented by the error correction information determination module 14, which takes the read access data (i.e., read data) and the read memory integrity verification information as input, and recalculates the data error correction information when processing the data read request, thereby comparing it with the data error correction information read directly from the secure memory space to determine whether there is an error in the read data.

[0131] An embodiment of the present invention further provides a data writing method, which is implemented based on the memory controller provided by the aforementioned embodiment.

[0132] Please refer to Figure 6 , Figure 6 It is a flowchart of a data writing method provided by an embodiment of the present invention.

[0133] like Figure 6 As shown, the method may include the following steps:

[0134] Step S101: obtaining a data write request of an encrypted virtual machine.

[0135] Step S101 may be implemented by a request acquisition module of the memory controller.

[0136] Step S102: determining a write integrity verification key corresponding to the encrypted virtual machine based on the address space identifier carried in the data write request.

[0137] Step S102 can be implemented by a key determination module within the memory controller. The data write request is issued by the encryption virtual machine, and the ASID is associated with the encryption virtual machine. Therefore, the ASID carried in the data write request is used to determine the write integrity verification key corresponding to the encryption virtual machine.

[0138] The write integrity verification key is configured in the key determination module by the security processor.

[0139] Step S103 : determining write memory integrity verification information according to the write data corresponding to the data write request, the write integrity verification key, and the physical write address of the data write request.

[0140] The written memory integrity verification information is used to verify the integrity of the secure memory space of the encrypted virtual machine.

[0141] Step S103 can be implemented by a memory integrity verification information determination module within the memory controller. For example, the memory integrity verification information determination module calculates the write memory integrity verification information using the SM3 algorithm, a write integrity verification key, write data determined based on the data write request, and a physical write address.

[0142] Step S104: writing at least the write memory integrity verification information and the write data into the physical write address.

[0143] After obtaining the write memory integrity verification information, the write memory integrity verification information and the write data can be written into the secure memory space indicated by the physical write address of the data write request.

[0144] It can be seen that the technical solution provided by the embodiment of the present invention is that when the memory access request is a data write request, after the memory controller obtains the data write request of the encrypted virtual machine, it can use the address space identifier carried by the data write request to determine the write integrity verification key, and then use the write integrity verification key, write data, and physical write address to obtain write memory integrity verification information; so as to facilitate the use of the write memory integrity verification information to verify the integrity of the secure memory space; thereby avoiding the restriction that the secure memory space allocated to the encrypted virtual machine is a physical memory space with continuous addresses due to the usage characteristics of the SIMU when using the SIMU to protect the integrity of the secure memory space of the encrypted virtual machine; that is, by designing the internal structure of the memory controller, the memory controller replaces the SIMU to implement the protection of the integrity of the secure memory space, so that when allocating secure memory space for the encrypted virtual machine, it is no longer subject to the usage restriction of having to allocate physical memory space with continuous addresses, thereby improving the allocation flexibility of the secure memory space of the encrypted virtual machine.

[0145] In one embodiment, initialization processing can also be performed. Figure 7 , Figure 7 This is another flowchart of the data writing method provided by an embodiment of the present invention.

[0146] like Figure 7 As shown, the method may include the following steps:

[0147] Step S200: sending an initialization signal.

[0148] The initialization signal is used to initialize the memory integrity verification information determination module of the memory controller.

[0149] Initializing the memory integrity verification information determination module, that is, initializing the memory integrity verification information (MAC), can ensure that all data is verified before the encrypted virtual machine accesses the secure memory space, preventing the data from being tampered with during transmission.

[0150] In order to achieve data security protection for processing data write requests, in one embodiment, the stored write data may be encrypted data, please continue to refer to Figure 7 ,like Figure 7 As shown, the method further includes:

[0151] Step S201: Obtain a data write request of an encrypted virtual machine.

[0152] Step S202: Determine a write integrity verification key corresponding to the encrypted virtual machine based on the address space identifier carried in the data write request.

[0153] Step S203, determining whether the encryption flag carried in the data write request is set, if yes, executing step S204, if not, executing step S205.

[0154] Step S204: using the address space identifier to determine the data encryption key corresponding to the encrypted virtual machine, and using the data encryption key to encrypt the initial write data of the data write request, so as to use the encrypted initial write data as the write data.

[0155] Step S205 : The initial write data of the data write request is not encrypted, so that the initial write data is used as the write data.

[0156] Steps S203 to S205 may be implemented by a data protection module within the memory controller.

[0157] By judging whether the encryption flag (C bit) carried by the data write request is set, the confidentiality of the content of the initial write data is determined. This ensures that even if the initial write data that needs to be kept confidential is obtained by unauthorized access, its content cannot be directly read, ensuring the security of the content of the written data.

[0158] Please continue to refer to Figure 7 , the method may further include:

[0159] Step S206, determine whether the write integrity verification key is 0, if yes, execute step 207, if not, execute step S208.

[0160] Step S207: Determine that the memory integrity verification information written is 0.

[0161] When the security processor configures the key determination module, the configured integrity verification key value will be 0. Therefore, when the obtained integrity verification key (write integrity verification key) is 0, the calculated write memory integrity verification information is 0.

[0162] Step S208: Determine write memory integrity verification information according to the write data, the write integrity verification key, and the physical write address of the data write request.

[0163] The written memory integrity verification information is used to verify the integrity of the secure memory space of the encrypted virtual machine.

[0164] Step S209 , determining write data error correction information based on the write memory integrity verification information and the write data.

[0165] Step S209 may be implemented by an error correction information determination module within the memory controller.

[0166] Step S210: writing the written memory integrity verification information, the written data, and the written data error correction information into the physical write address.

[0167] The written data error correction information is stored in a data error correction information storage space in the secure memory space, and the idle bits of the data error correction information storage space are used to store the written memory integrity verification information.

[0168] The calculation and storage of written data error correction information facilitates subsequent error detection and correction of written data, thereby improving the reliability of data storage and the stability of the system.

[0169] In the above process of executing the data write request, the memory integrity verification information used is called write memory integrity verification information, the data error correction information used is called write data error correction information, and the integrity verification key used is called write integrity verification key.

[0170] An embodiment of the present invention further provides a data reading method, which, based on the implementation of the data writing method provided in the aforementioned embodiment, completes the verification of the integrity of the secure memory space during the data reading process.

[0171] Please refer to Figure 8 , Figure 8 1 is a flow chart of a data reading method provided by an embodiment of the present invention.

[0172] like Figure 8 Said method may comprise the following steps:

[0173] Step S301: Obtain a data read request from an encrypted virtual machine.

[0174] Step S301 may be implemented by a request acquisition module of the memory controller.

[0175] Step S302: Determine a read integrity verification key corresponding to the encrypted virtual machine based on the address space identifier carried in the data read request.

[0176] Step S302 may be implemented by a key determination module within the memory controller.

[0177] Step S303 : determining read memory integrity verification information according to the read data read from the physical read address of the data read request, the read integrity verification key, and the physical read address.

[0178] Step S303 may be implemented by a memory integrity verification information determination module of the memory controller.

[0179] When executing a data read request, the input of the memory integrity verification information determination module is: the read integrity verification key determined based on the address space identifier carried by the data read request, the read data read according to the physical read address, the physical read address, and the recalculation of the read memory integrity verification information during the reading process.

[0180] Step S304: When it is determined that the read memory integrity verification information is equal to the write memory integrity verification information read based on the physical read address, it is determined that the integrity verification of the secure memory space of the encrypted virtual machine has passed.

[0181] Step S304 may be implemented by a first comparison module within the memory controller.

[0182] The first comparison module takes the read memory integrity verification information and the write memory integrity verification information as input, and compares the two. If they are equal, it means that the secure memory space integrity verification has passed.

[0183] Step S305: Send read data.

[0184] The memory integrity verification information is written based on the data writing method described in any of the aforementioned embodiments, and the read data is written based on the data writing method described in any of the aforementioned embodiments. The read data in this case can be encrypted or unencrypted write data written based on the physical write address during the process of the memory controller 1 processing the data write request.

[0185] It can be seen that the technical solution provided by the embodiment of the present invention is that when the memory access request is a data read request, after the memory controller obtains the data read request of the encrypted virtual machine, it can use the address space identifier carried by the data read request to determine the read integrity verification key, and then use the read integrity verification key, read data, and physical read address to recalculate and obtain the read memory integrity verification information; so as to facilitate the use of the read memory integrity verification information and the write memory integrity verification information written during the data writing method to verify the integrity of the secure memory space; thereby avoiding the restriction that the secure memory space allocated to the encrypted virtual machine is a physical memory space with continuous addresses due to the usage characteristics of the SIMU when using the SIMU to protect the integrity of the secure memory space of the encrypted virtual machine; that is, by designing the internal structure of the memory controller, the memory controller replaces the SIMU to implement the protection of the integrity of the secure memory space, so that when allocating secure memory space for the encrypted virtual machine, it is no longer subject to the usage restriction that the physical memory space with continuous addresses must be allocated, thereby improving the allocation flexibility of the secure memory space of the encrypted virtual machine.

[0186] In other implementations, when the secure memory space verification fails, an integrity check failure signal may be sent to the security processor to prevent the encrypted virtual machine from running again.

[0187] Please refer to Figure 9 , Figure 9 2 is another flow chart of the data reading method provided by an embodiment of the present invention.

[0188] like Figure 9 Said method may comprise the following steps:

[0189] Step S401: Obtain a data read request from an encrypted virtual machine.

[0190] Step S402: Determine a read integrity verification key corresponding to the encrypted virtual machine based on the address space identifier carried in the data read request.

[0191] Step S403: Determine whether the read integrity verification key is 0. If yes, execute step S404; if not, execute step S405.

[0192] Step S404: Determine that the read memory integrity verification information is 0.

[0193] When the security processor configures the key determination module, the configured integrity verification key value will be 0. Therefore, when the obtained integrity verification key (read integrity verification key) is 0, the calculated read memory integrity verification information is 0.

[0194] Step S405 : determining read memory integrity verification information according to the read data read from the physical read address of the data read request, the read integrity verification key, and the physical read address.

[0195] Step S406, determining whether the read memory integrity verification information is equal to the written memory integrity verification information, if not, executing step S407, if yes, executing step S408.

[0196] Step S407: Send an integrity check failure signal.

[0197] The integrity check failure signal integrity error is used to enable the security processor to set the virtual machine state of the encrypted virtual machine to prevent the encrypted virtual machine from running again.

[0198] After the first comparison module of the memory controller determines that a verification error has occurred, the first comparison module will send an integrity error signal to the security processor. The security processor will set the virtual machine state of the corresponding encrypted virtual machine so that the encrypted virtual machine will detect the encrypted virtual machine state error the next time it executes the VMRUN (virtual machine startup) instruction, exit in time, and set an exit code to indicate that an integrity error has occurred in the encrypted virtual machine, thereby ensuring the overall stability of the system.

[0199] Step S408: Determine whether the integrity verification of the secure memory space of the encrypted virtual machine has passed.

[0200] Please continue to refer to Figure 9 , the method may further include:

[0201] Step S409: Determine read data error correction information based on the read data and the written memory integrity verification information.

[0202] Step S409 may be implemented by the error correction information determination module of the memory controller.

[0203] Step S410 , comparing the read data error correction information and the write data error correction information to see if they are equal, if not, executing step S411 , if yes, executing step S412 .

[0204] The written data error correction information is written based on any of the aforementioned data writing methods.

[0205] Step S411: Send a data read error signal.

[0206] Step S412: Determine whether the read data verification passes.

[0207] Step S410 can be implemented by a second comparison module of the memory controller. The second comparison module receives the read write data error correction information and the re-determined read data error correction information as input and compares the two to determine if they are equal. If they are equal, it indicates that the read data has not been tampered with. If they are not equal, it indicates that the read data has been corrupted. Therefore, a data error signal can be issued to notify the system of a read data error.

[0208] In one embodiment, please refer to Figure 9 ,like Figure 9 As shown, the method may further include:

[0209] Step S413, determining whether the encryption flag carried in the data read request is set, if yes, executing step S414, if not, executing step S415.

[0210] Step S413 may be implemented by a data protection module of the memory controller.

[0211] Step S414 : using the address space identifier carried in the data read request, determining the corresponding data decryption key, and using the read data decrypted by the data decryption key as the read data to be sent.

[0212] Step S415: Send read data.

[0213] The read data obtained from the physical read address in the secure memory space passes through the data protection module. If the C bit is set, the read data is decrypted by the data protection module using the data decryption key corresponding to the ASID in the data write request, and the decrypted read data is ultimately returned. If the C bit is not set, the read data is returned directly without decryption.

[0214] In the above process of executing the data read request, the memory integrity verification information used is called read memory integrity verification information, the data error correction information used is called read data error correction information, and the integrity verification key used is called read integrity verification key.

[0215] An embodiment of the present invention further provides a data writing device as a schematic diagram of an implementation structure of the data writing method described in the above embodiment.

[0216] Please refer to Figure 10 , Figure 10 It is a structural diagram of a data writing device provided by an embodiment of the present invention.

[0217] like Figure 10 As shown, the data writing device may include:

[0218] A data writing request obtaining module 21 is configured to obtain a data writing request of an encrypted virtual machine, wherein the data writing request carries an address space identifier of the encrypted virtual machine;

[0219] A write integrity verification key determination module 22, configured to determine a write integrity verification key corresponding to the encrypted virtual machine based on the address space identifier carried in the data write request;

[0220] a write memory integrity verification information determination module 23, configured to determine write memory integrity verification information based on the write data corresponding to the data write request, the write integrity verification key, and the physical write address of the data write request; the write memory integrity verification information is used to verify the integrity of the secure memory space of the encrypted virtual machine;

[0221] A writing module 24, configured to write at least the write memory integrity verification information and the write data into the physical write address;

[0222] The data write request is a memory access request of the encrypted virtual machine; the memory access request is used to perform a data access operation on the secure memory space corresponding to the encrypted virtual machine, and the secure memory space is an arbitrarily allocated physical memory space.

[0223] It can be seen that the technical solution provided by the embodiment of the present invention, when the memory access request is a data write request, after obtaining the data write request of the encrypted virtual machine, can use the address space identifier carried by the data write request to determine the write integrity verification key, and then use the write integrity verification key, write data, and physical write address to obtain write memory integrity verification information; so as to facilitate the use of the write memory integrity verification information to verify the integrity of the secure memory space; thereby avoiding the restriction that the secure memory space allocated to the encrypted virtual machine is a physical memory space with continuous addresses due to the usage characteristics of the SIMU when using SIMU to protect the integrity of the secure memory space of the encrypted virtual machine; that is, the technical solution provided by the embodiment of the present invention can replace SIMU to achieve protection of the integrity of the secure memory space, so that when allocating secure memory space to the encrypted virtual machine, it is no longer subject to the usage restriction of having to allocate physical memory space with continuous addresses, thereby improving the allocation flexibility of the secure memory space of the encrypted virtual machine.

[0224] An embodiment of the present invention further provides a data reading device as a schematic diagram of an implementation structure of the data reading method described in the aforementioned embodiment.

[0225] Please refer to Figure 11 , Figure 11 It is a structural diagram of a data reading device provided by an embodiment of the present invention.

[0226] like Figure 11 As shown, the data reading device may include:

[0227] A data read request acquisition module 31 is configured to acquire a data read request from an encrypted virtual machine, wherein the data read request carries an address space identifier of the encrypted virtual machine;

[0228] a read integrity verification key determination module 32, configured to determine a read integrity verification key corresponding to the encrypted virtual machine based on the address space identifier carried in the data read request;

[0229] a read memory integrity verification information determination module 33, configured to determine read memory integrity verification information based on the read data read by the physical read address of the data read request, the read integrity verification key, and the physical read address;

[0230] an integrity verification module 34, configured to determine that the integrity verification of the secure memory space of the encrypted virtual machine has passed when it is determined that the read memory integrity verification information is equal to the write memory integrity verification information read based on the physical read address;

[0231] A sending module 35, configured to send read data;

[0232] The written memory integrity verification information and the read data are written based on the data writing device described in the aforementioned embodiment, and the data read request is a memory access request of the encrypted virtual machine described in the data writing device.

[0233] It can be seen that the technical solution provided by the embodiment of the present invention, when the memory access request is a data write request, after obtaining the data write request of the encrypted virtual machine, can use the address space identifier carried by the data write request to determine the write integrity verification key, and then use the write integrity verification key, write data, and physical write address to obtain write memory integrity verification information; so as to facilitate the use of the write memory integrity verification information to verify the integrity of the secure memory space; thereby avoiding the restriction that the secure memory space allocated to the encrypted virtual machine is a physical memory space with continuous addresses due to the usage characteristics of the SIMU when using SIMU to protect the integrity of the secure memory space of the encrypted virtual machine; that is, the technical solution provided by the embodiment of the present invention can replace SIMU to achieve protection of the integrity of the secure memory space, so that when allocating secure memory space to the encrypted virtual machine, it is no longer subject to the usage restriction of having to allocate physical memory space with continuous addresses, thereby improving the allocation flexibility of the secure memory space of the encrypted virtual machine.

[0234] An embodiment of the present invention further provides a computer system, which is based on the memory controller provided by the above embodiment, to improve the flexibility of memory allocation of the encrypted virtual machine while ensuring the integrity of the memory of the encrypted virtual machine.

[0235] Please refer to Figure 12 , Figure 12 It is a structural diagram of a computer system provided by an embodiment of the present invention.

[0236] like Figure 12 As shown, the computer system may include:

[0237] The memory controller 1 according to any one of the preceding embodiments;

[0238] A security processor 2, configured to configure a key determination module of the memory controller 1;

[0239] Memory 3 includes a secure memory space corresponding to the encrypted virtual machine, where the secure memory space is used to store or provide access data of the encrypted virtual machine, and the secure memory space is a physical memory space in the memory that is arbitrarily allocated.

[0240] The security processor 2 is responsible for configuring the key determination module in the memory controller 1 to ensure the security of the integrity verification key.

[0241] The secure memory space used by the encrypted virtual machine is in the ordinary memory 3 and is arbitrarily allocated from the physical memory space of memory 3 by the virtual machine monitor (such as the hypervisor) and is no longer supervised by the SIMU.

[0242] When allocating secure memory space for an encrypted VM, the hypervisor can allocate 4KB small or large pages from the physical memory space of memory 3 as pages for the secure memory space of the encrypted VM while secure processor 2 is creating the NPT page table for the encrypted VM (security processor 2 creates the NPT for the encrypted VM). Therefore, the size of the secure memory space of the encrypted VM is no longer constrained by the SIMU's requirement for continuous physical memory space, allowing for flexible allocation of secure memory space for the encrypted VM.

[0243] In one embodiment, the computer system may further include:

[0244] A secure memory isolation management unit is used to isolate and protect the physical memory space of the virtual machine control block program of the encrypted virtual machine and the physical memory space of the nested page table of the encrypted virtual machine.

[0245] Continue to use the secure memory isolation management unit (SIMU) to isolate and protect the physical memory space occupied by VMCB and NPT of the encrypted virtual machine, so that the physical memory space occupied by VMCB and NPT is inaccessible to the hypervisor and other virtual machines, fully ensuring the security of the physical memory space occupied by VMCB and NPT.

[0246] like Figure 3The structural diagram of the SIMU shown in the figure supervises the complete secure memory space of the encrypted virtual machine in the SIMU. If V in the SPOT table is 1, the memory area indicated by the table entry is the SMR. In the use of the SIMU, in addition to being used to protect the secure memory space of the encrypted virtual machine described in the embodiment of the present invention, the SMR can also be used to protect the physical memory space used by the VMCB and NPT of the encrypted virtual machine (including the physical memory space used by the VMCB and NPT of the virtual machine). The SMR used for this purpose is called SMCR, and the ASID field of the corresponding SPOT table entry is configured with a special value 0x1FE, indicating that the protected memory area is the memory area used by the VMCB and NPT of the encrypted virtual machine.

[0247] Among them, the starting address of SMCR is recorded in the SMCR_START_ADDR register, and the ending address is recorded in the SMCR_END_ADDR register. The security processor can access the SMCR memory using the ASID value of 0x1FE. Ucode (Ucode: user-defined code or user-defined script, which allows users to expand the functions of SIMU according to their own needs) determines whether the virtual machine is an encrypted virtual machine by judging whether the address of the virtual machine's VMCB is in the SMCR. If it is an encrypted virtual machine, Ucode uses ASID 0x1FE to access the VMCB in the SMCR. During the operation of the encrypted virtual machine, the kernel uses the ASID of 0x1FE to access the NPT in the SMCR.

[0248] Therefore, although SIMU is no longer used in the embodiment of the present invention to supervise the complete secure memory space of the encrypted virtual machine, SIMU continues to be used to supervise the physical memory space of the virtual machine control block program of the encrypted virtual machine and the physical memory space of the nested page table of the encrypted virtual machine.

[0249] Please refer to Figure 13 , Figure 13 This is a schematic diagram of the configuration structure of a secure memory isolation management unit provided by an embodiment of the present invention.

[0250] like Figure 13 As shown, SIMU is integrated on the system CS, which can enhance the security of the system.

[0251] The data protection module is an encryption engine, housed within the Unified Memory Controller (UMC). This engine reduces data transmission latency and improves system performance. A CPU chip with an integrated memory controller can directly manage memory, improving data access speed and overall computing efficiency. The unified memory controller enables the memory controller and CPU core to operate at the same frequency, effectively reducing transmission latency.

[0252] It should be noted that Figure 13 The figure shows a computer system using UMC. In this case, the SM4 module can be set in the UMC. If the computer system does not use UMC technology, it can be as follows Figure 1 As shown, the SM4 module is directly set in the memory controller 1.

[0253] Please refer to Figure 14 , Figure 14 It is a schematic diagram of a working process of a computer system provided by an embodiment of the present invention.

[0254] like Figure 14 As shown, when the computer system writes write data into the memory 3 (DRAM), the data write request includes ASID, C bit, physical write address HPA and the initial write data data of the plain text to be written.

[0255] First, the data write request is transmitted to the SM4 engine (data protection module) through the request acquisition module 11. If the C bit is set, the initial write data will first be encrypted by the SM4 engine using the data encryption key corresponding to the ASID in the data write request. If the C bit is not set, the plaintext initial write data is not encrypted. Figure 14 The write data data' output by the SM4 engine shown in includes encrypted data or unencrypted data (ie, plaintext initial write data data).

[0256] Then, according to the ASID in the data write request, the corresponding MACkey (write integrity verification key) is found in the MAC key table (key determination module), and the physical write address HPA and the write data data' output by the SM4 engine and the MAC key are used as the input of the MAC hash (memory integrity verification information determination module) to obtain a MAC (write memory integrity verification information) with a length of n bits.

[0257] Next, the write data data' output by the SM4 engine and the MAC calculated by the MAC hash pass through the ECC controller (error correction information determination module) to calculate the data error correction information ECC (write data error correction information).

[0258] Finally, the memory controller 1 writes the write data data' output by the SM4 engine, the MAC calculated by the MAC hash, and the ECC calculated by the ECC controller to the physical write address HPA in the memory 3.

[0259] Security Processor 2 is responsible for configuring the SM4 encryption engine and MAC key table.

[0260] Please refer to Figure 15 , Figure 15 This is another schematic diagram of the working process of the computer system provided by an embodiment of the present invention.

[0261] like Figure 15 As shown, when the computer system reads data from the memory 3, the data read request includes ASID, Cbit, and physical read address HPA.

[0262] First, the memory controller 1 reads the read data data' at the physical read address HPA from the memory 3 (data' is the write data encrypted or unencrypted based on the initial write data data during the write process).

[0263] Then, using the ASID in the data read request as an index, the corresponding MAC key (read integrity verification key) is searched in the MAC key table (key determination module). The read integrity verification key MAC key, physical read address HPA, and data' are used as inputs to the MAC hash (memory integrity verification information determination module) to calculate a MAC' (read memory integrity verification information) with a length of n bits. A first comparison module 16 compares the calculated MAC' with the MAC read from memory 3 (write memory integrity verification information). If the two are not equal, an integrity error signal is sent to the security processor 2.

[0264] Next, the read data data' and MAC (write memory integrity verification information) read from the memory 3 are used as inputs of the error correction information determination module 14 (ECC controller), and the ECC' (read data error correction information) is recalculated by the error correction information determination module 14; and the second comparison module 17 is used to compare the ECC (write data error correction information) read from the memory 3 with the calculated ECC'. If the two are not equal, an ECC error signal is sent to the kernel (x86 core) to trigger an MCA (Machine Check Architecture) exception, that is, it is determined that the read data verification has failed and a read data error signal is issued.

[0265] Finally, the read data data' obtained from memory 3 passes through the SM4 engine. If the C bit of the data read request is set, the SM4 engine decrypts the read data data' using the data decryption key corresponding to the ASID in the data read request and returns the decrypted read data data. If the C bit is not set, the read data data (data' in this case) is returned directly without decryption.

[0266] The above describes multiple embodiment schemes provided by the embodiments of the present invention. The various optional methods introduced in each embodiment scheme can be combined and cross-referenced with each other without conflict, thereby extending a variety of possible embodiment schemes, which can all be considered as embodiment schemes disclosed and open in the embodiments of the present invention.

[0267] Although the embodiments of the present invention are disclosed above, the present invention is not limited thereto. Any person skilled in the art can make various changes and modifications without departing from the spirit and scope of the present invention. Therefore, the scope of protection of the present invention should be based on the scope defined by the claims.

Claims

1. A memory controller, characterized in that: include: a request acquisition module, configured to acquire a memory access request of an encrypted virtual machine, wherein the memory access request is used to perform a data access operation on a secure memory space corresponding to the encrypted virtual machine, wherein the secure memory space is an arbitrarily allocated physical memory space; and the memory access request carries an address space identifier of the encrypted virtual machine; a key determination module, configured to determine an integrity verification key corresponding to the encrypted virtual machine according to the address space identifier, the key determination module being configured by a security processor; A memory integrity verification information determination module is used to determine memory integrity verification information based on the physical access address of the memory access request, the access data and the integrity verification key determined by the key determination module; the memory integrity verification information is used to verify the integrity of the secure memory space.

2. The memory controller according to claim 1, wherein: Also includes: an error correction information determination module, configured to calculate data error correction information based on the access data and the memory integrity verification information; The data error correction information is stored in a data error correction information storage space in a secure memory space, and the idle bits of the data error correction information storage space are used to store the memory integrity verification information.

3. The memory controller according to claim 2, wherein: Also includes: a data protection module, configured to determine whether to encrypt the write data of the data write request based on an encryption identification bit carried by the data write request when the memory access request is a data write request; Or, when the memory access request is a data read request, it is determined whether to decrypt the read data read from the secure memory space based on the encryption identification bit carried by the data read request.

4. The memory controller according to claim 3, wherein: The access data is encrypted or unencrypted write data output by the data protection module, or the access data is read data read from the secure memory space.

5. The memory controller according to claim 4, wherein: Also includes: a first comparing module, configured to compare whether the memory integrity verification information read from the secure memory space and the re-determined memory integrity verification information are identical; If yes, confirming that the integrity verification of the secure memory space of the encrypted virtual machine has passed; if not, issuing an integrity verification failure signal; the re-determined memory integrity verification information is determined based on the integrity verification key determined by the key determination module, the access data read from the secure memory space, and the physical access address; The integrity check failure signal is used to enable the security processor to set the virtual machine state of the encrypted virtual machine to prevent the encrypted virtual machine from running again.

6. The memory controller according to claim 5, wherein: Also includes: a second comparing module, configured to compare the data error correction information read from the secure memory space with the re-determined data error correction information to determine whether they are the same; If yes, confirm that the data verification is passed; if not, send a data error signal; the re-determined data error correction information is determined based on the access data and memory integrity verification information read from the secure memory space.

7. A data writing method, characterized in that: The memory controller according to any one of claims 1 to 6 comprises: Get the data write request of the encrypted virtual machine; Determining a write integrity verification key corresponding to the encrypted virtual machine based on the address space identifier carried in the data write request; Determining write memory integrity verification information based on the write data corresponding to the data write request, the write integrity verification key, and the physical write address of the data write request; the write memory integrity verification information is used to verify the integrity of the secure memory space of the encrypted virtual machine; At least the write memory integrity verification information and the write data are written into the physical write address.

8. The data writing method according to claim 7, wherein: Before the step of determining the write memory integrity verification information according to the write data corresponding to the data write request, the write integrity verification key, and the physical write address of the data write request, the step further includes: Determining whether the encryption flag carried in the data write request is set; If yes, determining a data encryption key corresponding to the encrypted virtual machine using the address space identifier, and encrypting the initial write data of the data write request using the data encryption key, so as to use the encrypted initial write data as the write data; If not, the initial write data of the data write request is not encrypted, so as to use the initial write data as the write data.

9. The data writing method according to claim 8, wherein: Also includes: Determining write data error correction information based on the write memory integrity verification information and the write data; The step of writing at least the write memory integrity verification information and the write data into the physical write address includes: Writing the written memory integrity verification information, the write data, and the write data error correction information into the physical write address; The written data error correction information is stored in a data error correction information storage space in the secure memory space, and the idle bits of the data error correction information storage space are used to store the written memory integrity verification information.

10. The data writing method according to claim 9, wherein: Before the step of obtaining the data writing request of the encrypted virtual machine, the method further includes: An initialization signal is sent to initialize a memory integrity verification information determination module of the memory controller.

11. A data reading method, characterized in that: include: Get the data read request of the encrypted virtual machine; Determining a read integrity verification key corresponding to the encrypted virtual machine based on the address space identifier carried in the data read request; Determining read memory integrity verification information based on read data read from the physical read address of the data read request, the read integrity verification key, and the physical read address; When it is determined that the read memory integrity verification information is equal to the write memory integrity verification information read based on the physical read address, determining that the integrity verification of the secure memory space of the encrypted virtual machine has passed; Send read data; The memory integrity verification information is written based on the data writing method described in any one of claims 7 to 10, and the read data is written based on the data writing method described in any one of claims 7 to 10.

12. The data reading method according to claim 11, wherein: The method further comprises: When it is determined that the read memory integrity verification information is not equal to the write memory integrity verification information, an integrity check failure signal is issued; The integrity check failure signal is used to enable the security processor to set the virtual machine state of the encrypted virtual machine to prevent the encrypted virtual machine from running again.

13. The data reading method according to claim 11, wherein: Also includes: Determining read data error correction information based on the read data and the written memory integrity verification information; comparing whether the read data error correction information and the write data error correction information are equal; If yes, determining that the read data verification passes; If not, a read data error signal is issued; The written data error correction information is written based on the data writing method.

14. The data reading method according to claim 13, wherein: After the step of determining that the read data verification is passed and before the step of sending the read data, the method further includes: Determine whether the encryption flag carried in the data read request is set, If yes, determine the corresponding data decryption key using the address space identifier carried in the data read request, and use the read data decrypted using the data decryption key as the read data to be sent; If not, the step of sending the read data is performed.

15. A data writing device, characterized in that: include: A data writing request obtaining module, configured to obtain a data writing request of an encrypted virtual machine, wherein the data writing request carries an address space identifier of the encrypted virtual machine; A write integrity verification key determination module, configured to determine a write integrity verification key corresponding to the encrypted virtual machine based on the address space identifier carried in the data write request; a write memory integrity verification information determination module, configured to determine write memory integrity verification information based on the write data corresponding to the data write request, the write integrity verification key, and the physical write address of the data write request; The written memory integrity verification information is used to verify the integrity of the secure memory space of the encrypted virtual machine; A writing module, configured to write at least the write memory integrity verification information and the write data into the physical write address; Wherein, the data write request is a memory access request of the encrypted virtual machine; The memory access request is used to perform a data access operation on the secure memory space corresponding to the encrypted virtual machine, where the secure memory space is an arbitrarily allocated physical memory space.

16. A data reading device, characterized in that: include: A data read request acquisition module, configured to acquire a data read request from an encrypted virtual machine, wherein the data read request carries an address space identifier of the encrypted virtual machine; a read integrity verification key determination module, configured to determine a read integrity verification key corresponding to the encrypted virtual machine based on the address space identifier carried in the data read request; a read memory integrity verification information determination module, configured to determine read memory integrity verification information based on read data read from a physical read address of the data read request, the read integrity verification key, and the physical read address; an integrity verification module, configured to determine that the integrity verification of the secure memory space of the encrypted virtual machine has passed when it is determined that the read memory integrity verification information is equal to the write memory integrity verification information read based on the physical read address; Sending module, used to send read data; The written memory integrity verification information and the read data are written based on the data writing device according to claim 15, and the data read request is a memory access request of the encrypted virtual machine described in the data writing device.

17. A computer system, characterized in that: include: The memory controller according to any one of claims 1 to 6; a security processor, configured to configure a key determination module of the memory controller; The memory includes a secure memory space corresponding to the encrypted virtual machine, where the secure memory space is used to store or provide access data of the encrypted virtual machine, and the secure memory space is a physical memory space in the memory that is arbitrarily allocated.

18. The computer system of claim 17, wherein: Also includes: A secure memory isolation management unit is used to isolate and protect the physical memory space of the virtual machine control block program of the encrypted virtual machine and the physical memory space of the nested page table of the encrypted virtual machine.

Images