CXL secure access and caching optimization methods, devices, electronic devices and storage media

Abstract

This invention belongs to the field of computer science. It provides a method, apparatus, electronic device, and storage medium for secure access and caching optimization in CXL (Continuous Large Scale) computing. The method includes: acquiring real Flit data from the transmission initiator; generating a unique encryption key for each real Flit data using an encryption algorithm and a synchronization counter to obtain encrypted real Flit data; detecting the traffic difference and load of the CXL channel transmitting the encrypted real Flit data; dynamically inserting virtual Flit data into the CXL channel based on the traffic difference and load; intercepting real Flit data written to memory that meets a preset access frequency; writing the real Flit data to a free cache area; and further writing the real Flit data to memory based on the mapping relationship between the free cache area and physical page addresses. The beneficial effects of this invention are: improved access security and caching performance for CXL computing.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer technology, and in particular to a CXL secure access and cache optimization method and device, electronic equipment and storage medium. BACKGROUND

[0002] With the continuous growth of data scale and the increasing complexity of computing demand, traditional data center architecture is facing unprecedented challenges. In the context of the rapid development of artificial intelligence and machine learning applications, the existing computing system gradually shows bottlenecks in memory bandwidth, storage access efficiency and resource utilization, etc. Although the introduction of technologies such as Non-Volatile Memory Host Controller Interface has significantly improved storage performance, there is still a performance gap between processors and accelerators, memories and storage, especially in large-scale model training and high-performance computing scenarios.

[0003] As a new generation of high-speed interconnection standard, Compute Express Link (CXL) not only inherits the high-bandwidth characteristics of Peripheral Component Interconnect Express (PCIe), but also realizes transparent access and efficient sharing of device memory through innovative protocol design. The emergence of this technology marks an important turning point in the evolution of computing architecture, enabling CPU, GPU, FPGA and other heterogeneous computing units to work together with unprecedented efficiency, while providing a standardized implementation solution for memory expansion and resource pooling.

[0004] In an environment where memory resources are shared, CXL links also face challenges in data security. If the data transmitted on the link lacks protection, it is vulnerable to eavesdropping, tampering or replay attacks, which can lead to the destruction of confidentiality and integrity. Especially in the context of artificial intelligence and high-performance computing, data traffic is huge and frequent, and once a leak occurs, it will have a serious impact on system security and application reliability.

[0005] Although CXL technology provides an efficient memory sharing mechanism, there is still a certain delay in memory access. In order to reduce this delay, DRAM cache is usually used to accelerate data access. The role of cache is to reduce the time of accessing memory, thereby improving system performance. However, cache partition isolation problems can cause additional performance loss. In CXL technology, different security domains are usually isolated through cache partitioning to ensure the security of memory access between devices. Although this isolation mechanism can provide necessary security guarantees, it may also cause cache conflicts and cache misses, leading to performance degradation. Especially in the case of high concurrency access and large-scale data exchange, frequent cache invalidation may become a performance bottleneck. SUMMARY

[0006] Aimed at at least in solving one of the technical problems existing in the prior art, the present invention provides a CXL secure access and caching optimization method, apparatus, electronic device and storage medium, which improves access security and caching performance for CXL.

[0007] One aspect of the present invention provides a CXL secure access and caching optimization method, comprising:

[0008] Obtain the real Flit data from the transmission initiator, and generate a unique encryption key for each real Flit data using an encryption algorithm and a synchronization counter to obtain encrypted real Flit data.

[0009] The flow difference and load of the CXL channel transmitting encrypted real Flit data are detected, and virtual Flit data is dynamically inserted into the CXL channel according to the flow difference and load of the CXL channel.

[0010] Real Flit data that meets the preset access frequency and is to be written to memory is written to the free cache area. Based on the mapping relationship between the free cache area and the physical page address, the real Flit data that meets the preset access frequency is written to memory.

[0011] According to the CXL secure access and caching optimization method, the real Flit data from the transmission initiator is obtained, and a unique key is generated for each real Flit data using an encryption algorithm and a synchronization counter to obtain encrypted real Flit data, including:

[0012] The header information and all data slots of the real Flit data are encrypted using the AES-GCM algorithm. A first message authentication code is generated by a synchronization counter and added to the real Flit data to obtain a unique encryption key. The encryption process is completed at the link layer.

[0013] The encrypted real Flit data is determined by using a unique encryption key and the real Flit data.

[0014] According to the CXL secure access and caching optimization method, the method further includes:

[0015] The encrypted real Flit data is received by the physical layer of the transmitting end, and the encrypted real Flit data is decrypted to obtain the real Flit data.

[0016] The second message authentication code is obtained by recalculating using a synchronization counter set at the transmitting and receiving end. It is then checked whether the second message authentication code conforms to the monotonically increasing expectation of the first message authentication code. If it does not conform, the real Flit data is discarded; otherwise, the real Flit data is restored.

[0017] According to the CXL secure access and caching optimization method, the method further includes:

[0018] The first message authentication codes from multiple real Flit data are aggregated during transmission.

[0019] According to the CXL secure access and caching optimization method, the method involves detecting the traffic difference and load of the CXL channel transmitting encrypted real Flit data, and dynamically inserting virtual Flit data into the CXL channel based on the traffic difference and load, including:

[0020] The flow difference and load of the bidirectional traffic of the CXL channel are detected. If the flow difference of the bidirectional traffic is greater than a preset threshold, the virtual Flit data is inserted on the side with the lower flow value so that the flow difference of the bidirectional traffic is less than or equal to the preset threshold.

[0021] If the load is greater than the preset threshold, virtual Flit data is inserted into the CXL channel according to the first insertion rule; if the load is less than or equal to the preset threshold, virtual Flit data is inserted into the CXL channel according to the second insertion rule.

[0022] Before writing virtual or real Flit data into memory, obtain the header information and determine whether it is virtual or real Flit data based on the header information. If it is virtual Flit data, discard it. Virtual Flit data does not include the payload, and the encryption method of virtual Flit data is the same as that of real Flit data.

[0023] According to the CXL secure access and cache optimization method, the real Flit data to be written to memory and meeting a preset access frequency is written to a free cache area. Based on the mapping relationship between the free cache area and the physical page address, the real Flit data meeting the preset access frequency is written to memory, including:

[0024] Obtain allocation requests for standard physical pages containing actual Flit data that are to be written to memory and meet the preset access frequency;

[0025] Select an unoccupied cache location from DRAM, allocate a physical page address in persistent memory according to the cache location, and write the actual Flit data that meets the preset access frequency according to the physical page address.

[0026] According to the CXL secure access and caching optimization method, the method further includes:

[0027] Obtain the memory access patterns in the security domain, including access frequency and read / write counts. Divide standard physical pages into cold pages and hot pages based on access frequency and read / write counts.

[0028] If a cache conflict occurs between hot pages in different security domains, the conflicting hot pages will be remapped to an unoccupied cache location in DRAM. A cache conflict is used to indicate that hot pages in at least two security domains are mapped to the same cache location.

[0029] Another aspect of the present invention provides a CXL secure access and cache optimization apparatus, comprising:

[0030] The first module is used to obtain the real Flit data from the transmission initiator. For each real Flit data, an encryption algorithm and a synchronization counter are used to generate a unique encryption key to obtain encrypted real Flit data.

[0031] The second module is used to detect the traffic difference and load of the CXL channel that transmits encrypted real Flit data, and dynamically insert virtual Flit data into the CXL channel according to the traffic difference and load of the CXL channel.

[0032] The third module is used to write real Flit data that meets the preset access frequency to memory into the free cache area. Based on the mapping relationship between the free cache area and the physical page address, the real Flit data that meets the preset access frequency is written into memory.

[0033] Another aspect of the present invention provides an electronic device, including a processor and a memory;

[0034] The memory is used to store programs;

[0035] The processor executes the program to implement the method as described above.

[0036] This invention also discloses a computer program product or computer program, which includes computer instructions stored in a computer-readable storage medium. A processor of a computer device can read the computer instructions from the computer-readable storage medium and execute the computer instructions, causing the computer device to perform the methods described above.

[0037] The beneficial effects of this invention are as follows: All Flits are fully encrypted, including header information and all data slots, ensuring that different ciphertexts are generated even when transmitting the same data; the encryption process is completed at the link layer, guaranteeing both data transmission security and maintaining physical layer transmission efficiency; based on real-time monitoring of the CXL communication channel's transmission load, on-demand filling is achieved by dynamically adjusting the insertion frequency of virtual Flits. The number of virtual Flits is reduced under low load conditions, minimizing resource waste; sufficient obfuscation strength is maintained under high load conditions to achieve access mode obfuscation and improve access security. The operating system kernel memory management subsystem is modified, transforming the traditional on-demand allocation mode into a cache-driven allocation mode, achieving a one-to-one mapping between DRAM cache and persistent memory physical pages. Combined with static page-oriented allocation and runtime dynamic hot page remapping mechanisms, the rational utilization of cache space is achieved. Attached Figure Description

[0038] Figure 1 This is a schematic diagram of CXL data transmission.

[0039] Figure 2 This is a schematic diagram of the CXL secure access and caching optimization method according to an embodiment of the present invention.

[0040] Figure 3 This is a schematic diagram of the actual Flit data encryption process in an embodiment of the present invention.

[0041] Figure 4 This is a schematic diagram of the actual Flit data decryption process in an embodiment of the present invention.

[0042] Figure 5 This is a schematic diagram of the dynamic insertion of fake Flit data according to an embodiment of the present invention.

[0043] Figure 6 This is a schematic diagram of the actual Flit data writing process in an embodiment of the present invention.

[0044] Figure 7 This is a schematic diagram of the cache conflict handling process according to an embodiment of the present invention.

[0045] Figure 8 This is a schematic diagram of the CXL secure access and cache optimization device according to an embodiment of the present invention. Detailed Implementation

[0046] The embodiments of the present invention are described in detail below, examples of which are shown in the accompanying drawings. Throughout the description, the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions. In the following description, suffixes such as "module," "part," or "unit" used to denote elements are used only for the purpose of illustrative purposes and have no specific meaning in themselves. Therefore, "module," "part," or "unit" can be used interchangeably. Terms such as "first," "second," etc., are used only to distinguish technical features and should not be construed as indicating or implying relative importance, or implicitly indicating the number of indicated technical features, or implicitly indicating the sequential relationship of the indicated technical features. In the following description, the consecutive reference numerals for method steps are for ease of review and understanding. Adjusting the implementation order of steps, in conjunction with the overall technical solution of the present invention and the logical relationship between the various steps, will not affect the technical effect achieved by the technical solution of the present invention. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present invention, and should not be construed as limiting the present invention.

[0047] refer to Figure 1 The diagram illustrates CXL data transmission. CXL data transmission uses the AES-GCM algorithm for Flit encryption and authentication. The encryption process requires plaintext data, Additional Authentication Data (AAD), and an Initialization Vector (IV). The 4-byte Flit header contained in the header slot is used as the AAD. The counter in the IV monotonically increments with each Flit encryption, effectively preventing IV reuse. All content except the Flit header is encrypted to ensure confidentiality. Simultaneously, the MAC generated by AES-GCM provides integrity protection for the Flit.

[0048] CXL IDE provides a key initialization and refresh mechanism. The key becomes effective after device authentication and exchange, and data loss must be ensured during the refresh process. Its operating modes include:

[0049] (1) Containment mode: Data is released after integrity verification, which is highly secure but increases latency;

[0050] (2) Skid mode: Releases data before verification is completed. It has low latency but requires the upper layer to tolerate the risk of attack.

[0051] Regarding error handling, the IDE does not alter the link CRC and retransmission procedures. When an integrity check fails or the MAC header is abnormal, the device must log the error, send a protocol signal, and discard the relevant data to prevent key and data leakage.

[0052] The detailed steps are shown in steps (1) to (6) below:

[0053] (1) IDE streams are established between ports through discovery, negotiation and device authentication to complete key distribution and initialization vector (IV) settings.

[0054] (2) Protocol data is processed in units of Flit. The Flit packet header is mapped to Additional Authentication Data (AAD) for integrity protection only, while the data portion is mapped to plaintext and encrypted with AES-GCM.

[0055] (3) Integrity protection of encrypted data is achieved through MAC and PCRC mechanisms. Multiple Flits can be aggregated into a single MAC_Epoch, and the MAC value is calculated uniformly within this range.

[0056] (4) Select the mode to run, which requires all Flits to pass integrity verification before they can be released. Aggregated Flits that arrive early need to wait for the corresponding communication MAC to complete the verification; or allow Flits to be processed immediately upon arrival without waiting for MAC verification.

[0057] (5) During link transmission, the IDE supports periodic key refresh to ensure security and ensure that data is not lost during the refresh process.

[0058] (6) When the integrity check fails or the MAC header is abnormal, the device records the error status, sends a protocol signal, and discards the relevant data stream to prevent key or user data leakage.

[0059] refer to Figure 2 ,in Figure 2 This is a schematic flowchart of the CXL secure access and caching optimization method according to an embodiment of the present invention, which includes, but is not limited to, steps S100-S300:

[0060] S100: Obtain the real Flit data from the transmission initiator, and generate a unique encryption key for each real Flit data using an encryption algorithm and a synchronization counter to obtain encrypted real Flit data.

[0061] It should be noted that Flit refers to real Flit data, while virtual Flit refers to virtual Flit data;

[0062] In some embodiments, reference Figure 3 The diagram shown illustrates the actual Flit data encryption process, which includes, but is not limited to, steps S110-S120:

[0063] S110 encrypts the header information and all data slots of the real Flit data using the AES-GCM algorithm, and generates the first message authentication code through the synchronization counter and adds it to the real Flit data to obtain a unique encryption key. The encryption process is completed at the link layer.

[0064] S120 uses a unique encryption key and the actual Flit data to determine the encrypted actual Flit data.

[0065] In some embodiments, reference Figure 4 The diagram shown illustrates the actual Flit data decryption process, which includes, but is not limited to, steps S130-S140:

[0066] S130: Receive encrypted real Flit data through the physical layer of the receiving end, decrypt the encrypted real Flit data, and obtain the real Flit data;

[0067] S140: The second message authentication code is obtained by recalculating the synchronization counter set at the receiving end. The second message authentication code is checked to see if it meets the monotonically increasing expectation of the first message authentication code. If it does not meet the expectation, the real Flit data is discarded; otherwise, the real Flit data is restored.

[0068] Although not explicitly stated, embodiments of the present invention also include a situation where, if the decryption of encrypted real Flit data fails, the corresponding encrypted real Flit data is considered to be attacked or tampered data.

[0069] In some embodiments, the method further includes aggregating the first message authentication codes from multiple real Flit data during transmission.

[0070] In some embodiments, the overall process of encrypting and decrypting Flit data is as follows (1) to (6):

[0071] (1) At the transmission initiator (e.g., CPU), data and control information are packaged into Flits. Unlike traditional schemes, this method performs full Flit encryption (including header and data slots). This encryption uses the AES-GCM algorithm and is combined with a monotonically increasing synchronization counter to ensure that each Flit uses a unique key, so that different ciphertexts can be generated even when transmitting the same content.

[0072] (2) During encryption, a message authentication code (MAC) is generated for each Flit based on a synchronization counter, and this MAC is appended to the Flit. This MAC is used for integrity verification at the receiving end. To improve transmission efficiency, this method also supports aggregating the MACs of multiple Flits to reduce the bandwidth overhead caused by security mechanisms.

[0073] (3) The Flit containing the encryption and authentication information is sent to the target device via the CXL physical layer.

[0074] (4) After the physical layer of the receiving end receives Flit, the transmission module first decrypts it and restores its original content.

[0075] (5) After decryption, the receiving module performs dual verification. First, it recalculates the MAC based on the local synchronization counter and compares it with the MAC received on the Flit to verify the integrity of the data. Second, the receiving module checks whether the counter value of the Flit conforms to the expected monotonically increasing trend. Any mismatch in the counter will be identified by the system as a replay attack or data tampering, and the Flit will be discarded immediately.

[0076] (6) If Flit passes the integrity verification, it will be successfully unpacked and the original commands and data will be restored for further processing by the receiving end.

[0077] The method of this invention ensures the security of the CXL link while taking into account transmission efficiency, and can effectively reduce the performance overhead of security mechanisms while preventing eavesdropping, tampering and replay attacks.

[0078] S200 detects the traffic difference and load of the CXL channel transmitting encrypted real Flit data, and dynamically inserts virtual Flit data into the CXL channel according to the traffic difference and load of the CXL channel.

[0079] In some embodiments, reference Figure 5 The diagram shown illustrates the process of dynamically inserting spurious Flit data, which includes, but is not limited to, steps S210 to S230:

[0080] S210, detects the flow difference and load of the bidirectional traffic of the CXL channel;

[0081] S220, if the flow difference between the two-way flows is greater than a preset threshold, insert virtual Flit data on the side with the lower flow value so that the flow difference between the two-way flows is less than or equal to the preset threshold.

[0082] S230, if the load is greater than the preset threshold, insert virtual Flit data into the CXL channel according to the first insertion rule; if the load is less than or equal to the preset threshold, insert virtual Flit data into the CXL channel according to the second insertion rule.

[0083] S240: Before writing virtual Flit data or real Flit data into memory, obtain header information and determine whether it is virtual Flit data or real Flit data based on the header information. If it is virtual Flit data, discard it. Virtual Flit data does not include a payload, and the encryption method of virtual Flit data is the same as that of real Flit data. In some embodiments, the preset threshold is customized according to the scenario, such as a preset threshold of 80%.

[0084] In some embodiments, for the bidirectional traffic difference, such as data interaction between the CPU and DRAM, where the traffic from the CPU to DRAM is one direction and the traffic from DRAM to the CPU is the other direction, then the bidirectional traffic difference is... The calculation method is as follows:

[0085] ;

[0086] in, and It is bidirectional traffic.

[0087] In some embodiments, dynamically inserting dummy flits leverages the fixed-size characteristic of CXL flits to intelligently insert virtual flits when the channel is idle, maintaining a balanced number of flits for bidirectional transmission. These virtual flits are also rigorously encrypted and completely indistinguishable from real flits. This design ensures both the obfuscation of access patterns and avoids the bandwidth waste problem associated with traditional padding schemes.

[0088] The process of dynamically inserting fake Flits is shown in (1) to (5):

[0089] (1) Integrate a load test unit into the CXL controller, pre-set a load threshold, and monitor bidirectional traffic on the CXL channel. Analyze the traffic patterns and rates to identify time periods when the channel may be idle or when there is a situation where traffic in one direction is significantly less than in the other direction.

[0090] (2) Compare the real-time monitored load value with the preset threshold (load threshold).

[0091] If the channel load is below the threshold (e.g., bandwidth utilization ≤ 80%), it enters low load mode; if the channel load is above the threshold (e.g., bandwidth utilization > 80%), it enters high load mode.

[0092] (3) Virtual Flit generation and encryption: In low-load mode, the system inserts virtual Flits on demand. In this mode, virtual Flits are only inserted when needed (e.g., for hidden access mode) (i.e., the second insertion rule), thereby minimizing unnecessary overhead.

[0093] In high-load mode, the system forcibly inserts the minimum necessary virtual Flits to ensure basic obfuscation strength. In this mode, predefined rules (i.e., the first insertion rule) can be used, such as forcibly inserting 1 virtual Flit for every N real Flits sent, thereby ensuring obfuscation effect while avoiding serious bandwidth overhead caused by over-padding.

[0094] The generation process for these virtual Flits is similar to that of real Flits, but they do not carry any meaningful payload. After generation, these virtual Flits undergo the same rigorous encryption process as real Flits.

[0095] (4) The encrypted virtual Flit is dynamically inserted into the idle time period of the channel. Taking advantage of the fixed size of CXLFlit, it is precisely filled into the idle slots of the channel. In this way, the virtual Flit is mixed with the real Flit, forming a seemingly continuous and balanced traffic flow, thus blurring the real request pattern. Since the insertion is performed when the channel is idle, it does not affect the transmission delay of normal requests.

[0096] (5) Before writing a Flit to memory, the system will determine whether it is a virtual Flit based on the header information of the Flit. If it is, the system will discard the Flit directly and not write it to memory in order to avoid occupying valuable storage resources and reduce unnecessary processing overhead.

[0097] In order to prevent attackers from inferring access patterns through traffic differences, embodiments of the present invention increase the dynamic insertion of virtual Flits, while also reducing the bandwidth overhead caused by virtual Flits.

[0098] S300 writes the real Flit data that meets the preset access frequency to memory into the free cache area, and writes the real Flit data that meets the preset access frequency into memory according to the mapping relationship between the free cache area and the physical page address.

[0099] In some embodiments, reference Figure 6 The diagram shown illustrates the actual Flit data writing process to memory, which includes, but is not limited to, steps S310~S320:

[0100] S310: Obtain the allocation request for a standard physical page of real Flit data that is to be written to memory and meets the preset access frequency;

[0101] S320 selects an unoccupied cache location from DRAM, allocates a physical page address in persistent memory according to the cache location, and writes the actual Flit data that meets the preset access frequency according to the physical page address.

[0102] It should be noted that the real Flit data that meets the preset access frequency is the real Flit data that is accessed frequently.

[0103] In some embodiments, reference Figure 7 The schematic diagram of the cache conflict handling process shown includes, but is not limited to, steps S330 to S340:

[0104] S330: Obtain the memory access pattern in the security domain. The access pattern includes the access frequency and the number of read / write operations. Based on the access frequency and the number of read / write operations, the standard physical page is divided into cold pages and hot pages.

[0105] S340, if a cache conflict occurs between hot pages in different security domains, the conflicting hot pages are remapped to an unoccupied cache location in DRAM, wherein a cache conflict is used to indicate that hot pages in at least two security domains are mapped to the same cache location.

[0106] While DRAM caching can alleviate memory access latency, the cache partitioning mechanism introduced to achieve multi-security domain isolation can incur significant performance overhead. Although this security isolation mechanism ensures the safety of memory access between devices, it inevitably introduces cache conflicts and reduced hit rates. Especially in high-concurrency scenarios, frequent cache misses not only negate the benefits of caching acceleration but can also become a critical bottleneck restricting overall system performance. These issues highlight the need for a more refined balance between security protection and performance optimization in the CXL architecture design.

[0107] This invention employs a heterogeneous memory secure cache management method for virtualized or multi-tenant environments. This method combines static page allocation and dynamic hot page remapping techniques to fundamentally solve cache conflict problems while enhancing the security and efficiency of memory access. The secure cache management process for heterogeneous memory systems includes the following steps (1) to (6):

[0108] (1) Modify the memory management subsystem of the operating system kernel. Specifically, we intercept standard physical page allocation requests, such as when handling "page.fault" interrupts or calling functions like "page_umap", instead of having them handled directly by the kernel's regular allocator. This interception allows us to customize the physical page allocation logic, transforming the traditional "on-demand allocation" into a "cache location-driven" allocation mode, laying the foundation for subsequent direct mapping.

[0109] (2) Upon receiving a physical page allocation request, the system does not immediately search for available space in persistent memory (PMEM). Instead, it first searches for a cache location in DRAM, which serves as an L4 cache, that is not currently occupied by any data. This location can be one or more contiguous cache lines. The system quickly identifies free locations by querying a specially maintained cache status table or using a hardware bitmap, thereby ensuring that new physical pages have dedicated cache space.

[0110] (3) Once a free cache location is determined in DRAM, the system will allocate a physical page address in persistent memory (PMEM). The choice of this address is carefully calculated to ensure that when this PMEM physical page is mapped to DRAM, its contents will fall directly and precisely into the free cache location found in the previous step. Through this reverse allocation method from "cache to memory", we have achieved a one-to-one mapping between DRAM cache and PMEM physical pages, fundamentally eliminating static cache conflicts caused by address hash collisions.

[0111] (4) To cope with dynamically changing workloads during runtime, this invention deploys a lightweight monitoring unit that combines hardware and software. This unit continuously monitors the memory access patterns of each security domain (such as different virtual machines or containers) during system runtime. By tracking metrics such as access frequency and read / write counts, the system can mark frequently accessed pages as "hot pages" and less frequently accessed pages as "cold pages" in real time. This distinction is dynamic and updates according to changes in the actual workload.

[0112] (5) The monitoring unit analyzes existing mapping relationships and access patterns in real time. When it detects two or more "hot pages" with high access frequency from different security domains being unexpectedly mapped to the same DRAM cache location, a cache conflict occurs. This conflict is often dynamically generated because although there is no conflict during static allocation, the competition for access to the same cache location becomes intense as different tasks are executed in parallel. The monitoring unit will immediately issue a conflict warning and trigger the next remapping process.

[0113] (6) Upon detecting a hot page conflict, the system initiates a dynamic remapping process. It selects one of the conflicting "hot pages" and transparently migrates it to a new, currently non-conflicting DRAM cache location. This process is invisible to the application and does not cause task interruption. Through this dynamic adjustment, the system not only mitigates the performance degradation caused by cache contention but also further enhances cross-domain memory access isolation by isolating hot pages from different security domains, effectively defending against security threats such as side-channel attacks.

[0114] Figure 8 This is a schematic diagram of a CXL secure access and cache optimization device according to an embodiment of the present invention. The device includes a first module 810, a second module 820, and a third module 830.

[0115] The system comprises three modules: a first module for acquiring real Flit data from the transmission initiator, generating a unique encryption key for each real Flit data using an encryption algorithm and a synchronization counter, and obtaining encrypted real Flit data; a second module for detecting the traffic difference and load of the CXL channel transmitting encrypted real Flit data, and dynamically inserting virtual Flit data into the CXL channel based on the traffic difference and load; and a third module for writing real Flit data that meets the preset access frequency to memory into a free buffer area, and writing real Flit data that meets the preset access frequency into memory based on the mapping relationship between the free buffer area and the physical page address.

[0116] For example, with the cooperation of the first, second, and third modules in the device, the embodiment device can implement any of the aforementioned CXL secure access and cache optimization methods, namely, acquiring the real Flit data from the transmission initiator, generating a unique encryption key for each real Flit data using an encryption algorithm and a synchronization counter to obtain encrypted real Flit data; detecting the traffic difference and load of the CXL channel transmitting the encrypted real Flit data, and dynamically inserting virtual Flit data into the CXL channel according to the traffic difference and load of the CXL channel; writing real Flit data to be written to memory and meeting the preset access frequency into the free cache area, and writing real Flit data meeting the preset access frequency into memory according to the mapping relationship between the free cache area and the physical page address. The beneficial effects of the present invention are: full encryption of all Flits, including header information and all data slots, ensures that different ciphertexts are generated even if the same data is transmitted; the encryption process is completed at the link layer, which not only ensures the security of data transmission but also maintains the transmission efficiency of the physical layer; based on real-time monitoring of the transmission load of the CXL communication channel, on-demand filling is achieved by dynamically adjusting the insertion frequency of virtual Flits. To reduce resource waste under low load conditions, the number of virtual flits is reduced; under high load conditions, sufficient obfuscation strength is maintained to improve access security. The operating system kernel memory management subsystem is modified to transform the traditional on-demand allocation mode into a cache-driven allocation mode, realizing a one-to-one mapping between DRAM cache and persistent memory physical pages. Combined with the mechanism of static page-oriented allocation and runtime dynamic hot page remapping, the rational utilization of cache space is achieved.

[0117] This invention also provides an electronic device, which includes a processor and a memory;

[0118] The memory stores the program;

[0119] The processor executes a program to perform the aforementioned CXL secure access and cache optimization method; the electronic device has the function of carrying and running the CXL secure access and cache optimization software system provided in the embodiments of the present invention, such as a personal computer, minicomputer, mainframe, workstation, network or distributed computing environment, standalone or integrated computer platform, or communicating with charged particle tools or other imaging devices, etc.

[0120] This invention also provides a computer-readable storage medium storing a program that is executed by a processor to implement the CXL secure access and cache optimization method described above.

[0121] In some alternative embodiments, the functions / operations mentioned in the block diagrams may not occur in the order shown in the operation diagrams. For example, depending on the functions / operations involved, two consecutively shown blocks may actually be executed substantially simultaneously, or the blocks may sometimes be executed in reverse order. Furthermore, the embodiments presented and described in the flowcharts of this invention are provided by way of example to provide a more comprehensive understanding of the technology. The disclosed methods are not limited to the operations and logic flows presented in the embodiments of this invention. Alternative embodiments are contemplated, in which the order of various operations is changed and sub-operations described as part of a larger operation are executed independently.

[0122] This invention also discloses a computer program product or computer program, which includes computer instructions stored in a computer-readable storage medium. A processor of a computer device can read the computer instructions from the computer-readable storage medium and execute the computer instructions, causing the computer device to perform the aforementioned CXL secure access and cache optimization method.

[0123] Furthermore, although the invention has been described in the context of functional modules, it should be understood that, unless otherwise stated, one or more of the described functions and / or features may be integrated into a single physical device and / or software module, or one or more functions and / or features may be implemented in a separate physical device or software module. It is also understood that a detailed discussion of the actual implementation of each module is unnecessary for understanding the invention. Rather, considering the properties, functions, and internal relationships of the various functional modules in the apparatus disclosed in the embodiments of the invention, the actual implementation of the module will be understood within the scope of conventional skill of an engineer. Therefore, those skilled in the art can implement the invention as set forth in the claims using ordinary techniques without excessive experimentation. It is also understood that the specific concepts disclosed are merely illustrative and are not intended to limit the scope of the invention, which is determined by the full scope of the appended claims and their equivalents.

[0124] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this invention, essentially, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0125] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (such as a computer-based system, a processor-included system, or other system that can fetch and execute instructions from, an instruction execution system, apparatus, or device). For the purposes of this specification, "computer-readable medium" can be any means that can include, store, communicate, propagate, or transmit programs for use by, or in conjunction with, an instruction execution system, apparatus, or device.

[0126] More specific examples of computer-readable media (a non-exhaustive list) include: electrical connections (electronic devices) having one or more wires, portable computer disk drives (magnetic devices), random access memory (RAM), read-only memory (ROM), erasable and editable read-only memory (EPROM or flash memory), fiber optic devices, and portable optical disc read-only memory (CDROM). Furthermore, computer-readable media can even be paper or other suitable media on which the program can be printed, because the program can be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, interpreting, or otherwise processing as necessary, and then stored in computer memory.

[0127] It should be understood that various parts of the present invention can be implemented in hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented in software or firmware stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware, as in another embodiment, it can be implemented using any one or a combination of the following techniques known in the art: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), etc.

[0128] In the description of this specification, references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0129] Although embodiments of the invention have been shown and described, those skilled in the art will understand that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the claims and their equivalents.

[0130] The above is a detailed description of the preferred embodiments of the present invention, but the present invention is not limited to the embodiments described. Those skilled in the art can make various equivalent modifications or substitutions without departing from the spirit of the present invention, and these equivalent modifications or substitutions are all included within the scope defined by the claims of this application.

Claims

1. A method for CXL secure access and cache optimization, comprising: The method comprises: obtaining real Flit data of a transmission initiator, generating a unique encryption key for each real Flit data by using an encryption algorithm and a synchronous counter, and obtaining encrypted real Flit data; detecting the traffic difference and load of a CXL channel transmitting the encrypted real Flit data, and dynamically inserting virtual Flit data in the CXL channel according to the traffic difference and load of the CXL channel; writing real Flit data that meets a preset access frequency into an idle cache area, and writing the real Flit data that meets the preset access frequency into a memory according to a mapping relationship between the idle cache area and a physical page address; The method further comprises: detecting the traffic difference and load of a CXL channel transmitting the encrypted real Flit data, and dynamically inserting virtual Flit data in the CXL channel according to the traffic difference and load of the CXL channel; detecting the traffic difference and load of bidirectional traffic of the CXL channel, and inserting the virtual Flit data in the side with lower traffic value when the traffic difference of the bidirectional traffic is greater than a preset threshold, so that the traffic difference of the bidirectional traffic is less than or equal to the preset threshold; inserting the virtual Flit data in the CXL channel according to a first insertion rule when the load is greater than a preset threshold; inserting the virtual Flit data in the CXL channel according to a second insertion rule when the load is less than or equal to the preset threshold; 2. The CXL secure access and cache optimization method of claim 1, wherein, obtaining header information before writing the virtual Flit data or the real Flit data into the memory, determining one of the virtual Flit data and the real Flit data according to the header information, and discarding the virtual Flit data, wherein the virtual Flit data does not include a payload, and the encryption mode of the virtual Flit data is consistent with that of the real Flit data. The method further comprises: encrypting the header information and all data slots of the real Flit data by using an AES-GCM algorithm, generating a first message authentication code by using a synchronous counter, and adding the first message authentication code to the real Flit data to obtain a unique encryption key, wherein the encryption process is completed at a link layer; 3. The CXL secure access and cache optimization method of claim 2, wherein, determining the encrypted real Flit data by using the unique encryption key and the real Flit data. The method further comprises: receiving the encrypted real Flit data by using a physical layer of a transmission receiver, decrypting the encrypted real Flit data to obtain real Flit data, and recalculating the synchronous counter of the transmission receiver to obtain a second message authentication code, and detecting whether the second message authentication code meets a monotone increasing expectation of the first message authentication code, and discarding the real Flit data when the second message authentication code does not meet the monotone increasing expectation of the first message authentication code, and otherwise, restoring the real Flit data.

4. The CXL secure access and cache optimization method of claim 3, wherein, The method further comprises: aggregating the first message authentication code in a plurality of real Flit data during transmission.

5. The CXL secure access and cache optimization method of claim 1, wherein, The real Flit data to be written into the memory and meeting the preset access frequency is written into the idle cache area, and the real Flit data meeting the preset access frequency is written into the memory according to the mapping relationship between the idle cache area and the physical page address, comprising: Obtain the allocation request of the standard physical page of the real Flit data to be written into the memory and meeting the preset access frequency; Select an unoccupied cache location from the DRAM, direct the allocation of the physical page address in the persistent memory according to the cache location, and write the real Flit data meeting the preset access frequency according to the physical page address.

6. The CXL safe access and cache optimization method of claim 5, wherein, The method further comprises: Obtain the memory access mode in the security domain, the access mode comprising the access frequency and the read-write times, and divide the standard physical page into cold pages and hot pages according to the access frequency and the read-write times; If cache conflicts occur in the hot pages of different security domains, remap the hot pages in conflict to unoccupied cache locations in the DRAM, wherein the cache conflict is used to represent that the hot pages in at least two security domains are mapped to the same cache location.

7. A CXL secure access and cache optimization apparatus, comprising: Comprise: The first module is used for obtaining real Flit data of a transmission initiator, generating a unique encryption key for each real Flit data by using an encryption algorithm and a synchronous counter, and obtaining encrypted real Flit data; The second module is used for detecting the traffic difference and load of the CXL channel transmitting the encrypted real Flit data, and dynamically inserting virtual Flit data in the CXL channel according to the traffic difference and load of the CXL channel; The third module is used for writing the real Flit data to be written into the memory and meeting the preset access frequency into the idle cache area, and writing the real Flit data meeting the preset access frequency into the memory according to the mapping relationship between the idle cache area and the physical page address; The detection of the traffic difference and load of the CXL channel transmitting the encrypted real Flit data, and the dynamic insertion of virtual Flit data in the CXL channel according to the traffic difference and load of the CXL channel, comprises: Detecting the traffic difference and load of the bidirectional traffic of the CXL channel, if the traffic difference of the bidirectional traffic is greater than a preset threshold, inserting the virtual Flit data in the party with lower traffic value, so that the traffic difference of the bidirectional traffic is less than or equal to the preset threshold; If the load is greater than a preset threshold, inserting the virtual Flit data in the CXL channel according to a first insertion rule; If the load is less than or equal to the preset threshold, inserting the virtual Flit data in the CXL channel according to a second insertion rule; Before writing the virtual Flit data or the real Flit data into the memory, obtain the header information, determine one of the virtual Flit data and the real Flit data according to the header information, and discard the virtual Flit data if it is the virtual Flit data, wherein the virtual Flit data does not include a payload, and the encryption mode of the virtual Flit data is consistent with that of the real Flit data.

8. An electronic device, comprising: Comprise a processor and a memory; The memory is used for storing a program; The processor executes the program to realize the CXL secure access and cache optimization method according to any one of claims 1-6.

9. A computer-readable storage medium, characterized in that, The storage medium stores a program, and the program is executed by the processor to realize the CXL secure access and cache optimization method in any one of claims 1-6.

Images