Memory access method and computing device

Abstract

The invention discloses a memory access method and computing equipment, relates to the field of computing equipment, and can effectively avoid leakage of data in a CXL memory. Specifically, in response to a device access request, a processor of the computing device obtains a first signature corresponding to a main body generating the device access request, and verifies the first signature. And responding to a read-write instruction of the main body generating the equipment access request to the CXL memory under the condition that the first signature verification is passed. Wherein the subject for generating the device access request includes at least one of a process, an application, or a computing device.

Description

Technical Field

[0001] The present application relates to the field of computing devices, and in particular to a memory access method and a computing device. Background Art

[0002] Compute Express Link (CXL) memory can be connected to a compute device to provide additional memory space for the compute device. CXL memory can be shared between multiple processes running on the same compute device, or between multiple compute devices.

[0003] When any process of a computing device writes data to CXL memory, other processes of the computing device or other computing devices can also read the data from CXL memory. In this way, when CXL memory is accessed by an unsafe process or computing device, data in CXL memory may be leaked. Summary of the invention

[0004] The embodiments of the present application provide a memory access method and a computing device, which can effectively prevent data leakage in a CXL memory.

[0005] To achieve the above objectives, the embodiments of the present application adopt the following technical solutions:

[0006] In a first aspect, a memory access method is provided, which is applied to a processor of a first computing device, the processor being connected to a CXL memory. The method comprises: in response to a device access request, obtaining a first signature corresponding to a subject that generates the device access request, and verifying the first signature. If the first signature verification passes, responding to the subject that generates the device access request with a read and write instruction to the CXL memory.

[0007] The subject that generates the device access request includes at least one of a process, an application, or a computing device.

[0008] Through the above technical solution, it can be known that only the verified subject (process, application, or computing device) can access the CXL memory. In this way, the phenomenon of unsafe processes accessing the CXL memory can be effectively avoided. In turn, the security of CXL memory access is effectively improved, and the data in the CXL memory is effectively prevented from being leaked.

[0009] In an optional implementation, the verifying of the first signature may specifically include: obtaining a target verification code, and verifying the first signature based on the target verification code.

[0010] In this implementation, the specific process of verifying the first signature is described, which can effectively improve the feasibility of the present application.

[0011] In an optional implementation manner, the device access request carries the first signature.

[0012] In this implementation, it is explained that the device access request can carry the first signature, so that the processor can directly parse the device access request to obtain the first signature, which can improve the processing efficiency of the processor.

[0013] In an optional implementation, a first correspondence is stored in the first computing device, and the first correspondence is used to indicate at least one of a verification code corresponding to a process allowed to access the CXL memory, a verification code corresponding to an application allowed to access the CXL memory, or a verification code corresponding to a computing device allowed to access the CXL memory.

[0014] In this embodiment, it is explained that different verification codes may be stored in the first computing device, such as verification codes corresponding to entities (processes, applications or computing devices) that are allowed to access the CXL memory. In this way, the processor can quickly obtain the target verification code from the verification codes stored in the first computing device to improve the processing efficiency of the processor.

[0015] In an optional implementation, the first correspondence relationship is stored in the kernel space of the first computing device, and the above-mentioned obtaining the target verification code may specifically include: obtaining the first correspondence relationship from the kernel space of the first computing device, and determining the target verification code based on the first correspondence relationship.

[0016] In this implementation, the first correspondence can be stored in the kernel space of the first computing device, which has higher security and operating efficiency. In this way, not only can the processor efficiency of the processor be effectively improved, but also the security of the first correspondence can be improved to avoid leakage of the verification code corresponding to the subject (process, application or computing device) allowed to access the CXL memory.

[0017] In an optional implementation, the first correspondence is stored in a user space of the first computing device. The above-mentioned obtaining of the target verification code may specifically include: obtaining the first correspondence from the user space of the first computing device, and determining the target verification code based on the first correspondence. In addition, the processor may also send the target verification code to the kernel space of the first computing device.

[0018] In this embodiment, it is described that the target verification code in the user space of the first computing device can be sent to the kernel space of the first computing device. In this way, the first signature can be verified based on the target verification code in the kernel space of the first computing device. The kernel space operates more efficiently. In this way, the verification efficiency of the first signature can be effectively improved.

[0019] In an optional implementation, when the first computing device is started, the first corresponding relationship is obtained from the management computing device; or, the first corresponding relationship is periodically obtained from the management computing device. The management computing device is used to manage multiple computing devices, including the first computing device.

[0020] In this embodiment, it is described that the processor can update the first corresponding relationship in the first computing device based on the first corresponding relationship stored in the management computing device, which can avoid leakage of the verification code, further improve the security of CXL memory access, and avoid leakage of data in the CXL memory.

[0021] In an optional implementation, verifying the first signature based on the target verification code may specifically include: determining that the first signature verification has passed if the target verification code and the first signature match successfully.

[0022] In this embodiment, a process of verifying the first signature based on the target verification code is described. When the target verification code and the first signature are obtained, the processor can match the target verification code and the first signature to determine whether the first signature passes the verification. In this way, the verification efficiency of the processor can be improved.

[0023] In an optional implementation, responding to the read and write instructions of the subject generating the device access request to the CXL memory may specifically include: in response to the read data instruction of the subject generating the device access request, obtaining the first data from the CXL memory, the read data instruction is used to instruct to read the first data. Or, in response to the write data instruction of the subject generating the device access request, writing the second data to the CXL memory, the write data instruction is used to instruct to write the second data.

[0024] In this embodiment, the read and write instructions of the CXL memory by the subject of the response generation device access request are described, which may include two response modes of obtaining data from the CXL memory and writing data to the CXL memory, so that the compatibility of this application can be enhanced.

[0025] In an optional implementation, the first signature is a private key, and the target verification code is a public key.

[0026] In this implementation, the first signature and the verification code are described. The first signature and the verification code may be a public key and a private key that are paired with each other. The private key has uniqueness and confidentiality, which can ensure that the first signature of a secure subject (process, application or computing device) will not be leaked, thereby further improving the security of CXL memory access.

[0027] In an optional implementation, both the first computing device and the second computing device are connected to the CXL memory; the subject generating the access request is a target process, which runs in the first computing device, or the target process runs in the second computing device. Alternatively, the subject generating the access request is a target application, which runs in the first computing device, or the target application runs in the second computing device.

[0028] In this embodiment, the subject that generates the access request is described. The subject can be a process or application running in the first computing device, or a process or application running in a computing device other than the first computing device (such as the second computing device). In this way, the compatible scenarios of this application can be expanded.

[0029] In a second aspect, a memory access device is provided, the device comprising: a functional unit for executing any one of the methods provided in the first aspect, the actions performed by each functional unit are implemented by hardware or by hardware executing corresponding software. For example, the memory access device may include: an acquisition unit, a verification unit, and a response unit. Among them, the acquisition unit is used to obtain a first signature corresponding to the subject that generates the device access request in response to the device access request, and the verification unit is used to verify the first signature. The response unit is used to respond to the subject that generates the device access request to read and write instructions to the CXL memory when the first signature verification passes.

[0030] In a third aspect, a computing device is provided, comprising: a processor and a memory, wherein the processor is connected to the memory and the processor is connected to the CXL memory. The memory is used to store computer-executable instructions, and the processor executes the computer-executable instructions stored in the memory, thereby implementing any one of the methods provided in the first aspect.

[0031] In a fourth aspect, a chip is provided, the chip comprising: a processor and an interface circuit; the interface circuit is used to receive code instructions and transmit them to the processor; the processor is used to run the code instructions to execute any one of the methods provided in the first aspect above.

[0032] In a fifth aspect, a computer-readable storage medium is provided, which stores computer execution instructions. When the computer execution instructions are executed on a computer, the computer executes any one of the methods provided in the first aspect.

[0033] In a sixth aspect, a computer program product is provided, comprising computer execution instructions, which, when executed on a computer, enable the computer to execute any one of the methods provided in the first aspect.

[0034] Among them, the technical effects brought about by any implementation method in the second to sixth aspects can refer to the technical effects brought about by different implementation methods in the first aspect, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] Figure 1 A schematic diagram of CXL memory being shared between server CXL244 and server CXL248;

[0036] Figure 2 A schematic diagram of the architecture of a computing cluster provided in an embodiment of the present application;

[0037] Figure 3 A flowchart of a memory access method provided in an embodiment of the present application;

[0038] Figure 4 A schematic diagram of a user space and a kernel space of a computing device provided in an embodiment of the present application;

[0039] Figure 5 A schematic diagram of a user space and a kernel space of another computing device provided in an embodiment of the present application;

[0040] Figure 6 A schematic diagram of another computing cluster architecture provided in an embodiment of the present application;

[0041] Figure 7 A schematic diagram of the structure of a memory access device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0042] The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application.

[0043] In the description of this application, unless otherwise specified, " / " indicates that the objects associated with each other are in an "or" relationship, for example, A / B can represent A or B; "and / or" in this application is merely a description of the association relationship between associated objects, indicating that three relationships may exist, for example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone, where A and B can be singular or plural.

[0044] Furthermore, in the description of this application, unless otherwise specified, "plurality" means two or more than two. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single items or plural items. For example, at least one of a, b, or c can mean: a, b, c, ab, ac, bc, or abc, where a, b, and c can be single or multiple.

[0045] In addition, in order to facilitate the clear description of the technical solutions of the embodiments of the present application, in the embodiments of the present application, the words "first", "second" and the like are used to distinguish the same items or similar items with substantially the same functions and effects. Those skilled in the art will understand that the words "first", "second" and the like do not limit the quantity and execution order, and the words "first", "second" and the like do not necessarily limit the differences. At the same time, in the embodiments of the present application, the words "exemplary" or "for example" are used to indicate examples, illustrations or explanations. Any embodiment or design described as "exemplary" or "for example" in the embodiments of the present application should not be interpreted as being more preferred or more advantageous than other embodiments or design solutions. Specifically, the use of words such as "exemplary" or "for example" is intended to present related concepts in a concrete manner for ease of understanding.

[0046] The following is an introduction to the terms involved in the embodiments of the present application.

[0047] CXL: is a high-speed interconnect technology standard designed for high-performance data center computers. It can quickly and reliably transmit data between different components inside computing devices, such as central processing unit (CPU), accelerator, memory, smart network interface card (Smart NIC), etc. CXL is built on the physical and electrical interface of the serial peripheral component interconnect (PCIe). CXL protocols can include input / output protocols (CXL.io), cache access protocols (CXL.cache), and memory access protocols (CXL.mem).

[0048] Direct access (DAX) devices: DAX technology is a technology that allows applications (hereinafter referred to as applications) to directly access persistent memory devices without the need to read and write persistent memory devices through block input / output (IO) operations of the file system, effectively reducing the latency of data access. When accessing CXL memory based on DAX technology, CXL memory can be created as a DAX device (or CXL-DAX device).

[0049] The application scenarios of the embodiments of the present application are introduced below.

[0050] With the rapid development of technologies such as big data, artificial intelligence and cloud computing, traditional interconnection technologies have been unable to meet the growing needs of data transmission and data processing. Compared with traditional interconnection technologies, CXL can provide higher bandwidth, lower latency and more powerful expansion capabilities, thereby meeting the efficient interconnection between processors (such as CPUs), memory, accelerators and other components. In the future data centers, high-performance computing and edge computing, CXL will become one of the key technologies for achieving high-efficiency, low-latency data processing.

[0051] CXL memory refers to a memory device connected to a computing device through the CXL protocol. When accessing CXL memory based on dax technology, CXL memory can be created as a dax device. Dax devices can include two application modes, one is the system memory (system ram) mode at the operating system (OS) control level, and the other is the direct access device (device dax) mode at the application control level.

[0052] In the system memory mode at the operating system control level, CXL memory can be used as an extension of system memory and is controlled and managed by the operating system. In other words, the control of CXL memory is centralized on the operating system side. In this mode, the operating system can centrally schedule the resource allocation of CXL memory. For example, the operating system determines how much memory space to allocate to each process (or business) in CXL memory. In this way, flexible allocation of CXL memory cannot be achieved.

[0053] In the direct access device mode at the application control layer, applications are allowed to access data stored in the CXL memory without going through the operating system. The following describes the process of applications accessing CXL memory in the direct access device mode at the application control layer.

[0054] CXL memory can realize memory sharing between multiple processes running on the same computing device, and can also realize memory sharing between multiple computing devices. On this basis, when any process running on a computing device writes data to CXL memory, other processes running on the computing device or processes running on other computing devices can obtain the data from CXL memory, that is, obtain plaintext data from CXL memory.

[0055] For example, Figure 1 FIG. 1 is a schematic diagram showing that CXL memory is shared between server CXL244 and server CXL248. Figure 1As shown, processes A and B are running on server CXL244, and process C is running on server CXL248. Process A is used to store natural numbers in CXL memory based on the CXL.mem protocol, and process A can also be called the writeCXLMemPattern process. On this basis, after process A writes a natural number in CXL memory, process B running in server CXL244 and process C running in server CXL248 can both read the natural number stored in CXL memory by process A through a simple read operation, that is, obtain the plaintext data from CXL memory.

[0056] In this way, when the CXL memory is accessed by an unsafe process, the data in the CXL memory will be leaked.

[0057] In view of this, an embodiment of the present application provides a memory access method, which is applied to a processor of a first computing device, and the processor is connected to a CXL memory. The processor can respond to a device access request, obtain a first signature corresponding to a subject that generates the device access request, and verify the first signature. If the first signature verification passes, respond to the subject that generates the device access request to send a read and write instruction to the CXL memory. The subject that generates the device access request includes at least one of a process, an application, or a computing device.

[0058] Through the above technical solution, it can be known that only the verified subject (process, application, or computing device) can access the CXL memory. In this way, the phenomenon of unsafe processes accessing the CXL memory can be effectively avoided. In turn, the security of CXL memory access is effectively improved, and the data in the CXL memory is effectively prevented from being leaked.

[0059] The following is an exemplary introduction to the system architecture of the embodiments of the present application.

[0060] Figure 2 The following is a schematic diagram of the architecture of a computing cluster provided in an embodiment of the present application. Figure 2 As shown, the computing cluster includes at least one computing device and a CXL memory 300. Exemplarily, Figure 2 Two computing devices are shown, a first computing device 100 and a second computing device 200 .

[0061] The CXL memory 300 is respectively connected to the first computing device 100 and the second computing device 200. In one implementation, the CXL memory 300 may be respectively connected to the first computing device 100 and the second computing device 200 via a high-speed cable.

[0062] The CXL memory 300 may include a CXL controller 301 and at least one memory. Figure 2Two memories are shown, namely memory 302 and memory 303.

[0063] It should be noted that the CXL controller, also known as the CXL chip, can connect memories (such as memory 302 and memory 303) to multiple computing devices based on the CXL technology to increase the memory capacity of the computing devices. It should also be noted that the CXL controller can be a CXL multi-head controller (CXL mulit head expander) so that the CXL controller can be directly connected to multiple computing devices. For example, the CXL controller can be connected to two computing devices through two ports. For another example, the CXL controller can be connected to four computing devices through four ports. For another example, the CXL controller can be connected to eight computing devices through eight ports.

[0064] Memory 302 and memory 303 may be storage particles (e.g., dynamic random access memory (DRAM) flash memory particles), memory sticks (e.g., dual inline memory modules (DIMM) memory sticks), or other types of memory, which is not limited in the embodiments of the present application.

[0065] The first computing device 100 may include a processor 101 and a memory 102 .

[0066] The second computing device 200 may include a processor 201 and a memory 202 .

[0067] Processor 101 and processor 201 may be a central processing unit (CPU) or other components with processing capabilities. The CPU is the computing and control core of the computing device and is the final execution unit for information processing and program running. The CPU is a large-scale integrated circuit composed of an arithmetic unit, a controller, a register, etc. Its main task is to process and process various data.

[0068] The memory 102 and the memory 202 may be a disk or other memory that stores data and does not lose the data after a power outage.

[0069] It should also be noted that the computing device (such as the first computing device 100 and the second computing device 200) provided in the embodiment of the present application can be a network device or a terminal device. The network device can include a server, etc. Among them, the server can be a physical server, or there can be two or more physical servers that share different responsibilities and cooperate with each other to realize the various functions of the server.

[0070] Exemplarily, the server may be a blade server, a high-density server, a rack server or a tower server, etc. The terminal device may include a personal digital assistant (PDA), an ultra-mobile personal computer (UMPC), a notebook computer, a netbook, a desktop computer, an all-in-one computer, etc.

[0071] In the embodiment of the present application, after receiving a device access request for the CXL memory, the processor (processor 101 or processor 201) of the computing device (first computing device 100 or second computing device 200) can obtain the first signature corresponding to the subject that generates the device access request and verify the first signature. If the first signature verification passes, the processor can respond to the read and write instructions of the subject that generates the device access request to the CXL memory.

[0072] The following describes in detail the implementation of the embodiment of the present application by taking the processor of the first computing device as an example of the execution subject in conjunction with the accompanying drawings.

[0073] Figure 3 A flowchart of a memory access method provided in an embodiment of the present application is shown below. Figure 3 As shown, the method includes S301-S303.

[0074] S301, in response to a device access request, obtaining a first signature corresponding to a subject that generates the device access request.

[0075] The device access request is used to request to open the CXL memory.

[0076] Illustratively, opening the CXL memory is a pre-order step for performing read and write operations on the CXL memory, that is, if a subject (process, application or computing device) intends to read data from or write data to the CXL memory, it needs to first send a device access request to the processor to open the CXL memory. After opening the CXL memory, the subject can send a read data instruction to read data from the CXL memory or a write data instruction to write data to the CXL memory to the processor to read data from or write data to the CXL memory.

[0077] The embodiment of the present application does not specifically limit the subject that generates the device access request (hereinafter referred to as the first subject). In an optional implementation, the first subject can be at least one of a process, an application, or a computing device.

[0078] It can be understood that the process in the embodiment of the present application may include any process running in the first computing device, and may also include any process running in a computing device (hereinafter referred to as the second computing device) connected to the same CXL memory as the first computing device. In addition, the process can be a process started during the operation of an application (such as a game application, a browser application, or a video playback application, etc.) installed in the computing device, that is, an application process. It can also be a process started during the operation of the operating system, that is, a system process. It can also be a process related to the kernel of the operating system, that is, a kernel process.

[0079] The application in the embodiment of the present application may include an application installed in the first computing device, and may also include an application installed in the second computing device.

[0080] In the case where the first subject is a process (hereinafter referred to as the first process), the first process can be run in the first computing device or in the second computing device. For example, taking the first subject as process A, process A can be run in Figure 2 The process in the first computing device 100 shown may also be running on Figure 2 Processes within the second computing device 200 are shown.

[0081] When the first subject is an application (hereinafter referred to as the first application), the first application may be run in the first computing device or in the second computing device.

[0082] The embodiment of the present application does not specifically limit the first signature corresponding to the first subject. In one example, the first signature may be a key corresponding to the first subject. In another example, the first signature may be a subject identifier of the first subject. For example, in the case where the subject that generates the read data instruction is a process, the first signature may be a process identifier (identifier, ID) or a process name of the process. In the case where the subject that generates the read data instruction is an application, the first signature may be an application ID or an application name of the application. In the case where the subject that generates the read data instruction is a computing device, the first signature may be a device ID or a device name of the computing device.

[0083] The embodiment of the present application does not specifically limit the way in which the processor obtains the first signature corresponding to the first subject. The following will introduce 1. obtaining the first signature from the device access request and 2. obtaining the first signature from multiple signatures stored in the first computing device.

[0084] 1. Obtain a first signature from the device access request.

[0085] In this embodiment, the device access request may carry the first signature. Accordingly, after receiving the device access request, the processor may parse the device access request to obtain the first signature corresponding to the second subject.

[0086] 2. Obtain a first signature from multiple signatures stored in the first computing device.

[0087] In this embodiment, a signature correspondence relationship may be stored in the first computing device, and the signature correspondence relationship is used to indicate at least one of signatures corresponding to different processes, signatures corresponding to different applications, or signatures corresponding to different computing devices.

[0088] The embodiment of the present application does not specifically limit the storage form of the signature correspondence relationship. For example, the signature correspondence relationship can be stored in the first computing device in the form of a table, or can be stored in the first computing device in the form of a function.

[0089] The signatures corresponding to different processes may include: signatures corresponding to multiple processes running in the first computing device and / or the second computing device. For example, take the example that the signatures corresponding to different processes include signatures corresponding to multiple processes running in the first computing device and the second computing device. Assuming that the processes running in the first computing device include process A and process B, and the processes running in the second computing device include process 1 and process 2, the signatures corresponding to different processes may include: the signature corresponding to process A, the signature corresponding to process B, and the signature corresponding to process 1, and the signature corresponding to process 2.

[0090] It should be noted that the signatures corresponding to different processes may be the same or different.

[0091] The application in the embodiment of the present application may include an application installed in the first computing device, and may also include an application installed in the second computing device.

[0092] The signatures corresponding to different applications may include: signatures corresponding to multiple applications installed in the first computing device and / or the second computing device. For example, take the example that the signatures corresponding to different applications include signatures corresponding to multiple applications installed in the first computing device and the second computing device. Assuming that the applications installed in the first computing device include application C and application D, and the applications installed in the second computing device include application 3 and application 4, the signatures corresponding to different applications may include: the signature corresponding to application C, the signature corresponding to application D, the signature corresponding to application 3, and the signature corresponding to application 4.

[0093] It should be noted that the signatures corresponding to different applications can be the same or different. The signatures corresponding to the same application installed on different computing devices can be the same or different. For example, assuming that application C is installed in both the first computing device and the second computing device, the signature corresponding to application C installed in the first computing device and the signature corresponding to application C installed in the second computing device can be the same or different.

[0094] The signatures corresponding to different computing devices may include: a signature corresponding to a first computing device and a signature corresponding to a second computing device. Figure 2 Taking the computing cluster in as an example, assuming that the signature corresponding to the first computing device 100 is 001 and the signature corresponding to the second computing device 200 is 002, the signatures corresponding to different computing devices may include: 001 and 002.

[0095] It should be noted that the signatures corresponding to different computing devices may be the same or different.

[0096] On this basis, taking the first subject as the first process as an example, before the first process intends to read data from the CXL memory or intends to write data to the CXL memory, it can generate a device access request for requesting to open the CXL memory, and send the device access request to the processor. After the processor receives the device access request sent by the first process, it can determine the process ID of the first process, and then based on the process ID of the first process, determine the signature corresponding to the first process from the signature correspondence relationship stored in itself, which is the first signature.

[0097] In an optional implementation, the first computing device may include a kernel space and a user space. A process or application (e.g., a process or application that generates a read data instruction in an embodiment of the present application) may be deployed in the user space. The kernel space may include a virtual file system (VFS) and a driver module (hereinafter referred to as a driver module) of the CXL memory. The user space and the kernel space may communicate through a software interface (e.g., a system call interface (syscall interface)).

[0098] The following will continue to take the case where the device access request carries the first signature and the first subject is the first process as an example, and illustrate the above S301 through the interaction between the user space and the kernel space.

[0099] like Figure 4As shown, before the first process in the user space intends to read data from the CXL memory or intends to write data to the CXL memory, it can generate a device access request carrying a first signature, and call the open function or mmap function in the syscall interface to send the device access request to the VFS in the kernel space. After receiving the device access request, the VFS can parse the device access request to obtain the first signature corresponding to the first process. Alternatively, after receiving the device access request, the VFS can send the device access request to the driver module in the kernel space. After receiving the device access request, the driver module can parse the device access request to obtain the first signature corresponding to the first process.

[0100] S302: Verify the first signature.

[0101] In an optional implementation, the processor may obtain a target verification code, and verify the first signature based on the target verification code.

[0102] The first computing device may store a first correspondence relationship, and the first correspondence relationship is used to indicate at least one of a verification code corresponding to a process allowed to access the CXL memory, a verification code corresponding to an application allowed to access the CXL memory, or a verification code corresponding to a computing device allowed to access the CXL memory.

[0103] The embodiments of the present application do not specifically limit the verification code. In one example, the verification code may include a key corresponding to a subject (process, application, or computing device, hereinafter referred to as the second subject) that is allowed to write data in the CXL memory. In another example, the first signature may include a subject identifier of the second subject. For example, when the second subject is a process, the verification code may include a process identifier (identifier, ID) or a process name of the process. When the second subject is an application, the verification code may include an application ID or an application name of the application. When the second subject is a computing device, the verification code may include a device ID or a device name of the computing device.

[0104] The embodiment of the present application does not specifically limit the storage form of the first correspondence relationship. For example, the first correspondence relationship may be stored in the first computing device in the form of a table, or may be stored in the first computing device in the form of a function.

[0105] The verification codes corresponding to the processes that are allowed to access the CXL memory include: verification codes corresponding to the processes that are allowed to perform read and write operations in the CXL memory (e.g., write data to the CXL memory or read data from the CXL memory) in the first computing device and / or the second computing device. For example, it is taken as an example that the processes that are allowed to access the CXL memory include the processes that are allowed to perform read and write operations in the CXL memory in the first computing device and the second computing device. Assuming that the processes that are allowed to perform read and write operations in the CXL memory in the first computing device include process A and process B, and the processes that are allowed to perform read and write operations in the CXL memory in the second computing device include process 1 and process 2, then the verification codes corresponding to the processes that are allowed to access the CXL memory may include: the verification code corresponding to process A, the verification code corresponding to process B, and the verification code corresponding to process 1 and the verification code corresponding to process 2.

[0106] It should be noted that the check codes corresponding to different processes that are allowed to access the CXL memory may be the same or different.

[0107] The verification codes corresponding to applications that are allowed to access the CXL memory may include: verification codes corresponding to applications that are allowed to perform read and write operations in the CXL memory in the first computing device and / or the second computing device. For example, it is taken that the applications that are allowed to access the CXL memory include applications that are allowed to perform read and write operations in the CXL memory in the first computing device and the second computing device. Assume that the applications installed in the first computing device include application C and application D, and application C allows read and write operations in the CXL memory. The applications installed in the second computing device include application 3 and application 4, and application 4 allows read and write operations in the CXL memory. Then the verification codes corresponding to the applications that are allowed to access the CXL memory may include: the verification code corresponding to application C and the verification code corresponding to application 4.

[0108] It should be noted that the verification codes corresponding to different applications that are allowed to access CXL memory may be the same or different. The verification codes corresponding to the same application installed on different computing devices may be the same or different. For example, assuming that application C is installed in both the first computing device and the second computing device, the verification code corresponding to application C installed in the first computing device and the verification code corresponding to application C installed in the second computing device may be the same or different.

[0109] The verification code corresponding to the computing device allowed to access the CXL memory may include: the verification code corresponding to the device in the first computing device and / or the second computing device that is allowed to perform read and write operations in the CXL memory. Figure 2Taking the computing cluster in as an example, assuming that the first computing device 100 allows read and write operations to the CXL memory, and the second computing device 200 does not allow read and write operations to the CXL memory, the verification code corresponding to the computing device allowed to access the CXL memory includes the verification code corresponding to the first computing device.

[0110] It should be noted that the check codes corresponding to different computing devices that are allowed to access the CXL memory may be the same or different.

[0111] On this basis, the processor can obtain the target verification code from the first corresponding relationship stored in itself. After obtaining the target verification code, the processor can match the target verification code with the first signature. If the target verification code and the first signature match successfully, the processor can determine that the first signature verification has passed.

[0112] The embodiment of the present application does not specifically limit the condition for the target verification code to successfully match the first signature. Specifically, the condition for the target verification code to successfully match the first signature may include any one of the following (1), (2), and (3).

[0113] (1) The target verification code is consistent with the first signature. In one example, assuming that the target verification code is 001x and the first signature is 001x, the target verification code and the first signature match successfully. In another example, assuming that the target verification code is 001x and the first signature is 002y, the target verification code and the first signature do not match successfully.

[0114] (2) The target verification code includes the first signature. In one example, assuming that the target verification code includes 001x, 002y, and 003z, and the first signature is 001x, then the target verification code includes the first signature, and the target verification code and the first signature match successfully. In another example, assuming that the target verification code includes 001x, 002y, and 003z, and the first signature is 004l, then the target verification code does not include the first signature, and the target verification code and the first signature match unsuccessfully.

[0115] (3) The target verification code and the first signature are paired keys. For example, the target verification code can be a public key and the first signature can be a private key. In this case, if the first signature and the target verification code are paired public keys and private keys, the target verification code and the first signature are successfully matched.

[0116] Specifically, taking the case where the first signature includes the private key corresponding to process B and the target verification code includes the public key corresponding to the process that is allowed to write data in the CXL memory as an example, after the processor obtains the private key corresponding to process B, it can compare the private key corresponding to process B with the public key corresponding to the process that is allowed to write data in the CXL memory. In the case where the private key corresponding to process B and the public key corresponding to any process that is allowed to write data in the CXL memory are paired public keys and private keys, the processor can determine that the first signature passes verification.

[0117] Through the above technical solution, when verifying the first signature, it can be verified not only based on the key (such as the public key and the private key), but also based on the subject identifier of the subject (process, application or device) that generates the write data instruction. In this way, when the subject is a process, the security of different processes of the same computing device accessing the CXL memory can be guaranteed; when the subject is an application, the security of different applications of the same computing device accessing the CXL memory can be guaranteed; when the subject is a device, the security of different computing devices accessing the CXL memory can be guaranteed.

[0118] In addition, only entities that have passed the verification can access the CXL memory. This can effectively prevent unsafe entities from accessing the CXL memory. This further improves the security of CXL memory access and effectively prevents data leakage in the CXL memory.

[0119] In an optional implementation, the first corresponding relationship may be stored in a kernel space of the first computing device, or may be stored in a user space of the first computing device.

[0120] In the case where the first corresponding relationship is stored in the user space of the first computing device, the processor obtains the target verification code, which can be replaced by: obtaining the first corresponding relationship from the user space of the first computing device, and determining the target verification code based on the first corresponding relationship.

[0121] In the case where the first corresponding relationship is stored in the kernel space of the first computing device, the processor obtains the target verification code, which can be replaced by: obtaining the first corresponding relationship from the kernel space of the first computing device, and determining the target verification code based on the first corresponding relationship.

[0122] In the above technical solution, the first corresponding relationship is stored in the kernel space of the first computing device, and the kernel space has higher security and operating efficiency. In this way, not only can the decoding parameters corresponding to the process, application or computing device be prevented from being leaked, but also the processor efficiency of the processor can be effectively improved.

[0123] In an optional implementation, the first computing device may include a verification code management module (may be called a key manager), and the verification code management module is used to store the first corresponding relationship. Accordingly, the verification code management module may be located in the user space of the first computing device, or in the kernel space of the first computing device.

[0124] In order to improve the verification efficiency of the first computing device for verifying the first signature, in an optional implementation, the processor may verify the first signature based on the target verification code in the kernel space of the first computing device. On this basis, after obtaining the target verification code based on the first corresponding relationship stored in the user space of the first computing device, it is also necessary to send the target verification code to the kernel space of the first computing device.

[0125] Both the VFS and the driver module in the kernel space of the first computing device can verify the first signature. Figure 4 This is a schematic diagram of VFS verifying the first signature. Figure 5 A schematic diagram of a driver module verifying a first signature.

[0126] In an optional implementation, the VFS may include a first verification module, such as Figure 4 The first verification module 401 is shown. Accordingly, the above-mentioned VFS verifies the first signature, which can be replaced by: VFS verifies the first signature through the first verification module.

[0127] In an optional implementation, the driving module may include a second verification module, such as Figure 5 The second verification module 501 is shown. Accordingly, the above-mentioned driver module verifies the first signature, which can be replaced by: the driver module verifies the first signature through the first verification module.

[0128] S303 , when the first signature verification passes, respond to the subject generating the device access request to generate a read and write instruction to the CXL memory.

[0129] The read / write instructions are used to instruct to obtain data from the CXL memory (hereinafter referred to as first data), or the read / write instructions are used to instruct to write data to the CXL memory (hereinafter referred to as second data).

[0130] Specifically, if the first signature verification passes, it indicates that the first subject is allowed to perform read and write operations on the CXL memory. At this time, the processor can send a handle to the first subject, and the handle is used to indicate that the first subject is allowed to perform read and write operations on the CXL memory. After receiving the handle, the first subject can generate a read and write instruction for the CXL memory based on the handle, and send the read and write instruction to the processor. The processor can respond to the read and write instruction sent by the first subject and perform read and write operations on the CXL memory.

[0131] If the first signature verification fails, it indicates that the first subject is not allowed to perform read and write operations on the CXL memory. The processor may return an error instruction to the first subject, and the error instruction is used to indicate that the first subject is not allowed to access the CXL memory.

[0132] In an optional implementation, when the read / write instructions are used to instruct to obtain the first data from the CXL memory, the processor responds to the read / write instructions sent by the first subject to perform read / write operations on the CXL memory, which can be replaced by: responding to a read data instruction sent by the first subject to obtain the first data from the CXL memory to obtain the first data from the CXL memory.

[0133] In the case where the above-mentioned read and write instructions are used to instruct writing the second data into the CXL memory, the above-mentioned processor responds to the read and write instructions sent by the first body to perform read and write operations on the CXL memory, which can be replaced by: responding to the write data instruction sent by the first body to write the second data into the CXL memory, writing the second data into the CXL memory.

[0134] Through the above technical solution, it can be known that only the verified subject (process, application, or computing device) can access the CXL memory. In this way, the phenomenon of unsafe processes accessing the CXL memory can be effectively avoided. In turn, the security of CXL memory access is effectively improved, and the data in the CXL memory is effectively prevented from being leaked.

[0135] In an optional embodiment, Figure 2 The computing cluster shown may also include management computing devices, such as Figure 6 The management computing device 600 shown. The management computing device 600 is used to manage multiple computing devices, such as Figure 6 The first computing device 100 and the second computing device 200 are shown in FIG.

[0136] The management computing device 600 may include a processor 601 and a memory 602. The processor 601 may be a CPU or other components with processing capabilities. The CPU, as the computing and control core of the computing device, is the final execution unit for information processing and program running. The CPU is a large-scale integrated circuit composed of an arithmetic unit, a controller, a register, etc., and its main task is to process and process various data. The memory 602 may be a disk or other memory that stores data and does not lose data after power failure.

[0137] In the embodiment of the present application, the management computing device 600 may store the first corresponding relationship, and accordingly, the processor of the first computing device may obtain the first corresponding relationship from the management computing device.

[0138] The embodiment of the present application does not specifically limit the manner in which the processor of the first computing device obtains the first correspondence from the management computing device. In one example, when the first computing device is started, the processor of the first computing device may obtain the first correspondence from the management computing device. In another example, the processor of the first computing device may periodically obtain the first correspondence from the management computing device.

[0139] The embodiment of the present application does not limit the period for the processor of the first computing device to obtain the first correspondence from the management computing device. For example, the period may be 5 days, that is, the processor of the first computing device may obtain the first correspondence from the management computing device once every 5 days. For another example, the period may be 1 day, that is, the processor of the first computing device may obtain the first correspondence from the management computing device once every 1 day.

[0140] Through the above technical solution, the first corresponding relationship in the first computing device can be updated based on the first corresponding relationship stored in the management computing device, which can avoid leakage of the verification code in the first corresponding relationship, further improve the security of CXL memory access, and avoid leakage of data in the CXL memory.

[0141] The above mainly introduces the memory access method provided by the embodiment of the present application from the perspective of the method. In order to achieve the above functions, the memory access device includes a hardware structure and / or software module corresponding to the execution of each function. Those skilled in the art should easily realize that, in combination with the units and algorithm steps of each example described in the embodiments disclosed herein, the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0142] The embodiment of the present application can exemplarily divide the memory access device into functional modules according to the above method. For example, the memory access device can include various functional modules corresponding to the various functional divisions, or two or more functions can be integrated into one processing module. The above integrated modules can be implemented in the form of hardware or in the form of software functional modules. It should be noted that the division of modules in the embodiment of the present application is schematic and is only a logical functional division. There may be other division methods in actual implementation.

[0143] For example, Figure 7A possible structural diagram of a memory access device (referred to as memory access device 700 ) involved in the above embodiment is shown. The memory access device 700 includes an acquisition unit 701 , a verification unit 702 , and a response unit 703 .

[0144] The acquisition unit 701 is used to acquire, in response to a device access request, a first signature corresponding to a subject that generates the device access request, wherein the subject that generates the device access request includes at least one of a process, an application, or a computing device.

[0145] The verification unit 702 is used to verify the first signature.

[0146] The responding unit 703 is used to respond to the read and write instructions of the CXL memory of the subject that generates the device access request when the first signature verification passes.

[0147] Optionally, the verification unit 702 is specifically used to: obtain a target verification code, and verify the first signature based on the target verification code.

[0148] Optionally, the device access request carries a first signature.

[0149] Optionally, a first correspondence is stored in the first computing device, the first correspondence being used to indicate at least one of a verification code corresponding to a process allowed to access the CXL memory, a verification code corresponding to an application allowed to access the CXL memory, or a verification code corresponding to a computing device allowed to access the CXL memory.

[0150] Optionally, the first corresponding relationship is stored in the kernel space of the first computing device, and the acquisition unit 701 is specifically used to: acquire the first corresponding relationship from the kernel space of the first computing device, and determine the target check code based on the first corresponding relationship.

[0151] Optionally, the first correspondence is stored in the user space of the first computing device. The acquisition unit 701 is specifically used to: acquire the first correspondence from the user space of the first computing device, and determine the target verification code based on the first correspondence. Accordingly, the apparatus also includes a sending unit, and the sending unit is specifically used to: send the target verification code to the kernel space of the first computing device.

[0152] Optionally, when the first computing device is started, the acquiring unit 701 is further configured to: acquire the first corresponding relationship from the management computing device; or periodically acquire the first corresponding relationship from the management computing device.

[0153] The management computing device is used to manage multiple computing devices, and the multiple computing devices include the first computing device.

[0154] Optionally, the verification unit 702 is specifically configured to: determine that the first signature verification passes when the target verification code and the first signature match successfully.

[0155] Optionally, the response unit 703 is specifically configured to: in response to a read data instruction of the subject that generates the device access request, obtain the first data from the CXL memory, the read data instruction is used to instruct to read the first data. Or, in response to a write data instruction of the subject that generates the device access request, write the second data into the CXL memory, the write data instruction is used to instruct to write the second data.

[0156] Optionally, the first signature is a private key and the target verification code is a public key.

[0157] Optionally, both the first computing device and the second computing device are connected to the CXL memory; the subject generating the access request is a target process, which runs in the first computing device, or the target process runs in the second computing device. Alternatively, the subject generating the access request is a target application, which runs in the first computing device, or the target application runs in the second computing device.

[0158] For the specific description of the above optional manner, please refer to the above method embodiment, which will not be repeated here. In addition, the explanation of any memory access device provided above and the description of the beneficial effects can refer to the above corresponding method embodiment, which will not be repeated here.

[0159] An embodiment of the present application also provides a computing device, which includes a processor and a memory, the processor is connected to the memory, the memory stores computer-executable instructions, and the processor implements the memory access method in the above embodiment when executing the computer-executable instructions.

[0160] The embodiments of the present application do not impose any restrictions on the specific form of the computing device. For example, the computing device may be a terminal device or a network device. The terminal device may be referred to as a terminal, a user equipment (UE), a terminal device, an access terminal, a user unit, a user station, a mobile station, a remote station, a remote terminal, a mobile device, a user terminal, a wireless communication device, a user agent or a user device, etc. The terminal device may be a mobile phone, an augmented reality (AR) device, a virtual reality (VR) device, a tablet computer, a laptop computer, an ultra-mobile personal computer (UMPC), a netbook, a personal digital assistant (PDA), etc. The network device may be a server, etc. The server may be a physical or logical server, or may be two or more physical or logical servers that share different responsibilities and cooperate with each other to realize the functions of the server.

[0161] An embodiment of the present application further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed on a computer, the computer is enabled to execute any of the methods executed by the computer devices provided above.

[0162] For the explanation of the relevant contents and description of the beneficial effects of any of the above-mentioned computer-readable storage media, reference may be made to the above-mentioned corresponding embodiments, which will not be repeated here.

[0163] The embodiment of the present application also provides a chip. The chip integrates a control circuit and one or more ports for realizing the functions of the above-mentioned computer device. Optionally, the functions supported by the chip can be referred to above and will not be repeated here. A person of ordinary skill in the art can understand that all or part of the steps of implementing the above-mentioned embodiment can be completed by instructing the relevant hardware through a program. The program can be stored in a computer-readable storage medium. The storage medium mentioned above can be a read-only memory, a random access memory, etc. The above-mentioned processing unit or processor can be a central processing unit, a general-purpose processor, an application specific integrated circuit (ASIC), a microprocessor (digital signal processor, DSP), a field programmable gate array (field programmable gatearray, FPGA) or other programmable logic devices, transistor logic devices, hardware components or any combination thereof.

[0164] The embodiment of the present application also provides a computer program product including instructions, when the instructions are run on a computer, the computer executes any one of the methods in the above embodiments. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on the computer, the process or function according to the embodiment of the present application is generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions may be transmitted from a website site, a computer, a server, or a data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means to another website site, computer, server, or data center. The computer-readable storage medium may be any available medium that a computer can access or a data storage device such as a server or a data center that includes one or more servers that can be integrated with the medium. The available medium may be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., an SSD), etc.

[0165] It should be noted that the above-mentioned devices for storing computer instructions or computer programs provided in the embodiments of the present application, such as but not limited to the above-mentioned memories, computer-readable storage media and communication chips, etc., are all non-transitory.

[0166] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using a software program, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When loading and executing computer program instructions on a computer, the process or function according to the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. Computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, computer instructions can be transmitted from a website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (digital subscriber line, DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server, data center, etc. that contains one or more servers that can be integrated with a medium. The available medium may be a magnetic medium (eg, a floppy disk, a hard disk, a magnetic tape), an optical medium (eg, a DVD), or a semiconductor medium (eg, a solid state disk (SSD)).

[0167] Although the present application is described herein in conjunction with various embodiments, in the process of implementing the claimed application, those skilled in the art may understand and implement other changes to the disclosed embodiments by viewing the drawings, the disclosure, and the appended claims. In the claims, the word "comprising" does not exclude other components or steps, and "one" or "an" does not exclude multiple situations. A single processor or other unit may implement several functions listed in the claims. Certain measures are recorded in different dependent claims, but this does not mean that these measures cannot be combined to produce good results.

[0168] Although the present application has been described in conjunction with specific features and embodiments thereof, it is obvious that various modifications and combinations may be made thereto without departing from the spirit and scope of the present application. Accordingly, this specification and the drawings are merely exemplary illustrations of the present application as defined by the appended claims, and are deemed to have covered any and all modifications, variations, combinations or equivalents within the scope of the present application. Obviously, those skilled in the art may make various modifications and variations to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A memory access method, characterized in that: A processor applied to a first computing device, the method comprising: In response to a device access request, obtaining a first signature corresponding to a subject that generates the device access request; the subject that generates the device access request includes at least one of a process, an application, or a computing device; Verifying the first signature; In the case where the first signature verification passes, the read and write instructions of the computing fast link CXL memory to the subject that generates the device access request are responded to.

2. The method according to claim 1, characterized in that: The verifying the first signature includes: Get the target verification code; The first signature is verified based on the target verification code.

3. The method according to claim 2, characterized in that The device access request carries the first signature.

4. The method according to claim 2, characterized in that: The first computing device stores a first corresponding relationship, where the first corresponding relationship is used to indicate at least one of the following: A checksum corresponding to the process that is allowed to access the CXL memory; A verification code corresponding to an application that is allowed to access the CXL memory; A verification code corresponding to a computing device that is allowed to access the CXL memory.

5. The method according to claim 4, characterized in that The first corresponding relationship is stored in the kernel space of the first computing device; The obtaining of the target verification code comprises: Acquire the first corresponding relationship from the kernel space of the first computing device; Based on the first corresponding relationship, the target check code is determined.

6. The method according to claim 4, characterized in that The first corresponding relationship is stored in a user space of the first computing device; The obtaining of the target verification code comprises: Acquire the first corresponding relationship from the user space of the first computing device; Based on the first corresponding relationship, determining the target check code; The method further comprises: The target verification code is sent to a kernel space of the first computing device.

7. The method according to any one of claims 4 to 6, characterized in that: When the first computing device is started, the first corresponding relationship is obtained from a management computing device; or, the first corresponding relationship is periodically obtained from a management computing device; wherein the management computing device is used to manage multiple computing devices, and the multiple computing devices include the first computing device.

8. The method according to any one of claims 2 to 6, characterized in that: The verifying the first signature based on the target verification code includes: If the target verification code and the first signature match successfully, it is determined that the first signature verification passes.

9. The method according to claim 1, characterized in that: The response generates a read and write instruction of the CXL memory by the subject of the device access request, including: In response to a read data instruction of a subject generating the device access request, obtaining first data from the CXL memory; the read data instruction is used to instruct to read the first data; or, In response to a write data instruction of the subject that generates the device access request, second data is written into the CXL memory; the write data instruction is used to instruct the writing of the second data.

10. The method according to claim 2, characterized in that The first signature is a private key, and the target verification code is a public key.

11. The method according to claim 1, characterized in that The first computing device and the second computing device are both connected to the CXL memory; The subject that generates the access request is a target process; the target process runs in the first computing device, or the target process runs in a second computing device; or, The subject generating the access request is a target application; The target application runs in the first computing device, or the target application runs in a second computing device.

12. A computing device, characterized in that: include: Processor and memory; The processor is connected to the storage, and the processor is connected to the CXL memory; The memory is used to store computer-executable instructions, and the processor executes the computer-executable instructions stored in the memory to enable the computer device to implement the method according to any one of claims 1 to 11.

Images