Separated computing system and method
By introducing a fabric manager in a separate computing system, the manager is responsible for communicating with multiple hosts and memory pools, turning on and off the data path between the host and memory pool, and after the data path is closed, through the memory controller and encryption engine Configuring memory pools to protect host data solves the complex problems of data security and management in the existing technology, and implements an efficient and flexible data protection solution.
Patent Information
- Application Number
- CN202380019314.3
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2023-05-30
- Publication Date
- 2025-02-14
AI Technical Summary
Existing separate computing systems need to rely on specific CPU and host configurations when ensuring data security, and the burden and responsibility for data protection lies with users rather than with data center owners, resulting in complex management and degradation in performance.
By introducing a fabric manager in a separate computing system, the manager is responsible for communicating with multiple hosts and memory pools, turning on and off the data path between the host and memory pool, and after the data path is closed, through the memory controller and encryption engine Configure the memory pool to protect host data.
It realizes efficient protection of each user's data without relying on a specific CPU and increasing the management burden of the host, simplifying the management process of the data center, and improving the flexibility and performance of the system.
Smart Images
Figure CN119452349A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to a split computing system, a method for a split computing system and a computer program product for executing the method. Background Art
[0002] Existing computing architectures include computing nodes with local memory. Only a single host can access the memory located next to the central processing unit (CPU) in the same chassis.
[0003] The split architecture enables the use of memory pools outside the host chassis. Because the memory is on a separate power domain, the data in the memory remains intact when the host loses power or loses connection to the memory. In these systems, the host's connection to the memory is controlled by the fabric manager, which has access to the host and the memory pool, and can also connect the host to the memory.
[0004] Fig.16 The working principle of the traditional separation architecture is schematically described. Fig.16 In (a), the host (e.g., host A) can write data to the memory module. After the host writes the data, no host is connected to the memory module, e.g. Fig.16 (b) Unlike traditional architectures that rely on local CPU power, the memory in a split system can be connected to a separate power system, so the data in the memory will not be deleted.
[0005] Then, the fabric manager can connect another host, such as host B, to the memory module, such as Fig.16 (c) At this time, host B can read the data written by host A, resulting in the data security cannot be guaranteed.
[0006] In the Hard Disk Drive (HDD) / Solid State Drive (SSD) domain, traditional solutions address data security issues by using self-encrypting drive (SED) functionality on the computing device itself. The host changes the key on the drive so that data is encrypted without the key. The memory encryption function is also controlled by the host connected to the memory module.
[0007] However, in Fig.17These schemes schematically described in require a CPU that supports memory safety features. In addition, they require the host user to turn on and configure the memory safety features in the CPU (if available). In addition, traditional schemes may experience performance degradation when using the memory safety features in the CPU. In addition, in existing schemes, the burden and responsibility of data protection lies on the user rather than the data center owner. Summary of the invention
[0008] In view of the above, the present invention aims to improve the traditional scheme for separate computing systems. The purpose is to enable the memory pool to protect the data of each user (host) in an efficient and simple manner, thereby providing a secure service without adding additional requirements and management burdens to users and hosts.
[0009] This object and others are achieved by the solutions of the invention as described in the independent claims. Advantageous implementations are further defined in the dependent claims.
[0010] According to a first aspect, a separate computing system is provided. The separate computing system includes a fabric manager for communicating with multiple hosts and a memory pool of the system, wherein the memory pool includes a memory controller and one or more memory devices, and the one or more memory devices are used to store data of the host. The fabric manager is also used to open a data path between any host and at least one memory device of the memory pool, and after the host writes data to the at least one memory device, close the data path between the host and the at least one memory device of the memory pool. The memory controller is used to configure the memory pool to protect the data of the host in the at least one memory device after closing the data path between the host and the at least one memory device of the memory pool.
[0011] This has the advantage of ensuring that a rack or data center providing memory pool services does not need to rely on the host to protect data in one or more memory devices.
[0012] Furthermore, the discrete computing system can use any CPU and is not tied to products that provide specific memory safety features.
[0013] The memory pool can be implemented in a separate module located outside the host chassis. In addition, the memory pool can be common to all hosts.
[0014] In an implementation manner of the first aspect, the fabric manager is further used to control the memory pool to allocate memory space for the host in the at least one memory device.
[0015] The fabric manager may be a software-hardware combined system for allocating resources of the public memory pool and capable of connecting any host to the memory pool.
[0016] In an implementation of the first aspect, after the host writes data in the at least one memory device, after closing the data path between the host and the at least one memory device of the memory pool, the fabric manager is also used to open a local data path between the memory controller and the at least one memory device of the memory pool.
[0017] This protects your data without adding additional requirements and management burdens to users and hosts.
[0018] In an implementation of the first aspect, protecting the data of the host in the at least one memory device includes clearing the memory space allocated in the at least one memory device of the memory pool for the host.
[0019] When switching memory resources between different hosts, after detaching a host from a memory device of a memory pool and before connecting another host to the memory device, host data stored on the memory device may be cleaned up, thereby preventing the host data from being subsequently accessed by any other host.
[0020] In an implementation of the first aspect, cleaning up the memory space allocated to the host in the at least one memory device of the memory pool includes erasing the memory space allocated to the host in the at least one memory device of the memory pool, or overwriting the memory space of the host in the at least one memory device of the memory pool with random data.
[0021] The advantage of this is that different methods can be used to protect the host data, improving the efficiency and flexibility of the device.
[0022] In an implementation of the first aspect, the separate computing system further comprises a fabric grid, the fabric grid being used to communicate with the fabric manager, the plurality of hosts, and the memory pool. The fabric grid is further used to open the data path between the host and the at least one memory device of the memory pool through the fabric grid, and to close the data path between the host and the at least one memory device of the memory pool through the fabric grid.
[0023] That is, the connection from the host to at least one memory device of the memory pool may be provided by a fabric mesh. The fabric mesh may include one or more physical implementations.
[0024] In an implementation of the first aspect, the memory controller includes a memory host device, and after the host writes data in the at least one memory device, after closing the data path between the host and the at least one memory device of the memory pool, the fabric manager is further used to open the data path between the memory host device and the at least one memory device through the fabric grid.
[0025] Therefore, the fabric mesh may also enable the memory host device to connect to at least one memory device within the memory pool.
[0026] In an implementation of the first aspect, the memory controller includes a reset module host, and after the host writes data in the at least one memory device, after closing the data path between the host and the at least one memory device of the memory pool, the fabric manager is further used to open the data path between the reset module host and the at least one memory device through the fabric grid.
[0027] Therefore, the fabric mesh may also provide a connection from the reset module host to at least one memory device within the memory pool.
[0028] In an implementation of the first aspect, after the data path between the host and the at least one memory device of the memory pool is closed, protecting the data of the host in the at least one memory device includes performing a low-level reset on the at least one memory device of the memory pool.
[0029] This provides another way to protect host data, further improving the efficiency and flexibility of the device.
[0030] In an implementation of the first aspect, the fabric manager is further configured to generate an encryption key and send the encryption key to the memory controller, and to change the encryption key after the host writes data to the at least one memory device and before the data path between the host and the at least one memory device of the memory pool is closed. The memory pool also includes an encryption engine for communicating with the memory controller and with the one or more memory devices. In addition, the memory controller is further configured to protect the data of the host in the at least one memory device through the encryption engine after the data path between the host and the at least one memory device of the memory pool is closed.
[0031] This provides the advantage of ensuring data protection without requiring the host to enable, configure and manage encryption on its own data, thereby increasing flexibility and efficiency. Furthermore, this applies to all CPUs.
[0032] In an implementation of the first aspect, the fabric manager is further used to open the data path between the host and at least one memory device of the memory pool through the encryption engine, and to close the data path between the host and at least one memory device of the memory pool through the encryption engine.
[0033] In an implementation of the first aspect, after the data path between the host and the at least one memory device of the memory pool is closed, the data of the host in the at least one memory device is protected by the encryption engine, including: the memory controller controls the encryption engine to encrypt the data of the host using the encryption key sent by the fabric manager; and provides the encrypted data of the host to the at least one memory device.
[0034] This provides another way to protect the host's data by encrypting the host's data "on the fly" in the memory pool through the encryption engine. It should be noted that the generated encryption key is unique to each host, further enhancing data protection.
[0035] In an implementation of the first aspect, the at least one memory device is also used to store the encrypted data of the host.
[0036] According to a second aspect, a method for a separate computing system is provided. The separate computing system includes a fabric manager for communicating with multiple hosts and a memory pool of the system, the memory pool includes a memory controller and one or more memory devices, and the one or more memory devices are used to store data of the host. The method includes: the fabric manager opens a data path between any host and at least one memory device of the memory pool; after the host writes data to the at least one memory device, the fabric manager closes the data path between the host and the at least one memory device of the memory pool; the memory controller configures the memory pool to protect the data of the host in the at least one memory device after the data path between the host and the at least one memory device of the memory pool is closed.
[0037] This has the advantage of ensuring that a rack or data center providing memory pool services does not need to rely on the host to protect data in one or more memory devices.
[0038] Furthermore, the discrete computing system can use any CPU and is not tied to products that provide specific memory safety features.
[0039] In an implementation manner of the second aspect, the method further includes: the fabric manager controlling the memory pool to allocate memory space to the host in the at least one memory device.
[0040] The fabric manager may be a software-hardware combined system for allocating resources of the public memory pool and capable of connecting any host to the memory pool.
[0041] In an implementation of the second aspect, after the host writes data in the at least one memory device, after closing the data path between the host and the at least one memory device of the memory pool, the method further includes: the fabric manager opening a local data path between the memory controller and the at least one memory device of the memory pool.
[0042] This protects your data without adding additional requirements and management burdens to users and hosts.
[0043] In an implementation of the second aspect, protecting the data of the host in the at least one memory device includes clearing the memory space allocated in the at least one memory device of the memory pool for the host.
[0044] When switching memory resources between different hosts, after detaching a host from a memory device of a memory pool and before connecting another host to the memory device, host data stored on the memory device may be cleaned up, thereby preventing the host data from being subsequently accessed by any other host.
[0045] In an implementation of the second aspect, cleaning up the memory space allocated to the host in the at least one memory device of the memory pool includes erasing the memory space allocated to the host in the at least one memory device of the memory pool, or overwriting the memory space of the host in the at least one memory device of the memory pool with random data.
[0046] The advantage of doing this is that different methods can be used to protect the host data, which improves efficiency and flexibility.
[0047] In an implementation of the second aspect, the method further includes: opening the data path between the host and the at least one memory device of the memory pool through a fabric grid, the fabric grid being used to communicate with the fabric manager, the multiple hosts and the memory pool; and closing the data path between the host and the at least one memory device of the memory pool through the fabric grid.
[0048] That is, the connection from the host to at least one memory device of the memory pool may be provided by a fabric mesh. The fabric mesh may include one or more physical implementations.
[0049] In an implementation of the second aspect, the memory controller includes a memory host device, and after the host writes data in the at least one memory device, after closing the data path between the host and at least one memory device of the memory pool, the method further includes: the fabric manager opening the data path between the memory host device and the at least one memory device through the fabric grid.
[0050] Therefore, the fabric mesh may also enable the memory host device to connect to at least one memory device within the memory pool.
[0051] In an implementation of the second aspect, the memory controller includes a reset module host, and after the host writes data in the at least one memory device, after closing the data path between the host and the at least one memory device of the memory pool, the method further includes: the fabric manager opening the data path between the reset module host and the at least one memory device through the fabric grid.
[0052] Therefore, the fabric mesh may also provide a connection from the reset module host to at least one memory device within the memory pool.
[0053] In an implementation of the second aspect, after the data path between the host and the at least one memory device of the memory pool is closed, protecting the data of the host in the at least one memory device includes performing a low-level reset on the at least one memory device of the memory pool.
[0054] This provides another way to protect host data, further improving the efficiency and flexibility of the device.
[0055] In an implementation of the second aspect, the method also includes: the fabric manager generates an encryption key; the fabric manager sends the encryption key to the memory controller; after the host writes data to the at least one memory device, before closing the data path between the host and the at least one memory device of the memory pool, the fabric manager changes the encryption key; after the data path between the host and the at least one memory device of the memory pool is closed, the memory controller protects the data of the host in the at least one memory device; and uses an encryption engine to communicate with the memory controller and the one or more memory devices.
[0056] This provides the advantage of ensuring data protection without requiring the host to enable, configure and manage encryption on its own data, thereby increasing flexibility and efficiency. Furthermore, this applies to all CPUs.
[0057] In an implementation of the second aspect, the method also includes: the fabric manager opening the data path between the host and the at least one memory device of the memory pool through the encryption engine; and the fabric manager closing the data path between the host and the at least one memory device of the memory pool through the encryption engine.
[0058] In an implementation of the second aspect, after the data path between the host and the at least one memory device of the memory pool is closed, the data of the host in the at least one memory device is protected by the encryption engine, including: the memory controller controls the encryption engine to encrypt the data of the host using the encryption key sent by the fabric manager; and provides the encrypted data of the host to the at least one memory device.
[0059] This provides another way to protect the host's data by encrypting the host's data "on the fly" in the memory pool through the encryption engine. It should be noted that the generated encryption key is unique to each host, further enhancing data protection.
[0060] In an implementation manner of the second aspect, the at least one memory device is also used to store the encrypted data of the host.
[0061] The method according to the second aspect comprises the features of the corresponding implementation of the device according to the first aspect.
[0062] According to a third aspect, there is provided a computer program product comprising program code for executing the method according to the second aspect and its implementation when implemented on a processor.
[0063] The computer program product according to the third aspect comprises the features of the corresponding implementation of the method according to the second aspect.
[0064] The method according to the second aspect and the computer program product according to the third aspect and the implementation thereof provide the same advantages and effects as the above-mentioned device according to the first aspect and the corresponding implementation thereof.
[0065] The solution according to the present invention solves the security problem from the perspective of the memory pool and can provide one or more of the following advantages:
[0066] The solution is applicable to all CPUs;
[0067] The method has negligible impact on performance;
[0068] The solution does not require the host to enable, configure and manage advanced security features;
[0069] Datacenter owners can guarantee memory isolation without any requirement from the host and its users.
[0070] It should be noted that all devices, elements, units and devices described in this application can be implemented in software or hardware elements or any type of combination thereof. All steps performed by various entities described in this application and the functions to be performed by various entities described are intended to refer to the corresponding entities for performing the corresponding steps and functions. Although in the description of the following specific embodiments, the specific functions or steps to be performed by the external entity are not reflected in the description of the specific detailed elements of the entity performing the specific steps or functions, it should be clear to the technician that these methods and functions can be implemented by corresponding hardware or software elements or any combination thereof. BRIEF DESCRIPTION OF THE DRAWINGS
[0071] In conjunction with the accompanying drawings, the following description of specific embodiments will illustrate the above aspects and their implementation methods. In the drawings:
[0072] Figure 1 A split computing system according to the present invention is schematically described;
[0073] Figure 2 A split computing system according to the present invention is schematically described;
[0074] Figure 3 A split computing system according to the present invention is schematically described;
[0075] Figure 4 A split computing system according to the present invention is schematically described;
[0076] Figure 5A split computing system according to the present invention is schematically described;
[0077] Figure 6 A split computing system according to the present invention is schematically described;
[0078] Figure 7 A split computing system according to the present invention is schematically described;
[0079] Figure 8 A split computing system according to the present invention is schematically described;
[0080] Fig. 9 A fabric manager according to the present invention is schematically described;
[0081] Fig.10 Shows Figure 2 An example of a split computing system as shown in;
[0082] Fig.11 Shows Figure 3 An example of a split computing system as shown in;
[0083] Fig.12 Shows Figure 5 An example of a split computing system as shown in;
[0084] FIG. 13A to FIG. 13B Shows Figure 8 An example of a split computing system as shown in;
[0085] Fig.14 An example of an implementation of a split computing system according to the present invention is shown;
[0086] Fig.15 A method for a split computing system according to the present invention is shown;
[0087] Fig.16 A conventional split computing system is schematically described;
[0088] Fig.17 A conventional split computing system is schematically depicted. DETAILED DESCRIPTION
[0089] Figure 1 An exemplary embodiment of a split computing system 100 according to the present invention is shown.
[0090] The split computing system 100 includes a fabric manager 110 , a plurality of hosts 120 , and a memory pool 130 .
[0091] The fabric manager 110 is used to communicate with a plurality of hosts 120 and a memory pool 130 .
[0092] The memory pool 130 includes a memory controller 131 and one or more memory devices 132. Each of the one or more memory devices 132 is used to store data of the host 120.
[0093] One or more memory devices 132 may be implemented in a memory module, or may be part of a memory module.
[0094] The memory pool may be a separate module located outside the chassis of one or more hosts in the plurality of hosts 120 .
[0095] The fabric manager 110 is further configured to open a data path 121 between any host 120 and at least one memory device 132 of the memory pool 130. In addition, after the host 120 writes data to the at least one memory device 132, the fabric manager 110 is configured to close the data path 121 between the host 120 and the at least one memory device 132 of the memory pool 130.
[0096] The fabric manager 110 may be a software and hardware combined system for allocating resources of the memory pool 130 and may also support connection with each host 120 .
[0097] The memory controller 131 is used to configure the memory pool 130 to protect the data of the host 120 in the at least one memory device 132 after the data path 121 between the host 120 and at least one memory device 132 of the memory pool 130 is closed.
[0098] The fabric manager 110 is further configured to control the memory pool 130 to allocate memory space in at least one memory device 132 for the host 120. Therefore, the host 120 can write data into the at least one memory device 132.
[0099] After the host 120 writes data to at least one memory device 132, and after the data path 121 between the host 120 and at least one memory device 132 of the memory pool 130 is closed, the fabric manager 110 is also used to open a local data path 133 between the memory controller 131 and at least one memory device 132 of the memory pool 130.
[0100] In other words, the fabric manager 110 may enable the memory controller 131 to obtain ownership of at least one memory device 132 of the memory pool 130 .
[0101] The memory controller 131 may use the local data path 133 to protect data of the host 120 in at least one memory device 132 of the memory pool 130 .
[0102] The memory controller protects data of the host 120 in at least one memory device 132 , including cleaning up memory space allocated to the host 120 in at least one memory device 132 of the memory pool 130 .
[0103] The memory controller may clean up the memory space allocated to the host 120 in at least one memory device 132 of the memory pool 130 through the local data path 133 .
[0104] Cleaning the memory space allocated to the host 120 in the at least one memory device 132 of the memory pool 130 includes erasing the memory space allocated to the host 120 in the at least one memory device 132 of the memory pool 130 .
[0105] Alternatively, cleaning the memory space allocated to the host 120 in the at least one memory device 132 of the memory pool 130 includes overwriting the memory space of the host 120 in the at least one memory device 132 of the memory pool 130 with random data. The random data may be generated by the memory controller 131.
[0106] The separate computing system 100 according to the present invention may include a processor or processing circuit (not shown) for executing, implementing or starting various operations of the separate computing system 100 described herein. The processing circuit may include hardware and / or the processing circuit may be controlled by software. The hardware may include analog circuits or digital circuits, or both analog circuits and digital circuits. The digital circuit may include components such as an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), a digital signal processor (DSP) or a multi-purpose processor. The separate computing system 100 may also include a memory circuit for storing one or more instructions that can be executed by the processor or processing circuit (specifically, executed under the control of software). For example, the memory circuit may include a non-transitory storage medium storing executable software code, which, when executed by the processor or processing circuit, enables the separate computing system 100 to perform various operations. The processing circuit may include one or more processors and a non-transitory memory connected to one or more processors. The non-transitory memory may carry executable program code that, when executed by one or more processors, causes the split computing system 100 to perform, implement, or initiate the operations or methods described herein.
[0107] Figure 2 An exemplary embodiment of a split computing system 100 according to the present invention is shown. Figure 1The split computing system 100 shown in FIG. Like elements are labeled with like reference symbols.
[0108] The above detailed description can be applied to Figure 2 The split computing system 100 is similar to the split computing system 100 of FIG. 1 , except for the significant differences noted below.
[0109] exist Figure 2 In the embodiment of the present invention, the split computing system 100 further includes a fabric grid 240. The fabric grid 240 is used to communicate with the fabric manager 110, the plurality of hosts 120, and the memory pool 130.
[0110] In addition, the fabric grid 240 is used to open the data path 121 between the host 120 and at least one memory device 132 of the memory pool 130. In addition, the fabric grid 240 is used to close the data path 121 between the host 120 and at least one memory device 132 of the memory pool 130.
[0111] That is to say, Figure 2 In the split computing system 100 of the embodiment, the fabric manager 100 may be configured to enable a data path 121 between a host 120 and at least one memory device 132 through a fabric grid 240 .
[0112] Thus, in this exemplary embodiment, the connection of the host 120 to the at least one memory device 132 may be implemented via the fabric grid 240, wherein the fabric grid 240 may include one or more physical implementations.
[0113] Then, after the host 120 writes data to the at least one memory device 132 , the fabric manager 100 may be configured to close the data path 121 between the host 120 and the at least one memory device 132 through the fabric grid 240 .
[0114] The fabric grid 240 according to the present invention may include a processor or processing circuit (not shown) for performing, implementing or initiating various operations of the fabric grid 240 described herein. The processing circuit may include hardware and / or the processing circuit may be controlled by software. The hardware may include analog circuits or digital circuits, or both analog circuits and digital circuits. The digital circuit may include components such as an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), a digital signal processor (DSP) or a multi-purpose processor. The fabric grid 240 may also include a memory circuit for storing one or more instructions that can be executed by the processor or processing circuit (specifically, executed under the control of software). For example, the memory circuit may include a non-transitory storage medium storing executable software code that, when executed by the processor or processing circuit, causes the fabric grid 240 to perform various operations. The processing circuit may include one or more processors and a non-transitory memory connected to the one or more processors. The non-transitory memory may store executable program code that, when executed by one or more processors, causes the fabric grid 240 to perform, implement, or initiate the operations or methods described herein.
[0115] Figure 3 An exemplary embodiment of a split computing system 100 according to the present invention is shown. Figure 2 The split computing system 100 shown in FIG. Like elements are labeled with like reference symbols.
[0116] The above detailed description can be applied to Figure 3 1. The split computing system 100 of FIG. 1 is similar to the split computing system 100 of FIG. 1, except for the significant differences mentioned below. In the exemplary embodiment, the memory controller 131 includes a memory host device 331.
[0117] The fabric manager 110 opens a local data path 133 between the memory controller 131 and at least one memory device 132 of the memory pool 130 , including: the fabric manager 110 opens a data path 333 between a memory host device 331 and at least one memory device 132 through the fabric grid 240 .
[0118] The memory host device 331 may use the data path 333 to protect data of the host 120 in at least one memory device 132 of the memory pool 130 .
[0119] The memory controller protects data of the host 120 in at least one memory device 132 , including cleaning up memory space allocated to the host 120 in at least one memory device 132 of the memory pool 130 .
[0120] The memory host device 331 can be used to configure the memory pool 130 to protect the data of the host 120 in at least one memory device 132 by clearing the memory space allocated to the host 120 in at least one memory device 132 after the data path 121 between the host 120 and at least one memory device 132 of the memory pool 130 is closed.
[0121] The memory host device 331 may be used to clean up the memory space allocated to the host 120 in at least one memory device 132 of the memory pool 130 through the data path 333 .
[0122] Cleaning the memory space allocated to the host 120 in the at least one memory device 132 of the memory pool 130 includes erasing the memory space allocated to the host 120 in the at least one memory device 132 of the memory pool 130 .
[0123] Alternatively, cleaning the memory space allocated to the host 120 in the at least one memory device 132 of the memory pool 130 includes overwriting the memory space of the host 120 in the at least one memory device 132 of the memory pool 130 with random data. The random data may be generated by the memory host device 331.
[0124] Figure 4 An exemplary embodiment of a split computing system 100 according to the present invention is shown. Figure 1 The split computing system 100 shown in FIG. Like elements are labeled with like reference symbols.
[0125] Above Figure 1 The detailed description in this section can be applied to Figure 4 1. The memory controller 131 of the present invention is similar to the split computing system 100 of FIG. 1, except for the significant differences mentioned below. In this exemplary embodiment, the memory controller 131 includes a reset module host 431.
[0126] The fabric manager 110 opens a local data path 133 between the memory controller 131 and at least one memory device 132 of the memory pool 130 , including: the fabric manager 110 opens a data path 433 between the reset module host 431 and at least one memory device 132 of the memory pool 130 .
[0127] In addition, after the data path 121 between the host 120 and at least one memory device 132 of the memory pool 130 is closed, protecting the data of the host 120 in the at least one memory device 132 includes performing a low-level reset on the at least one memory device 132 of the memory pool 130 by the reset module host 431 .
[0128] The reset module host 431 may be used to perform a low level reset on at least one memory device 132 of the memory pool 130 via a data path 433 .
[0129] In this exemplary embodiment, the one or more memory devices 132 may also be used to support a low level reset performed by the reset module host 431 .
[0130] Figure 5 An exemplary embodiment of a split computing system 100 according to the present invention is shown. Figure 4 The split computing system 100 shown in FIG. Like elements are labeled with like reference symbols.
[0131] The above detailed description can be applied to Figure 5 The separate computing system 100 is similar to the separate computing system 100 of FIG. 1 , except for the significant differences mentioned below. In this embodiment, the separate computing system 100 also includes a fabric grid 240 .
[0132] The fabric manager 100 may be used to open a data path 121 between the host 120 and at least one memory device 132 through the fabric grid 240 , and to close a data path 121 between the host 120 and at least one memory device 132 through the fabric grid 240 .
[0133] That is, the fabric grid 240 is used to open the data path 121 between the host 120 and at least one memory device 132 of the memory pool 130 through the fabric grid 240. In addition, the fabric grid 240 is used to close the data path 121 between the host 120 and at least one memory device 132 of the memory pool 130.
[0134] Thus, in this exemplary embodiment, the connection of the host 120 to the at least one memory device 132 may be implemented via the fabric grid 240, wherein the fabric grid 240 may include one or more physical implementations.
[0135] In addition, after the data path 121 between the host 120 and at least one memory device 132 of the memory pool 130 is closed, protecting the data of the host 120 in the at least one memory device 132 includes performing a low-level reset on the at least one memory device 132 of the memory pool 130 by the reset module host 431 .
[0136] The reset module host 431 can be used to perform a low level reset on at least one memory device 132 of the memory pool 130 through the data path 433, as described above. Figure 4 The details are disclosed in the embodiments of the present invention. The details are not repeated here.
[0137] In this exemplary embodiment, the one or more memory devices 132 may also be used to support a low level reset performed by the reset module host 431 .
[0138] Figure 6 An exemplary embodiment of a split computing system 100 according to the present invention is shown. Figure 5 The split computing system 100 shown in FIG. Like elements are labeled with like reference symbols.
[0139] The above detailed description can be applied to Figure 6 In the exemplary embodiment, the fabric manager 110 opens a local data path 133 between the memory controller 131 and at least one memory device 132 of the memory pool 130, including opening a data path 633 between the reset module host 431 and at least one memory device 132 of the memory pool 130 through the fabric grid 240.
[0140] Therefore, in this embodiment, the fabric grid 240 can connect the host 120 to at least one memory device 132 and connect the reset module host 431 to at least one memory device 132 of the memory pool 130 .
[0141] In addition, after the data path 121 between the host 120 and at least one memory device 132 of the memory pool 130 is closed, protecting the data of the host 120 in the at least one memory device 132 includes performing a low-level reset on the at least one memory device 132 of the memory pool 130 by the reset module host 431 .
[0142] The reset module host 431 may be used to perform a low level reset on at least one memory device 132 via the data path 633 .
[0143] exist Figure 6 In an exemplary embodiment, one or more memory devices 132 may also be used to support a low level reset performed by the reset module host 431 .
[0144] Figure 7 An exemplary embodiment of a split computing system 100 according to the present invention is shown. Figure 1 The split computing system 100 shown in FIG. Like elements are labeled with like reference symbols.
[0145] The above detailed description can be applied to Figure 7 The memory pool 130 is similar to the split computing system 100 of FIG. 1 , except for the significant differences mentioned below. In the exemplary embodiment, the memory pool 130 also includes an encryption engine 710 for communicating with the memory controller 131 and one or more memory devices 132 .
[0146] The fabric manager 110 is also used to generate an encryption key 711. In addition, the fabric manager 110 sends the encryption key 711 to the memory controller 131. The generated encryption key 711 is unique to the host.
[0147] In addition, the fabric manager 110 is used to open a data path 121 between the host 120 and at least one memory device 132 of the memory pool 130 through the encryption engine 710 .
[0148] The fabric manager 110 may also be used to open a data path 733 between the memory controller 131 and the encryption engine 710 .
[0149] After the host 120 writes data into at least one memory device 132 , the fabric manager 110 is configured to close the data path 121 between the host 120 and at least one memory device 132 of the memory pool 130 through the encryption engine 710 .
[0150] Then, after the host 120 writes data to the at least one memory device 132 and before the data path 121 between the host 120 and the at least one memory device 132 of the memory pool 130 is closed, the fabric manager 110 is used to change the encryption key 711 .
[0151] The memory controller 131 is then used to protect data of the host 120 in at least one memory device 132 after the data path 121 between the host 120 and at least one memory device 132 of the memory pool 130 is closed by using the encryption engine 710 and using the encryption key 711 received from the fabric manager 110 before the fabric manager 110 changes the key.
[0152] Additionally, the memory controller may be configured to protect data of the host 120 in at least one memory device 132 using the encryption engine 710 via the data path 733 .
[0153] In this exemplary embodiment, after closing the data path 121 between the host 120 and at least one memory device 132 of the memory pool 130, the data of the host 120 in the at least one memory device 132 is protected by using the encryption engine 710, including controlling the encryption engine 710 by the memory controller 131 to encrypt the data of the host 120 using the encryption key 711 sent by the fabric manager 110, and further providing the encrypted data of the host 120 to at least one memory device 132.
[0154] Alternatively, the memory controller 131 may be used to protect data of the host 120 in at least one memory device 132 through the encryption engine 710 when the host 120 writes data.
[0155] That is, the host 120 can use the encryption engine 710 to write data into at least one memory device 132, and the encryption engine 710 is used to protect the data of the host 120 by encrypting the data of the host 120 using the encryption key 711 sent by the fabric manager, and further provide the encrypted data of the host 120 to at least one memory device 132.
[0156] After the host 120 writes the data, the fabric manager 110 may be used to close the data path 121 between the host 120 and at least one memory device 132 of the memory pool 130. Next, the fabric manager 110 may be used to change the encryption key 711.
[0157] Therefore, the data of the host can be dynamically encrypted through the encryption engine 710.
[0158] In addition, Figure 7 In an exemplary embodiment, at least one memory device 132 is used to store encrypted data of the host 120.
[0159] Figure 8 An exemplary embodiment of a split computing system 100 according to the present invention is shown. Figure 7 The split computing system 100 shown in FIG. Like elements are labeled with like reference symbols.
[0160] The above detailed description can be applied to Figure 8 The split computing system 100 is similar to the split computing system 100 of FIG. 1 , except for the significant differences noted below. Figure 8 The illustrated split computing system 100 also includes a fabric grid 240 .
[0161] The fabric manager 110 is used to open a data path 121 between the host 120 and at least one memory device 132 of the memory pool 130 by using the encryption engine 710 through the fabric grid 240 .
[0162] In addition, after the host 120 writes data to the at least one memory device 132 , the fabric manager 110 is used to close the data path 121 between the host 120 and the at least one memory device 132 of the memory pool 130 through the fabric grid 240 using the encryption engine 710 .
[0163] Fig. 9 The system 100 is shown as a separate computing system according to the present invention. Figures 1 to 8 An exemplary embodiment of the fabric manager 110 is shown in FIG.
[0164] The fabric manager 110 according to the present invention may include a processor or processing circuit (not shown) for performing, implementing or initiating various operations of the fabric manager 110 described herein. The processing circuit may include hardware and / or the processing circuit may be controlled by software. The hardware may include analog circuits or digital circuits, or both. The digital circuit may include components such as an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), a digital signal processor (DSP) or a multi-purpose processor. The fabric manager 110 may also include a memory circuit for storing one or more instructions that can be executed by the processor or processing circuit (specifically, executed under the control of software). For example, the memory circuit may include a non-transitory storage medium storing executable software code that, when executed by the processor or processing circuit, causes the fabric manager 110 to perform various operations. The processing circuit may include one or more processors and a non-transitory memory connected to the one or more processors. The non-transitory memory may store executable program code that, when executed by one or more processors, causes the fabric manager 110 to perform, implement, or initiate the operations or methods described herein.
[0165] The fabric manager 110 includes a computing node control unit 9111 that communicates with each of the plurality of hosts 120 of the split computing system 100. The computing node control unit 9111 can be used to open a data path 121 between any host 120 and at least one memory device 132 of the memory pool 130.
[0166] In addition, the computing node control unit 9111 may be configured to close the data path 121 between the host 120 and at least one memory device 132 of the memory pool 130 after the host 120 writes data to at least one memory device 132 .
[0167] The fabric manager 110 further includes a memory control unit 9113 for communicating with the memory pool 130. The memory control unit 9113 can be used to control the memory pool 130 to allocate memory space for the host 120 in at least one memory device 132.
[0168] In addition, the memory control unit 9113 may be used to open a local data path 133 between the memory controller 131 and at least one memory device 132 of the memory pool 130 .
[0169] The memory control unit 9113 may also be used to generate the encryption key 711 and send the encryption key 711 to the memory controller 131. In addition, the memory control unit 9113 may be used to change the encryption key 711.
[0170] The memory control unit 9113 may also be used to open a data path 733 between the memory controller 131 and the encryption engine 710 .
[0171] The fabric manager 110 may further include a network control unit 9112 for controlling the fabric grid 240 to open a data path 121 between any host 120 and a memory device 132 of the memory pool 130 through the fabric grid 240 .
[0172] The network control unit 9112 may also be configured to control the fabric grid 240 to close the data path 121 between the host 120 and at least one memory device 132 of the memory pool 130 after the host 120 writes data into at least one memory device 132 through the fabric grid 240 .
[0173] In addition, the network control unit 9112 may be used to control the fabric grid 240 to open a data path 333 between the memory host device 331 and at least one memory device 132 .
[0174] The network control unit 9112 may also be used to control the fabric grid 240 to open a data path 633 between the reset module host 431 and at least one memory device 132 .
[0175] Fig.10 Describes Figure 2An example of a split computing system 100 is shown in FIG. In this example, the split computing system 100 may include two hosts 120, exemplarily host A and host B, a fabric manager 110, a memory pool 130, and a fabric grid 240. Fig.10 As shown in (a), the fabric manager 110 may configure the host A 120, the fabric grid 240, and the memory pool 130 to open a data path 121 between the host A 120 and the memory device 132 of the memory pool 130. Then, the host A 120 may write data to the memory device 132 on the memory pool 130.
[0176] Then, Fig.10 (b) describes that the memory controller 131 can obtain ownership of the memory device 132, as follows: The fabric manager 110 can configure the host A 120, the fabric grid 240, and the memory pool 130 to close (or disconnect) the data path 121 between the host A 120 and the memory device 132 on the memory pool 130. Next, the fabric manager 110 can configure the memory controller 131 to open the local data path 133 within the memory pool chassis, that is, the local data path 133 between the memory controller 131 and the memory device 132.
[0177] Next, in Fig.10 (c) shows an example of data cleaning of the memory device 132. The memory controller 131 can use the data path (or data link) 133 leading to the memory device 132 to clean the data written by the host A to the memory device 132, for example, by overwriting the entire memory space of the memory device 132. Therefore, the data in the memory device 132 can be completely cleaned without any residual data.
[0178] The split computing system 100 can then perform a new memory allocation, such as Fig.10 (d). That is, the fabric manager 110 may configure another host 120 (i.e., host B), the fabric grid 240, and the memory pool 130 to open a data path 121 between the host B 120 and the memory device 132 on the memory pool 130. The memory device 132 may be, for example, but not limited to, the same memory device 132 in which the host A has written data. It should be noted that since the data in the memory device 132 is completely cleared, the host B 120 may not be able to access the data previously written to the memory by a different host (e.g., by the host A 120).
[0179] Fig.11 Describes Figure 3. In this example, the split computing system 100 may include two hosts 120, exemplarily host A and host B, a fabric manager 110, a memory pool 130, and a fabric grid 240. The memory controller 131 may include a memory host device 331. Fig.11 As shown in (a), the fabric manager 110 may configure the host A 120, the fabric grid 240, and the memory pool 130 to open a data path 121 between the host A 120 and the memory device 132 of the memory pool 130. Then, the host A 120 may write data to the memory device 132 on the memory pool 130.
[0180] Fig.11 (b) describes that the memory host device 331 can obtain ownership of the memory device 132. That is, the fabric manager 110 can configure the host A 120, the fabric grid 240, and the memory pool 130 to close the data path 121 between the host A 120 and the memory device 132 on the memory pool 130. Then, the fabric manager 110 can configure the fabric grid 240 and the memory pool 130 to open the data path 333 between the memory host device 331 and the memory device 132.
[0181] Next, in Fig.11 In the example of (c), memory cleaning is described. The memory host device 331 can use the data path (or link) 133 leading to the memory device 132 to clean the memory device 132 by overwriting the entire memory space of the memory device 132. Therefore, the data in the memory device 132 can be completely cleaned and there is no residual data of the host A 120.
[0182] The split computing system 100 can then perform a new memory allocation, such as Fig.11 (d). That is, the fabric manager 1110 may configure another host 120 (i.e., host B), the fabric grid 240, and the memory pool 130 to open a data path 121 between the host B 120 and the memory device 132 on the memory pool 130. The memory device 132 may be (for example, but not limited to) the same memory device 132 in which the host A has written data. It should be noted that since the data in the memory device 132 is completely cleared, the host B 120 may not be able to access the data previously written to the memory device 132 by a different host (for example, by the host A 120).
[0183] Fig.12 Describes Figure 5. In this example, the split computing system 100 may include two hosts 120, exemplarily host A and host B, a fabric manager 110, a memory pool 130, and a fabric grid 240. The memory controller 131 may include a reset module host 431. Fig.12 As shown in (a), the fabric manager 110 may configure the host A 120, the fabric grid 240, and the memory pool 130 to open a data path 121 between the host A 120 and the memory device 132 of the memory pool 130. Then, the host A 120 may write data to the memory device 132 on the memory pool 130.
[0184] Fig.12 (b) describes that the reset module host 431 can obtain ownership of the memory device 132. That is, the fabric manager 110 can configure the host A 120, the fabric grid 240, and the memory pool 130 to close the data path 121 between the host A 120 and the memory device 132 on the memory pool 130. Then, the fabric manager 110 can configure the fabric grid 240 and the memory pool 130 to open the data path 433 between the reset module host 431 and the memory device 132 through the fabric grid 240.
[0185] Next, in Fig.12 In the example of (c), memory cleaning is described. The reset module host 431 can use the data path (or link) 633 leading to the memory device 132 to clean up the memory device 132 by specifically performing a low-level reset on the memory device 132. Such a reset mechanism is supported by the hardware of the memory device 132. Therefore, the data in the memory device 132 can be completely cleaned up and there is no residual data of the host A 120.
[0186] The split computing system 100 can then perform a new memory allocation, such as Fig.12 (d). The fabric manager 110 may configure another host 120, namely host B, the fabric grid 240, and the memory pool 130 to open a data path 121 between host B 120 and a memory device 132 on the memory pool 130. The memory device 132 may be, for example, but not limited to, the same memory device 132 to which host A has written data. It should be noted that since the data in the memory device 132 is completely flushed, host B 120 may not be able to access data previously written to the memory device 132 by a different host (e.g., by host A 120).
[0187] Fig.13A and Fig. 13B Describes Figure 8An example of a split computing system 100 is shown in FIG. In this example, the split computing system 100 may include two hosts 120, exemplarily host A and host B, a fabric manager 110, a memory pool 130, and a fabric grid 240. The memory pool 130 may also include an encryption engine 710.
[0188] Fig.13A The top of FIG. 10 illustrates that the fabric manager 110 can configure the memory pool 130 to enable data path compression within the memory pool 130. That is, the fabric manager 110 can generate an encryption key 711 and then provide the encryption key 711 to the memory controller 131. For example, this can be implemented when the split computing system 100 is turned on. Alternatively, the fabric manager 110 can use the split computing system 100 to generate a new encryption key for any new host 120.
[0189] Next up Fig.13A , describes how host A can write data to memory device 132 on memory pool 130. Fabric manager 110 can configure host A 120, fabric grid 240, and memory pool 130 to open a data path 121 between host A 120 and memory device 132 on memory pool 130 through encryption engine 710. Host A can then write data to memory device 132 on memory pool 130 through encryption engine 710. That is, data can be dynamically encrypted in the memory pool with the help of encryption engine 710. It should be noted that encryption key 711 is unique to this current host (or owner) 120 of memory pool 130.
[0190] Fig. 13B The top portion of describes that after host A 120 writes encrypted data to the memory device 132 of the memory pool 130, the fabric manager 110 can change the encryption key 711 before the data path 121 is closed, thereby protecting the data from host A.
[0191] Next, the split computing system 100 may perform a new memory allocation, such as Fig. 13B. The fabric manager 110 may configure another host 120, namely host B, the fabric grid 240, and the memory pool 130 to open a data path 121 between host B 120 and the memory device 132 on the memory pool 130. It should be noted that because host B lacks the appropriate encryption key 711 generated for host A 120, host B cannot decrypt the data of host A 120. In addition, the fabric manager 110 may generate a new encryption key 711 and may distribute it to host B 120. Host B 120 may then use the new encryption key 711 to write data to the memory device 132 on the memory pool 130.
[0192] Fig.14 An exemplary implementation of a split computing system 100 according to the present invention is shown. Figures 1 to 8 The illustrated split computing system 100 may be implemented with a memory pool 130 and a fabric manager 110 that may coordinate the connection of a host 120 and the authenticity of the split computing system 100 as described above.
[0193] Fig.15 An exemplary embodiment of a method 1500 for a split computing system 100 according to the present invention is shown. The split computing system 100 includes a fabric manager 110 for communicating with a plurality of hosts 120 and a memory pool 130 of the system. The memory pool 130 includes a memory controller 131 and one or more memory devices 132. The one or more memory devices 132 are used to store data of the host 120. The method 1500 may be performed by an exemplary embodiment of the split computing system 100 according to the present invention.
[0194] The method 1500 comprises step 1501 : opening a data path 121 between any host 120 and at least one memory device 132 of a memory pool 130 through the fabric manager 110 .
[0195] Then, the method 1500 includes step 1502 : after the host 120 writes data to the at least one memory device 132 , the fabric manager 110 closes the data path 121 between the host 120 and the at least one memory device 132 of the memory pool 130 .
[0196] In addition, in step 1503 , the method 1500 includes: after the data path 121 between the host 120 and at least one memory device 132 of the memory pool 130 is closed, the memory controller 131 configures the memory pool 130 to protect the data of the host 120 in the at least one memory device 132 .
[0197] Method 1500 may also include: Figure 1, Figure 2 , Figure 3 , Figure 4 , Figure 5 , Figure 6 , Figure 7 and Figure 8 The actions of the exemplary embodiment of the split computing system 100 are shown. Therefore, the method 1500 achieves the same advantages as the split computing system 100 disclosed above.
[0198] The present invention also provides a computer program product, including program code for implementing method 1500 on a processor. The computer program can be included in a computer readable medium of the computer program product. The computer readable medium can basically include any memory, such as a read-only memory (ROM), a programmable read-only memory (PROM), an erasable PROM (EPROM), a flash memory, an electrically erasable EPROM (EEPROM), or a hard disk drive.
[0199] The invention has been described in conjunction with various embodiments as examples and implementations. However, from a study of the drawings, the invention and the independent claims, other variations will be understood and implemented by those skilled in the art in implementing the claimed subject matter. In the claims and in the specification, the word "comprising" does not exclude other elements or steps, and the indefinite article "a" does not exclude a plurality. A single element or other unit may fulfil the functions of several entities or items described in the claims. The listing of certain measures in mutually different dependent claims does not indicate that a combination of these measures cannot be effectively used.
Claims
1. A split computing system (100), characterized in that: include: A fabric manager (110) is used to communicate with a plurality of hosts (120) and a memory pool (130) of the system, wherein the memory pool (130) includes a memory controller (131) and one or more memory devices (132), and the one or more memory devices (132) are used to store data of the host (120); The fabric manager (110) is further configured to: Opening a data path (121) between any host (120) and at least one memory device (132) of the memory pool (130); After the host (120) writes data into the at least one memory device (132), closing the data path (121) between the host (120) and the at least one memory device (132) of the memory pool (130); The memory controller (131) is used for: The memory pool (130) is configured to protect the data of the host (120) in the at least one memory device (132) after a data path (121) between the host (120) and the at least one memory device (132) of the memory pool (130) is closed.
2. The split computing system (100) according to claim 1, characterized in that: The fabric manager (110) is further configured to control the memory pool (130) to allocate memory space to the host (120) in the at least one memory device (132).
3. The split computing system (100) according to any one of claims 1 or 2, characterized in that: After the host (120) writes data into the at least one memory device (132), after closing the data path (121) between the host (120) and the at least one memory device (132) of the memory pool (130), the fabric manager (110) is further configured to: A local data path (133) is opened between the memory controller (131) and the at least one memory device (132) of the memory pool (130).
4. The split computing system (100) according to any one of claims 1 to 3, characterized in that: The protecting the data of the host (120) in the at least one memory device (132) comprises: The memory space allocated to the host (120) in the at least one memory device (132) of the memory pool (130) is cleaned up.
5. The split computing system (100) according to claim 4, characterized in that: The clearing of the memory space allocated to the host (120) in the at least one memory device (132) of the memory pool (130) comprises: Erasing the memory space allocated to the host (120) in the at least one memory device (132) of the memory pool (130); or The memory space allocated to the host (120) in the at least one memory device (132) of the memory pool (130) is overwritten with random data.
6. The split computing system (100) according to any one of claims 1 to 5, characterized in that: The system further includes a fabric grid (240), wherein the fabric grid (240) is used to communicate with the fabric manager (110), the plurality of hosts (120), and the memory pool (130), and the fabric grid (240) is further used to: Opening the data path (121) between the host (120) and the at least one memory device (132) of the memory pool (130) through the fabric grid (240); The data path (121) between the host (120) and the at least one memory device (132) of the memory pool (130) is closed through the fabric grid (240).
7. The split computing system (100) according to any one of claims 1 to 6, characterized in that: The memory controller (131) includes a memory host device (331); After the host (120) writes data in the at least one memory device (132), after closing the data path (121) between the host (120) and the at least one memory device (132) of the memory pool (130), the fabric manager (110) is further configured to: A data path (333) is opened between the memory host device (331) and the at least one memory device (132) through the fabric grid (240).
8. The split computing system (100) according to any one of claims 1 to 6, characterized in that: The memory controller (131) includes a reset module host (431); After the host (120) writes data in the at least one memory device (132), after closing the data path (121) between the host (120) and the at least one memory device (132) of the memory pool (130), the fabric manager (110) is further configured to: A data path (633) is opened between the reset module host (431) and the at least one memory device (132) through the fabric grid (240).
9. The split computing system (100) according to claim 8, characterized in that: After the data path (121) between the host (120) and the at least one memory device (132) of the memory pool (130) is closed, protecting the data of the host (120) in the at least one memory device (132) comprises: A low level reset is performed on the at least one memory device (132) of the memory pool (130).
10. The split computing system (100) according to claim 1, characterized in that: The fabric manager (110) is further configured to: Generate an encryption key (711) and send the encryption key (711) to the memory controller (131); After the host (120) writes data to the at least one memory device (132) and before the data path (121) between the host (120) and the at least one memory device (132) of the memory pool (130) is closed, changing the encryption key (711); The memory pool (130) further includes an encryption engine (710) for communicating with the memory controller (131) and the one or more memory devices (132); The memory controller (131) is also used for: After the data path (121) between the host (120) and at least one memory device (132) of the memory pool (130) is closed, the data of the host (120) in the at least one memory device (132) is protected by the encryption engine (710).
11. The split computing system (100) according to claim 10, characterized in that: The fabric manager (110) is further configured to: Opening the data path (121) between the host (120) and the at least one memory device (132) of the memory pool (130) through the encryption engine (710); The data path (121) between the host (120) and the at least one memory device (132) of the memory pool (130) is closed by the encryption engine (710).
12. The split computing system (100) according to any one of claims 10 or 11, characterized in that: After the data path (121) between the host (120) and the at least one memory device (132) of the memory pool (130) is closed, protecting the data of the host (120) in the at least one memory device (132) by the encryption engine (710) comprises: The memory controller (131) controls the encryption engine (710) to encrypt the data of the host (120) using the encryption key (711) sent by the fabric manager (110); The encrypted data of the host (120) is provided to the at least one memory device (132).
13. The split computing system (100) according to any one of claims 10 to 12, characterized in that: The at least one memory device (132) is also used to store the encrypted data of the host (120).
14. A method (1500) for a split computing system (100), characterized in that: The split computing system (100) includes a fabric manager (110) for communicating with a plurality of hosts (120) and a memory pool (130) of the system, wherein the memory pool (130) includes a memory controller (131) and one or more memory devices (132), wherein the one or more memory devices (132) are used to store data of the host (120); The method (1500) comprises: The fabric manager (110) opens (1501) a data path (121) between any host (120) and the at least one memory device (132) of the memory pool (130); After the host (120) writes data to the at least one memory device (132), the fabric manager (110) closes (1502) the data path (121) between the host (120) and the at least one memory device (132) of the memory pool (130); After the data path (121) between the host (120) and at least one memory device (132) of the memory pool (130) is closed, the memory controller (131) configures (1503) the memory pool (130) to protect the data of the host (120) in the at least one memory device (132).
15. A computer program product, characterized in that The method comprises program code for executing the method (1500) according to claim 14 when implemented on a processor.