Calculation device

Abstract

The invention discloses computing equipment, and relates to the field of computers, the computing equipment comprises a processor and a memory, the memory comprises a memory controller, a key generator and a memory, the processor is connected with the memory controller, the memory controller is respectively connected with the key generator and the memory, and the processor is used for operating the key generator and the memory in the process of operating processor tasks. Initiating a data access request to a memory controller; the memory controller is used for responding to the data access request and encrypting and decrypting the target task data by using a data key corresponding to the target task data to obtain reference task data; calling a memory to execute a target access operation on the reference task data; the key generator is used for generating a data key; and the memory is used for storing the task data of the processor task for the processor, so that the technical problem that the data security of the computing equipment is insufficient is solved, and the technical effect of improving the data security of the computing equipment is achieved.

Description

Technical Field

[0001] This application relates to the field of computers, and more specifically, to a computing device. Background Technology

[0002] In related technologies, data security protection of computing devices mainly relies on the processor performing encryption and decryption operations. The processor needs to use keys managed by the operating system to process data by running encryption software algorithms or calling external security modules, and then interact with memory to read and write data. However, the above method has obvious limitations: on the one hand, encryption and decryption operations consume computing resources and cache bandwidth on the host side, seriously reducing the overall operating efficiency of the system; on the other hand, the decryption key needs to reside in the operating system's addressable memory space or processor registers for a long time for access, making it highly vulnerable to malware scanning and theft or physical cold start attacks, resulting in insufficient data security.

[0003] There are no effective solutions yet to address the technical issues, such as insufficient data security in computing devices, in related technologies. Summary of the Invention

[0004] This application provides a computing device to at least address the technical problems of insufficient data security in computing devices in related technologies.

[0005] According to one embodiment of this application, a computing device is provided, including: a processor and a memory, the memory including: a memory controller, a key generator, and a storage device; the processor is connected to the memory controller, and the memory controller is connected to both the key generator and the storage device.

[0006] The processor is used to initiate data access requests to the memory controller during the execution of processor tasks. The data access requests are used to request the execution of target access operations on the target task data of the processor task.

[0007] The memory controller is used to respond to data access requests, encrypt and decrypt the target task data using the data key corresponding to the target task data to obtain the reference task data, and call the memory to perform target access operations on the reference task data.

[0008] A key generator is used to generate data keys.

[0009] Memory is used to store task data for the processor's tasks.

[0010] This application describes a method whereby, during the execution of a processor task, the processor initiates a data access request to the memory controller included in the main memory, requesting a target access operation on the target task data. The memory controller responds to the data access request and uses the data key corresponding to the target task data to encrypt and decrypt the target task data to obtain reference task data. The data key is generated by a key generator included in the main memory. Then, it invokes the memory included in the main memory to perform the target access operation on the reference task data. This memory is used to store the processor's task data. By integrating key generation and encryption / decryption logic within the main memory and having it executed autonomously by the memory controller, the limitations of related technologies—such as encryption / decryption operations consuming host computing resources and the vulnerability of plaintext keys residing in the operating system space—are avoided. Therefore, this method solves the technical problems of insufficient data security in computing devices in related technologies, achieving the technical effect of improving the data security of computing devices. Attached Figure Description

[0011] To more clearly illustrate the embodiments of this application, the accompanying drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0012] Figure 1 This is a structural block diagram of a computing device according to an embodiment of this application. Figure One ;

[0013] Figure 2 This is a memory structure framework according to an embodiment of this application. Figure One ;

[0014] Figure 3 This is a flowchart of a data access request processing method according to an embodiment of this application;

[0015] Figure 4 This is a memory structure framework according to an embodiment of this application. Figure Two ;

[0016] Figure 5 This is a structural block diagram of a key generator according to an embodiment of this application. Figure One ;

[0017] Figure 6 This is a structural block diagram of a key generator according to an embodiment of this application. Figure Two ;

[0018] Figure 7 This is a structural block diagram of a key generator according to an embodiment of this application. Figure Three ;

[0019] Figure 8 This is a structural block diagram of a computing device according to an embodiment of this application. Figure Two . Detailed Implementation

[0020] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the protection scope of this application.

[0021] It should be noted that, in the description of this application, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. The terms "first," "second," etc., in this application are used to distinguish similar objects and are not used to describe a specific order or sequence.

[0022] To enable those skilled in the art to better understand the present application, the present application will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0023] This embodiment provides a computing device. Figure 1 This is a structural block diagram of a computing device according to an embodiment of this application. Figure One ,like Figure 1 As shown, the computing device includes a processor 10 and a memory 20. The memory 20 includes a memory controller 21, a key generator 22, and a storage device 23. The processor 10 is connected to the memory controller 21, and the memory controller 21 is connected to both the key generator 22 and the storage device 23.

[0024] The processor 10 is used to initiate a data access request to the memory controller 21 during the execution of a processor task, wherein the data access request is used to request the execution of a target access operation on the target task data of the processor task.

[0025] Memory controller 21 is used to respond to data access requests, encrypt and decrypt the target task data using the data key corresponding to the target task data to obtain reference task data; and call memory 23 to perform target access operations on the reference task data.

[0026] Key generator 22, used to generate data keys;

[0027] The memory 23 is used to store task data for the processor 10.

[0028] This application describes a method whereby, during the execution of a processor task, the processor initiates a data access request to the memory controller included in the main memory, requesting a target access operation on the target task data. The memory controller responds to the data access request and uses the data key corresponding to the target task data to encrypt and decrypt the target task data to obtain reference task data. The data key is generated by a key generator included in the main memory. Then, it invokes the memory included in the main memory to perform the target access operation on the reference task data. This memory is used to store the processor task data. By integrating key generation and encryption / decryption logic within the main memory and having it executed autonomously by the memory controller, the limitations of related technologies—such as encryption / decryption operations consuming host computing resources and the vulnerability of plaintext keys residing in the operating system space to theft—are avoided. This improves the data security of computing devices and solves the technical problem of insufficient data security in computing devices.

[0029] Optionally, the computing device provided in this embodiment may be, but is not limited to, a server, such as a blade server, rack server, or tower server; it may also be a personal computer, network-attached storage device, cloud computing terminal, or any electronic device with data processing and storage capabilities. In some high-performance computing scenarios, the computing device may also be a computing cluster node integrating multiple processing nodes.

[0030] Optionally, in this embodiment, the processor may be, but is not limited to, a Central Processing Unit (CPU), such as a general-purpose processor based on x86 or ARM architecture; it may also be the computing and control core of a computing device such as a Graphics Processing Unit (GPU), Neural Processing Unit (NPU), Field-Programmable Gate Array (FPGA), or Application-Specific Integrated Circuit (ASIC). The processor initiates data access requests to the memory controller during the execution of processor tasks. These data access requests request the execution of target access operations on the target task data of the processor task. Specifically, the data access request may manifest as a read / write instruction packet.

[0031] Optionally, in this embodiment, the processor and memory can be connected via, but are not limited to, a system bus. The system bus can be a Double Data Rate (DDR) bus, a Peripheral Component Interconnect Express (PCIe) bus, or a Compute Express Link (CXL) bus, etc. For example, the processor sends read / write instructions containing the target physical address and operation type to the memory module's interface via the DDR bus.

[0032] It should be noted that the memory in this embodiment should be understood as a generalized memory subsystem with active security protection capabilities. In one optional implementation, the memory controller, key generator, and memory are all integrated on the same dual in-line memory module (DIMM), forming a secure memory module with independent security capabilities. In another optional implementation, the memory controller and key generator can be located on the motherboard side or exist in the form of a CXL expansion card, communicating with the storage medium via high-speed interconnect.

[0033] Optionally, in this embodiment, the memory controller is connected to the key generator and the memory, and also to the processor. The memory controller may be, but is not limited to, a control chip integrated on a DIMM, or a separate interface control chip. The memory controller may, but is not limited to, integrate bus protocol parsing logic, encryption engine logic, and physical layer interface logic. The memory controller may, but is not limited to, be responsible for responding to data access requests and coordinating key generation and data access.

[0034] Optionally, in this embodiment, the key generator can be, but is not limited to, an independent hardware entropy source integrated on the memory module. The key generator can be, but is not limited to, a quantum key generator based on the characteristics of photon quantum states (such as photon phase and polarization state). In embodiments where the key generator is a quantum key generator, the key generator internally includes a light source (such as a 1550nm laser, a single-photon source, or a weakly coherent laser pulse) and a modulator. The modulator can be implemented using cascaded modulation of optical waveguides with a Mach-Zehnder interferometer (MZI) structure, or it can be implemented using a micro-ring resonator (MRR). The detector detects the photon state after modulation and transmission, and generates an unpredictable random bit stream as the data key based on the uncertainty principle of quantum mechanics. The key generator can also be a true random number generator based on circuit thermal noise or avalanche noise, or a random number generation circuit based on the jitter characteristics of a ring oscillator.

[0035] Optionally, in this embodiment, the connection between the key generator and the memory controller can be, but is not limited to, a direct physical connection within the memory module, such as traces within a printed circuit board (PCB), without passing through an external system bus. In other words, in this embodiment, the generation, transmission, and use of the key are entirely confined within the physical boundaries of the memory module.

[0036] Optionally, in this embodiment, the memory may be, but is not limited to, a physical storage medium array used to actually carry binary data. The memory may be, but is not limited to, an array of volatile Dynamic Random Access Memory (DRAM) chips, an array of Static Random Access Memory (SRAM) chips, or non-volatile Phase Change Memory (PCM) and NAND flash memory chips.

[0037] Optionally, in this embodiment, the memory controller is used to respond to the processor's data access requests. The encryption / decryption process may include, but is not limited to, encryption during writing and decryption during reading; the target task data and reference task data refer to the data format before and after encryption / decryption, depending on the data flow direction.

[0038] Optionally, in this embodiment, when the target access operation is a write operation, the memory controller receives and acquires the target task data sent by the processor. At this time, the target task data is the raw data (plaintext data) to be written to memory by the processor. Subsequently, the memory controller calls the key generator to obtain the generated data key. This data key can be, but is not limited to, a symmetric encryption key. Then, the memory controller uses the data key to encrypt and decrypt the target task data (encryption processing here) to obtain reference task data (i.e., encrypted ciphertext data). The encryption algorithm can be, but is not limited to, the AES algorithm, or a stream encryption algorithm to meet high throughput requirements. Subsequently, the memory controller calls the memory to perform a target access operation on the reference task data (ciphertext). Specifically, the ciphertext is transmitted to the storage particle through the internal data bus of the memory, and control signals such as the Row Address Strobe (RAS), Column Address Strobe (CAS), and Write Enable (WE) are sent to write the ciphertext to the physical address.

[0039] Optionally, in this embodiment, when the target access operation is a read operation, the memory controller addresses and reads data from the memory. At this time, the read raw data is ciphertext, meaning the target task data is stored data. Subsequently, the memory controller uses the corresponding data key to encrypt and decrypt the ciphertext (here, decryption processing) to obtain reference task data, i.e., the restored plaintext data. Finally, the memory controller returns the decrypted plaintext data to the processor via the system bus.

[0040] Optionally, in this embodiment, the target access operation on the reference task data can be performed by calling the memory through the following steps, but not limited to: when the target access operation is a write operation, the memory controller transmits the encrypted reference task data to the memory through the internal data bus of the memory, and sends control signals such as RAS, CAS, and WE to physically write the encrypted data to the specified physical address of the storage chip. Alternatively, when the target access operation is a read operation, the memory controller addresses and reads the encrypted data in the memory.

[0041] Optionally, in this embodiment, the connection between the key generator and the memory controller can be, but is not limited to, a direct physical connection within the memory module, without going through an external system bus. That is, the interaction between the key generator and the memory controller is completed within the memory module. For the operating system, drivers, or potential malware running on the processor, the key is logically "invisible" and "unreachable." The processor can only access the data, not the key, effectively preventing attacks that steal keys by scanning the memory address space.

[0042] Furthermore, in this embodiment, data can be transmitted in plaintext on the bus between the processor and memory (for ease of debugging and compatibility with existing bus protocols), or it can be data encrypted with a lightweight bus layer, but must undergo high-strength encryption by the memory controller before being stored in memory. Alternatively, in another embodiment, the processor sends plaintext, and the memory controller encrypts it instantaneously before writing it to memory, ensuring that the data always exists in ciphertext form on the physical medium. Even if an attacker physically steals the memory module and attempts to read residual charge through a cold start attack, they will only read uncrackable ciphertext data, thus significantly improving data confidentiality.

[0043] As an alternative solution, Figure 2 This is a memory structure framework according to an embodiment of this application. Figure One ,like Figure 2 As shown, the memory 20 also includes a power interface 24 and a memory register 25. The power interface 24 is connected to the memory controller 21 and the key generator 22, respectively. The memory register 25 is connected to the memory controller 21.

[0044] Power interface 24 is used to power memory controller 21 and key generator 22;

[0045] Memory register 25 is used to store data keys, wherein the physical address space corresponding to memory register 25 is not mapped to the physical address space of processor 10;

[0046] The memory controller 21 is also used to detect the power supply status of the power interface 24; if the power supply status is detected to indicate an abnormal power supply to the power interface 24, the data key stored in the memory register 25 is deleted.

[0047] Optionally, in this embodiment, the memory also includes a power interface and memory registers. The power interface connects to the memory controller and key generator, respectively, to provide operating voltage to both. The power interface can be, but is not limited to, standard power pins on the DIMM gold fingers, such as VDD and VPP pins, powered via the motherboard power plane. In newer memory standards such as DDR5 (Double Data Rate Synchronous Dynamic Random Access Memory), the power interface can also connect to the power management IC (PMIC) on the memory module board. The PMIC receives the input voltage (e.g., 12V or 5V) from the motherboard and performs DC-DC (Direct Current) conversion to provide the required specific voltage rails (e.g., 1.1V, 1.8V, or 2.5V) to the memory controller, key generator (especially the optical chip power supply module), and memory chips. In another low-power or low-cost embodiment, the power interface can also transmit external voltage to each chip directly via pins.

[0048] Optionally, in this embodiment, the memory register is connected to the memory controller, and the memory register is a hardware unit used to store the data key generated by the key generator. The memory register may be, but is not limited to, a dedicated register file integrated inside the memory controller, or an independent secure storage chip located on the memory module PCB board. The memory register may be, but is not limited to, a volatile storage medium. This means that once power is lost, the data in it will naturally disappear, thus forming the first line of defense at the physical level.

[0049] Optionally, in this embodiment, the physical address space may refer to, but is not limited to, the range of addresses that can be identified and accessed within the memory controller. The physical addressing space may refer to, but is not limited to, the range of address mapping tables used to map system memory that are visible to the processor and its running operating system. When the processor accesses memory via the bus, it does so based on physical addresses. Typically, all storage units of a large-capacity memory on a memory module are mapped to the system's physical address pool for allocation by the operating system. However, in this embodiment, the physical address space corresponding to the memory register is not mapped to the processor's physical addressing space. That is, although the memory register physically exists in this embodiment, the address decoding logic of the memory controller is designed not to expose the address of the register, keeping it in out-of-band space. In other words, the operating system, drivers, or even malicious kernel-level rootkits (kernel-level backdoor tools) running on the processor cannot address and read the register by executing regular LOAD / STORE instructions or direct memory access. The key data is "invisible" to the software layer, thus completely blocking the path for attackers to steal keys based on software vulnerabilities.

[0050] Optionally, in this embodiment, in order to defend against physical-level cold start attacks, the memory controller also has power status monitoring and key destruction functions.

[0051] Optionally, in this embodiment, the memory controller is used to detect the power supply status of the power interface. The memory controller may, but is not limited to, integrate or connect a low-voltage detection module. The low-voltage detection module is used to detect the power supply status of the power interface and transmit the power supply status to the memory controller. The memory controller is also used to receive the power supply status transmitted by the low-voltage detection module. Specifically, the low-voltage detection module is used to: sample the voltage value of the power interface, obtain a target voltage value, and compare the target voltage value with a preset reference voltage; when the target voltage value is lower than the reference voltage, output a power supply status indicating an abnormal power supply to the power interface; when the target voltage value is greater than or equal to the reference voltage, output a power supply status indicating a normal power supply to the power interface. In another embodiment, the power supply status can also be indirectly detected by monitoring the level of the RESET# signal line issued by the motherboard. Abnormal power supply includes, but is not limited to, power outages caused by system shutdown, voltage transient drops caused by unexpected system reset, or power interruptions caused by physically removing the memory module.

[0052] Optionally, in this embodiment, when a power supply status indicating a power interface power supply abnormality is detected, the memory controller immediately performs the operation of deleting the data key stored in the memory register. This can be achieved, but is not limited to, by actively clearing the data key stored in the memory register: utilizing the brief time window provided by the trace charge remaining in the decoupling capacitor of the memory module, a fast erase circuit is triggered to write all "0"s or all "1"s to the memory register, or write random noise data to overwrite the original data key. In another embodiment, this can also be achieved, but is not limited to, by cutting off the sustaining voltage. For example, the memory controller controls an electronic switch to cut off the sustaining voltage connected to the memory register the instant the abnormality occurs, causing it to instantly lose data due to its volatility.

[0053] It is important to note that the "deletion" mentioned in this embodiment should be understood as any operation that makes the key unrecoverable. To combat cold start attacks, attackers typically attempt to freeze and quickly remove the memory module, exploiting the residual charge in the DRAM to read data on another machine. This embodiment employs a "proactive destruction upon detection of anomalies" mechanism, preemptively destroying the key in the register the instant the attacker removes the memory module or forcibly shuts off power (within milliseconds or microseconds). Because the key is completely destroyed, even if encrypted reference task data (ciphertext) remains in the large-capacity storage, the attacker cannot recover the original plaintext without the key, thus greatly enhancing the physical security of the data.

[0054] In the above embodiments, by isolating the memory register storing the key outside the processor's physical address space, the operating system cannot access the key via instructions, logically blocking the software-level theft path. Secondly, by monitoring power supply in real time and actively destroying the key using residual capacitor charge, it is ensured that the key is immediately destroyed when the physical environment becomes insecure, effectively preventing attackers from recovering the key using the cold-start residue effect of memory. This combined hardware and software protection strategy significantly improves the data security of computing devices when facing physical and system-level attacks.

[0055] As an optional solution, the memory controller is used for:

[0056] When a data access request is used to request a target write operation on the target task data of a processor task, the target task data is encrypted using the data key corresponding to the target task data.

[0057] When a data access request is used to request the execution of a target read operation on the target task data of a processor task, the target task data is decrypted using the data key corresponding to the target task data. The target access operation includes a target write operation and a target read operation, and the encryption and decryption process includes encryption and decryption.

[0058] Optionally, in this embodiment, Figure 3 This is a flowchart of a data access request processing method according to an embodiment of this application, such as... Figure 3 As shown, after the memory controller receives a data access request, it includes:

[0059] Step S301: Detect the operation type of the data access request. If the operation type of the data access request is detected as a write operation, then execute step S302; if the operation type of the data access request is detected as a read operation, then execute step S305.

[0060] In traditional DDR interface scenarios, the memory controller can identify the operation type of a data access request by decoding the signal combinations on the command bus. For example, it analyzes the level states of the RAS, CAS, and WE signals; if the WE signal is valid (e.g., low level), it is identified as a target write operation, and step S302 is executed; if the WE signal is invalid (e.g., high level), it is identified as a target read operation, and step S305 is executed. In packet-switched protocol scenarios such as CXL or AXI (Advanced eXtensible Interface), the memory controller can determine the type by analyzing the opcode field in the packet header. For example, it identifies the M2S RwD (Request with Data) message in the CXL.mem protocol as a write request and the M2S Req (Request) message as a read request.

[0061] In step S302, the memory controller determines that the data flow is from the processor to the memory. That is, the target task data is the raw plaintext data sent by the processor. The memory controller obtains the plaintext data and calls the pre-generated and stored (e.g., stored in a memory register) data key, and executes step S303.

[0062] In step S303, the memory controller uses its internal hardware encryption engine to encrypt the target task data using a data key. After encryption, ciphertext data (i.e., reference task data) is obtained, and step S304 is executed.

[0063] The encryption process can be, but is not limited to, the algorithmic operation of converting plaintext data into ciphertext data. For example, the memory controller can send plaintext data into the First In First Out (FIFO) input queue of the built-in AES encryption engine, load the key, and after multiple rounds of hardware logic operations, obtain the ciphertext data from the output FIFO. The memory controller can also feed the plaintext data stream and the key stream output by the key generator bit by bit into an XOR gate circuit to output the ciphertext stream in real time.

[0064] In step S304, the memory controller writes the encrypted data (i.e., the reference task data) into the target physical address of the memory.

[0065] In step S305, the memory controller determines that the data flow is from memory to processor. That is, the target task data is encrypted data. The memory controller addresses and reads the encrypted data from the memory chip according to the physical address in the request, and then executes step S306.

[0066] Step S306: Obtain the key corresponding to the encrypted data, and proceed to step S307.

[0067] Step S307: Use the same corresponding data key as when writing to perform reverse operation on the ciphertext data. After the operation is completed, restore the plaintext data (i.e., reference task data) and execute step S308.

[0068] Decryption processing can refer to, but is not limited to, the reverse algorithm operation process of restoring ciphertext data to plaintext data. For example, the memory controller sends the ciphertext data to the decryption engine, configures the same data key as during encryption, performs the inverse transformation of the encryption process (such as the AES decryption round function) or performs XOR logic operation again (for symmetric stream encryption), thereby recovering the plaintext data.

[0069] In step S308, plaintext data (i.e., reference task data) is returned to the processor via the system bus.

[0070] It's important to note that the memory controller may, but is not limited to, integrate high-performance dedicated hardware acceleration circuitry to encrypt and decrypt data instantly as it passes through the memory interface, without passing through intermediate caches. For the operating system and applications running on the processor, they are unaware that the data is encrypted in physical memory; they always see and use plaintext data, achieving low-level hardware-level security without modifying any code.

[0071] Furthermore, regarding the corresponding data key, in one optional implementation, the entire memory module can use the same global data key. In another optional implementation, the memory controller can support multiple key domains. That is, different memory physical address ranges correspond to different data keys. The memory controller looks up the key table based on the physical address in the data access request, finds the specific data key corresponding to the region to which the address belongs, and performs encryption and decryption.

[0072] In the above embodiments, the memory controller automatically splits the write and read operations at the hardware level and performs real-time encryption and decryption operations respectively, ensuring that the data is always in an encrypted state when it leaves the memory controller and enters the physical storage medium. This effectively prevents the risk of data leakage caused by directly reading the storage chip through physical means (such as physically moving the memory stick), and achieves the security goal of "encrypting data as soon as it lands".

[0073] As an optional solution, the memory controller is used for:

[0074] Extract the target task data from the data access request, and obtain the idle data key from the memory register as the reference data key. The idle data key is the data key that has not yet performed an encryption or decryption task.

[0075] The target task data is encrypted using a reference data key.

[0076] Optionally, in this embodiment, the memory controller extracts the target task data from the data access request. When the processor initiates a write request, the data is typically encapsulated in a data packet or burst transmission of the bus protocol. The protocol parsing logic inside the memory controller strips away the bus command header and address information, separating the actual payload and temporarily storing it in an internal data buffer. This payload is the plaintext data to be encrypted. For example, the memory controller parses the DQ (Data Queue) signal line status on the DDR bus, captures the transmitted valid data payload in a specific clock cycle after the write instruction, and identifies it as the plaintext data to be written. In another embodiment, the memory controller can also directly read the data block to be processed from the agreed DMA (Direct Memory Access) buffer address according to the address in the write request.

[0077] Optionally, in this embodiment, the memory register is configured as a key buffer pool or key queue, storing multiple candidate data keys pre-generated by the key generator. The idle state indicates that the data key has been generated by the key generator and stored in the memory register; the data is valid and not currently bound to any physical address or data block, making it available for use by new write operations. Examples include key entries in the pre-generated queue or register values ​​marked "Valid" and "Unbound". The busy state indicates that the key is currently being used by the encryption engine or is in an unstable phase of generation / update.

[0078] Optionally, in this embodiment, the memory controller may, but is not limited to, obtain the reference data key using a bitmap lookup table: maintaining a key status table or bitmap. Each bit in the bitmap corresponds to a key slot in a register; for example, "0" represents free and "1" represents occupied. The memory controller quickly finds the first data key with a flag bit of "0" as the reference data key using hardware circuitry (such as a priority encoder) and sets that flag bit to "1" (locks) through an atomic operation. Alternatively, the memory controller may, but is not limited to, obtain the reference data key using a FIFO queue: pre-generated keys are sequentially stored in a FIFO queue. The memory controller directly pops a key from the head of the queue as the reference data key.

[0079] Optionally, in this embodiment, key lifecycle management can be divided into two modes based on different security requirements: key reuse mode and one-time pad mode. In key reuse mode, after the memory controller completes encryption with the key, it writes the ciphertext to memory and resets the key's status bit at an appropriate time (such as when writing is complete or data is overwritten), restoring it to an idle state, awaiting the next allocation. This mode is suitable for scenarios with limited key resources. In one-time pad mode, once a key is used for encryption (becoming a reference data key), it is marked as "used" or "discarded." After completing this encryption, the key does not return to the idle pool but waits to be overwritten by a new key generated by the key generator. Key reuse mode is suitable for memory systems supporting multiple channels. For example, when the first encryption engine is using "key A" to process a request (busy), for the second request that arrives immediately, the memory controller automatically selects the idle "key B" for processing, achieving pipeline concurrency. One-time pad mode is similar to a rolling key strategy, providing extremely high security; even if an attacker cracks the key at a certain historical moment, they cannot decrypt subsequent data.

[0080] In the above embodiments, by establishing a key caching pool mechanism within the memory controller and prioritizing the acquisition of idle keys for encryption, the response speed of data write operations is significantly improved. Compared to schemes that wait for the key generator to generate keys in real time for each write operation, this embodiment utilizes system idle time to pre-generate and cache keys, eliminating the impact of key generation delay on write performance and achieving high-throughput encrypted data writing.

[0081] As an optional solution, the memory controller is used for:

[0082] Detect whether there is an idle data key in the memory register;

[0083] If no idle data key exists in the memory register, a key generation request is sent to the key generator to obtain the candidate data key returned by the key generator in response to the key generation request; the candidate data key is stored in the memory register and used as the reference data key;

[0084] If an idle data key exists in the memory register, obtain the idle data key as the reference data key.

[0085] Optionally, in this embodiment, the memory controller may, but is not limited to, detect the existence of idle data keys before performing the encryption task by maintaining an available key counter. The counter is incremented by 1 each time a new key is generated and enqueued; and decremented by 1 each time a key is consumed. The detection step involves determining whether the value of the counter is greater than 0. Alternatively, in a bitmap management mode, the entire bitmap is scanned to determine if there are any bits with a value of "0" (representing an idle state). Alternatively, in a FIFO queue management mode, the empty flag status of the queue is directly queried.

[0086] Optionally, in this embodiment, if there is an idle data key in the memory register (i.e., a "cache hit"), the memory controller may, but is not limited to, directly obtain an idle data key from the buffer pool as a reference data key.

[0087] Optionally, in this embodiment, if no idle data key exists in the memory register (i.e., "cache miss" or "cache exhaustion"), the memory controller initiates an on-demand generation process, including: the memory controller sending a key generation request to the key generator. The key generation request may, but is not limited to, pulling an enable signal line high, sending a pulse trigger signal, or sending a generation command via the internal bus. The key generator responds to the key generation request and generates a data key using a physical entropy source (such as a photonic quantum state). After detecting a handshake signal (READY), the memory controller reads the newly generated candidate data key via the parallel data bus.

[0088] Optionally, in this embodiment, after obtaining the candidate data key, the memory controller performs storage and usage operations: the memory controller stores the candidate data key in a memory register. For example, it writes it to an empty slot in the register array and updates the status of the slot to "occupied" for subsequent querying or auditing. At the same time, the memory controller directly uses the candidate data key as the reference data key for this operation and sends it to the encryption engine.

[0089] In another alternative implementation, to reduce latency, the newly generated key can be transmitted to the encryption engine in parallel while being written to the memory register, avoiding the additional clock overhead of writing to the register first and then reading it.

[0090] Optionally, in this embodiment, when the system is idle, the key generator can continue to work in the background, filling the memory registers. In the event of a sudden surge in high-concurrency writes, if the write speed exceeds the background filling speed, causing the buffer pool to be emptied instantly, the system will automatically revert to on-demand generation mode. Although the write latency will increase at this time (increasing the time waiting for photon emission and detection), the continuity and availability of the encryption function are guaranteed, and write failures or system crashes will not occur due to a lack of keys.

[0091] In the above embodiments, by constructing an on-demand key management strategy, system performance and resource utilization are effectively balanced. When the key inventory is sufficient, idle keys are directly reused to minimize latency; when the inventory is depleted, a replenishment mechanism is automatically triggered to ensure business continuity and prevent write failures or system crashes due to a lack of keys. Simultaneously, it avoids the power waste caused by the key generator running ineffectively for extended periods when unnecessary.

[0092] As an optional solution, the memory controller is used for:

[0093] Extract the target read address from the data access request, where the target read address is the physical address of the target task data in memory;

[0094] The target task data is retrieved from the memory according to the target read address, and the target data key corresponding to the target task data is found from the memory register. The target task data is the data obtained after encrypting the reference task data using the target data key.

[0095] The target data key is used to decrypt the target task data.

[0096] Optionally, in this embodiment, the target read address is the index of the specific storage location of the target task data in the memory, that is, it directly corresponds to the addressing code (physical address) of the physical unit of the storage medium, without the need for virtual address translation. Specifically, the address can be represented as a combination of physical addresses including Rank (memory rank), Bank (memory storage group number), Bank number, Row (row address), and Column (column address).

[0097] Optionally, in this embodiment, the target read address can be extracted in, but is not limited to, the following ways: In a DDR bus scenario, the memory controller samples signals on the address bus and, in conjunction with Chip Select (CS) and command signals (RAS / CAS / WE), decodes the physical address pointed to by the current read operation as the target read address. In another embodiment, the memory controller extracts the address by reading DMA request packets and parses the source address field in the packet header as the target read address.

[0098] Optionally, in this embodiment, the memory controller searches for the target data key in the memory register based on the extracted target read address. The target data key refers to a specific key used to encrypt the data during data writing, and this key is associated with the physical address of the data. The target data key corresponding to the target task data can be found, but is not limited to, through the following methods: The memory controller maintains a mapping table internally (or in a dedicated area of ​​the memory register). This table records the correspondence between physical addresses (or address ranges) and key IDs (Identifiers). The memory controller uses the extracted target read address as an index to query the mapping table and obtain the corresponding key ID. Then, it reads the specific target data key from the key pool of the memory register based on the key ID. Alternatively, in a system employing a rolling key strategy, data written at different times may use different versions of the key. The memory controller may record the key version number used when encrypting the data in the metadata area of ​​the stored data. While reading the ciphertext data, the memory controller reads its associated metadata, parses the key version number, and uses this to find the corresponding target data key from the register's historical key queue. Alternatively, if the system policy specifies that the entire memory module uses the same key, the currently valid global key is read directly from a fixed register location.

[0099] Optionally, in this embodiment, the memory controller uses the found target data key to decrypt the target task data (ciphertext) read from the memory. The decryption algorithm must be symmetrical to the encryption algorithm used during writing: if the AES algorithm was used for encryption, the target data key is configured to the AES decryption engine during decryption, and the ciphertext is subjected to a reverse round function operation. If a stream cipher (such as an XOR stream) was used for encryption, the same keystream is generated again and XORed with the ciphertext during decryption. After decryption, the original reference task data (plaintext) is restored and then returned to the processor via the system bus.

[0100] It is important to note that the "lookup from memory registers" in this embodiment implies that the key must reside in hardware storage that the controller can quickly access. If the corresponding key is found to have been destroyed during the lookup process (e.g., due to a previous power outage causing the registers to be cleared), the memory controller will be unable to complete the decryption. In this case, the memory controller can be designed to return a string of invalid data (such as all zeros or a random number), or return a "data error / uncorrectable error" signal to the processor to prevent the spread of erroneous data.

[0101] In the above embodiments, by establishing a strong mapping mechanism between physical addresses and keys, the correct decryption key can be accurately located and invoked during read operations. Even if an attacker obtains part of the key or part of the ciphertext, they cannot decrypt data in other address ranges in batches, greatly improving the security of stored data. At the same time, the parallel execution of data reading and key lookup operations minimizes additional decryption latency, ensuring high-performance reading of the system.

[0102] As an alternative solution, Figure 4 This is a memory structure framework according to an embodiment of this application. Figure Two ,like Figure 4 As shown, the key generator 22 includes a transmitting unit 221 and a receiving unit 222, which are connected together. A memory controller 21 is connected to both the transmitting unit 221 and the receiving unit 222.

[0103] The transmitting unit 221 is used to respond to a key generation request, generate an optical signal carrying multiple target quantum states, and send the optical signal carrying multiple target quantum states to the receiving unit 222, wherein the target quantum states include at least one of a target polarization state, a target phase state, a target time-coded state, and a target photon number state;

[0104] The receiving unit 222 is used to receive an optical signal carrying multiple target quantum states; detect the optical signal carrying multiple target quantum states to obtain multiple target quantum states; find multiple target bit values ​​corresponding to multiple target quantum states from the quantum states and bit values ​​with corresponding relationships; combine multiple target bit values ​​to obtain a data key, and send the data key to the memory controller 21.

[0105] Optionally, in this embodiment, the transmitting unit and the receiving unit may be connected via, but are not limited to, an optical waveguide or a free-space optical path, and the memory controller may be connected to, but is not limited to, the electrical interfaces of the transmitting unit and the receiving unit respectively.

[0106] Optionally, in this embodiment, the transmitting unit may be, but is not limited to, a collection of components in the key generator responsible for preparing and transmitting quantum state signals, such as an optical transmitting module integrating a laser source, modulator, and attenuator. The transmitting unit is used to respond to a key generation request, generate an optical signal carrying multiple target quantum states, and transmit the optical signal to the receiving unit.

[0107] Optionally, in this embodiment, the receiving unit may be, but is not limited to, a set of components in the key generator responsible for receiving and measuring quantum state signals, such as an optical receiving module integrating a beam splitter, an interferometer, and a single-photon detector. The receiving unit is used to receive and detect optical signals, parse the target bit value corresponding to the target quantum state, and finally combine them to generate a data key and send it to the memory controller.

[0108] Optionally, in this embodiment, the target quantum state may refer to, but is not limited to, the physical state of the microscopic particles used to carry key information, such as: the polarization direction of photons (e.g., horizontal / vertical), the phase difference of photons (e.g., 0 or 0), etc. ( ), arrival time of photons, or the average number of photons contained in a light pulse.

[0109] Optionally, in this embodiment, the target polarization state may refer to, but is not limited to, the vibration direction state of the photon electric field vector; the target phase state may refer to, but is not limited to, the phase delay state of the light wave during transmission; the target time-coded state may refer to, but is not limited to, the state in which photons appear in different time windows; and the target photon number state may refer to, but is not limited to, the quantized distribution state of the light pulse energy.

[0110] Optionally, in this embodiment, the transmitting unit can generate an optical signal carrying the target quantum state by modulating laser pulses, but is not limited to this. For example, the transmitting unit controls the laser to emit optical pulses, and uses a polarization modulator to randomly modulate each optical pulse into one of the following polarization states: horizontal, vertical, +45 degrees, or -45 degrees. In another embodiment, this can also be achieved, but is not limited to, by phase modulation. For example, a phase modulator is used to change the phase of the optical pulse so that it carries preset phase information.

[0111] Optionally, in this embodiment, the receiving unit may include, but is not limited to, a single-photon detector. The receiving unit may receive and detect the optical signal through, but is not limited to, the following steps: using a single-photon detector to sense the arriving photons; since the photon energy is extremely weak, the receiving unit converts it into an electrical pulse signal (such as an avalanche current), thereby determining the presence and state of the photon. In another embodiment, the receiving unit may also receive and detect the optical signal through, but is not limited to, zero-difference detection. For example, by using interference between a strong local oscillator beam and the signal beam, the orthogonal components can be measured.

[0112] Optionally, in this embodiment, the receiving unit searches for the target bit value from a set of corresponding quantum states and bit values. This can be achieved through a lookup table mapping, for example, the receiving unit pre-stores a mapping table, specifying that "horizontal polarization" corresponds to bit "0" and "vertical polarization" corresponds to bit "1". When a photon is detected to be horizontally polarized, the bit is determined to be "0". Alternatively, it can be achieved through logic circuit decoding, for example, the hardware circuit directly maps the detector's channel output to high and low levels.

[0113] Optionally, in this embodiment, the data key can be obtained by combining bit values ​​using a serial shift register, but is not limited to this method. For example, the continuously parsed bit values ​​can be shifted into a shift register sequentially, and truncated every 256 bits to form the AES-256 key. In another embodiment, it can also be achieved using a post-processing algorithm, but is not limited to this method. For example, the bit stream can first be compared and error-corrected to eliminate transmission errors, and then hashed and compressed into the final key.

[0114] In the above embodiments, the non-cloning and uncertainty principle of quantum states (such as polarization and phase) are used to generate keys, thus ensuring the true randomness and unpredictability of the keys from a physical perspective. Compared with traditional pseudo-random number algorithms, key generation methods based on quantum physics properties can resist computationally-based attacks, thereby providing the highest level of security entropy source for the encryption of memory data.

[0115] As an alternative solution, Figure 5 This is a structural block diagram of a key generator according to an embodiment of this application. Figure One ,like Figure 5As shown, the transmitting unit 221 includes a light source assembly 2211 and a modulation assembly 2212. The light source assembly 2211 is connected to the receiving unit through the modulation assembly 2212, and the light source assembly 2211 is connected to the memory controller.

[0116] The light source component 2211 is used to respond to the key generation request, emit a light beam of a preset wavelength, and direct the light beam into the modulation component 2212;

[0117] The modulation component 2212 is used to perform quantum state modulation on the light beam to obtain an optical signal carrying multiple target quantum states, and to send the optical signal carrying multiple target quantum states to the receiving unit. The quantum state modulation includes at least one of polarization state modulation, phase state modulation, time-coded state modulation and photon number state modulation. Polarization state modulation is used to control the photon polarization direction of the light beam, phase state modulation is used to control the photon phase difference of the light beam, time-coded state modulation is used to control the photon emission time interval of the light beam in the time domain, and photon number state modulation is used to control the photon number distribution of the light beam.

[0118] Optionally, in this embodiment, the light output terminal of the light source component is fed into the modulation component via a light waveguide, and the modulation component is connected to the receiving unit. The light source component may refer to, but is not limited to, a device unit capable of generating stable light radiation, such as a semiconductor laser diode, a light-emitting diode, or a single-photon source device. The preset wavelength may be, but is not limited to, a communication band (such as 1550nm) or a visible light band.

[0119] Optionally, in this embodiment, the modulation component may refer to, but is not limited to, an optical device unit capable of changing the properties of light waves, such as a lithium niobate modulator, an electroabsorption modulator, or a liquid crystal spatial light modulator.

[0120] Optionally, in this embodiment, quantum state modulation can refer to, but is not limited to, the process of using physical means to change the degrees of freedom of photons to carry information. Polarization state modulation can refer to, but is not limited to, the operation of changing the direction of light vibration; phase state modulation can refer to, but is not limited to, the operation of changing the phase of light waves; time-coded state modulation can refer to, but is not limited to, the operation of controlling the timing of light pulse emission; and photon number state modulation can refer to, but is not limited to, the operation of controlling the average number of photons in the pulse. For example, by adjusting the coupling ratio of the directional coupler in the modulation component, fine control of the light beam intensity can be achieved, thereby completing photon number state modulation.

[0121] Optionally, in this embodiment, the emission of the initial light beam by the light source assembly can be achieved, but is not limited to, by driving a laser to emit light. For example, a 1550nm laser diode can be driven by a precision current source to generate an initial laser beam in the form of a continuous wave or a pulsed wave. In another embodiment, it can also be achieved, but is not limited to, by pulse shaping. For example, an intensity modulator can be used to cut the continuous light into pulse trains with specific time-domain waveforms.

[0122] Optionally, in this embodiment, the modulation component can perform quantum state modulation through electro-optic control, but is not limited to this method. For example, for phase state modulation, different voltages are applied to the electrodes of the phase modulator, and the refractive index of the waveguide is changed by the electro-optic effect, thereby causing the passing light beam to generate 0, / 2、 Or 3 A phase delay of 2 / 2. For polarization state modulation, this can be achieved using a combination of phase modulators or a dedicated polarization controller. In another embodiment, it can also be achieved, but is not limited to, through interference structure control. For example, using an MZI structure. By applying a voltage to one arm of the MZI, the refractive index of the waveguide is changed using the electro-optic effect, thereby generating a 0, 2π / 2 phase delay at the output. / 2、 Or 3 The relative phase delay is 2 / 2. For polarization modulation, rapid switching between different polarization states can be achieved by combining multiple phase modulators and polarization rotators.

[0123] In a highly integrated embodiment, the modulation component employs an MRR (Metal-Resonant Array). An MRR is a miniature optical device based on silicon-based optical waveguide technology, where the resonant wavelength is tuned by changing the refractive index of a microring (thermo-optical effect or carrier dispersion effect). When the input light frequency matches the resonant frequency of the microring, light couples into the ring. By rapidly switching the resonant state of the microring, high-precision intensity modulation (for photon number states) or phase modulation of the optical signal can be achieved, enabling the fabrication of extremely small on-chip quantum states.

[0124] In the above embodiments, high-speed and accurate preparation of quantum state signals is achieved through a precise light source combined with a modulation architecture. In particular, the system supports combinations of multiple modulation dimensions such as polarization, phase, time, and photon number, enabling it to adapt to different quantum key distribution protocols and enhancing its flexibility and applicability. Simultaneously, precise modulation at the hardware level ensures the distinguishability of quantum states, reduces the transmission error rate, and improves the final key generation rate.

[0125] As an alternative solution, Figure 6 This is a structural block diagram of a key generator according to an embodiment of this application. Figure Two ,like Figure 6 As shown, the receiving unit 222 includes a detection component 2221 and a demodulation component 2222. The transmitting unit is connected to the demodulation component 2222 through the detection component 2221, and the demodulation component 2222 is connected to the memory controller.

[0126] The detection component 2221 is used to receive an optical signal carrying multiple target quantum states; perform quantum state detection on the optical signal carrying multiple target quantum states to obtain multiple target quantum states, and transmit the multiple target quantum states to the demodulation component 2222. The quantum state detection includes at least one of polarization state detection, phase state detection, time-coded state detection, and photon number state detection. Polarization state detection is used to detect the polarization direction of photons in the optical signal, phase state detection is used to detect the phase difference of photons in the optical signal, time-coded state detection is used to detect the emission time interval of photons in the time domain in the optical signal, and photon number state detection is used to detect the number distribution of photons in the optical signal.

[0127] The demodulation component 2222 is used to find multiple target bit values ​​corresponding to multiple target quantum states from quantum states and bit values ​​with corresponding relationships; combine multiple target bit values ​​to obtain a data key; and send the data key to the memory controller.

[0128] Optionally, in this embodiment, the detection component is used to perform quantum state detection on the optical signal. Since the signal is typically at the single-photon level, the detection component must have extremely high sensitivity. It can be, but is not limited to, a single-photon avalanche diode, a superconducting nanowire single-photon detector, or a PIN (Positive-Intrinsic-Negative Photodiode).

[0129] Optionally, in this embodiment, quantum state detection may refer to, but is not limited to, the process of acquiring photon state information through physical measurement means. Polarization state detection may refer to, but is not limited to, the process of using a polarization beam splitter to distinguish the polarization direction of photons; phase state detection may refer to, but is not limited to, the process of using an interferometer to convert phase information into intensity information for measurement; time-coded state detection may refer to, but is not limited to, the process of measuring the arrival timestamp of photons; and photon number state detection may refer to, but is not limited to, the process of measuring the intensity of light pulses.

[0130] Optionally, in this embodiment, quantum state detection can be achieved by the detection component through optical splitting and detection, but is not limited to this. For example, for polarization state detection, the optical signal is physically separated into horizontal and vertical paths by a polarization beam splitter, and these paths enter two single-photon detectors respectively. The response of the detector indicates the polarization state of the photon. For phase state detection, the optical signal enters an unbalanced interferometer (such as a Faraday-Michelson interferometer), where two consecutive optical pulses interfere. The interference result determines which port the photon outputs from and is detected. In another embodiment, time-coded state detection can also be achieved, but is not limited to, through a time-to-digital converter (TDC). For example, the detector output pulse triggers a TDC circuit to record the precise time difference relative to a synchronous clock.

[0131] Optionally, in this embodiment, the demodulation component is used to process electrical signals and output keys. It may refer to, but is not limited to, a circuit unit that performs logical decisions and data processing on the detected electrical signals, such as an FPGA logic module, a dedicated signal processing chip, or a high-speed comparator circuit.

[0132] Optionally, in this embodiment, the demodulation components can be combined to obtain the data key through logical mapping and concatenation. For example, the demodulation component receives pulse signals from the detector, filters out valid detection events (e.g., only one detector responds within the same clock cycle) according to preset protocol rules, maps the valid events to binary bits (0 or 1) and stores them in a buffer, and outputs the key after accumulating a certain length. In another embodiment, this can also be achieved through post-processing error correction. For example, error checking and privacy amplification processing can be performed before combination.

[0133] In the above embodiments, a highly sensitive detection component and an intelligent demodulation component work together to achieve efficient conversion of weak quantum signals into digital keys. This architecture can accurately distinguish subtle features such as the polarization and phase of photons, effectively filter out environmental noise, and ensure the accuracy of key generation. Simultaneously, the hardware-based processing of the demodulation component significantly improves the key generation rate, meeting the key supply requirements of high-speed memory data read / write.

[0134] As an alternative solution, Figure 7 This is a structural block diagram of a key generator according to an embodiment of this application. Figure Three ,like Figure 7As shown, the key generator 22 may include a transmitting unit 221 and a receiving unit 222. The transmitting unit 221 may include a light source assembly 2211 and a modulation assembly 2212, with the light source assembly 2211 and the modulation assembly 2212 connected. The receiving unit 222 may include a detection assembly 2221 and a demodulation assembly 2222, with the detection assembly 2221 and the demodulation assembly 2222 connected. The light source component 2211 is used to respond to the key generation request, emit an initial light beam of a preset wavelength, and direct the initial light beam into the modulation component 2212; the modulation component 2212 is used to perform quantum state modulation on the initial light beam to obtain an optical signal carrying multiple target quantum states, and send the optical signal carrying multiple target quantum states to the detection component 2221 in the receiving unit 222; the detection component 2221 is used to receive the optical signal carrying multiple target quantum states, perform quantum state detection on the optical signal to obtain multiple target quantum states, and transmit the multiple target quantum states to the demodulation component 2222; the demodulation component 2222 is used to find the multiple target bit values ​​corresponding to the multiple target quantum states from the quantum states and bit values ​​with corresponding relationships, combine the multiple target bit values ​​to obtain a data key, and send the data key to the memory controller 21.

[0135] Specific examples in this embodiment can be found in the examples described in the above embodiments and exemplary implementations, and will not be repeated here.

[0136] As an optional solution, the memory controller is used for:

[0137] In the case where a data access request is used to request a target write operation on the target task data of a processor task, the target write address is extracted from the data access request, where the target write address is the physical address of the memory to which the target task data is to be written; the memory is called to write the reference task data to the target write address;

[0138] In the case where a data access request is used to request the execution of a target read operation on the target task data of a processor task, a reference task data is transferred to the processor, wherein the target access operation includes a target write operation and a target read operation.

[0139] Optionally, in this embodiment, when a data access request is used to request a target write operation on the target task data of a processor task, the memory controller extracts the target write address from the data access request. The target write address is the physical address of the memory where the target task data is to be written. The memory controller calls the memory to write the reference task data to the target write address.

[0140] Optionally, in this embodiment, the target write address can be extracted in the following ways, but not limited to: In the DDR interface scenario, the memory controller, upon capturing a write instruction, latches the Bank group number, Bank, Row, and Column signals on the address bus, and combines them to parse a linear physical address as the target write address. In the CXL.mem interface scenario, the memory controller parses the Address field (usually a 64-bit physical address) in the M2S RwD data packet header as the target write address.

[0141] Optionally, in this embodiment, the address can be extracted from the data access request and the memory can be invoked for writing by address decoding and timing control. For example, in a write operation, the memory controller parses the physical address in the request and converts it into timing signals for the DDR interface: first, an ACT (Activate) instruction is sent to activate a specific Bank and Row, then a write instruction and Column address are sent, and the encrypted reference task data is written to the DRAM chip via the DQ data line at the DQS (Data Strobe) clock edge. In another embodiment, it can also be implemented by burst writing, but is not limited to. For example, after sending a write instruction, a segment of address space data is continuously written.

[0142] Optionally, in this embodiment, when the data access request is used to request the execution of a target read operation on the target task data of the processor task, the memory controller has already completed the decryption operation of the ciphertext read from the memory, obtaining the restored plaintext data. At this time, this plaintext data is the reference task data in this step. The memory controller transmits the reference task data (plaintext) to the processor.

[0143] The above embodiments construct a complete closed loop for data persistence and transmission. The writing end ensures that the final data stored on disk is encrypted, preventing the physical medium from being stolen; the reading end ensures that the data returned to the processor is plaintext, transparent to upper-layer software. This not only achieves confidential data storage but also guarantees transparent compatibility with upper-layer processors and operating systems, providing hardware-level security protection without requiring software modifications.

[0144] As an alternative solution, Figure 8 This is a structural block diagram of a computing device according to an embodiment of this application. Figure Two .like Figure 8As shown, the computing device also includes a monitoring unit 30, which is connected to the key generator 22 and the memory controller 21 respectively, and is used to collect the operating status of the key generator 22 and the memory controller 21. The monitoring unit 30 may be, but is not limited to, a microcontroller unit (MCU) or FPGA module integrated on the memory 20, and has an independent acquisition channel and communication interface, such as I2C (Inter-Integrated Circuit) or SMBus (System Management Bus). In addition, the monitoring unit 30 may also include physical sensors distributed around the optical chip, such as a temperature sensor for monitoring the laser temperature, an optical power meter / photodiode for monitoring the laser emission intensity, and a voltage monitoring circuit.

[0145] Optionally, in this embodiment, the operating status may include, but is not limited to, three types of indicators: quantum error rate, optical device health, and environmental parameters. The monitoring unit may detect the operating status in, but is not limited to, the following ways:

[0146] The error rate of quantum key distribution is calculated in real time by comparing the verification data of the transmitter and receiver.

[0147] The health of optical devices is calculated by detecting the stability of the emission power of the light source components, the drift of the bias voltage of the modulator, and the dark count rate of the single-photon detector.

[0148] Environmental parameters are calculated by detecting local temperature, voltage ripple, and other parameters of the memory module.

[0149] Optionally, in this embodiment, the monitoring unit is also used to perform alarm or circuit breaker operations when an abnormal operating status is detected. For example, the monitoring unit can communicate with the substrate management controller or processor via SMBus to report health status logs; when the quantum error rate exceeds the standard (suspected eavesdropping) is detected, an interrupt signal is immediately sent to the memory controller to suspend the generation and use of keys, preventing insecure keys from being used for data encryption; when an optical path failure is detected, the memory controller can be notified to switch to a backup conventional random number generation source (such as a circuit thermal noise source) to ensure basic system availability.

[0150] It should be noted that the monitoring unit in this embodiment not only has fault reporting capabilities but also integrates predictive maintenance functionality: by recording the driving current variation trend of the laser over a long period, it can predict the remaining lifespan of the light source and notify the system administrator to replace the memory module before it is completely damaged, thus preventing the server from unexpectedly crashing due to hardware failure. Furthermore, the monitoring unit can adopt a power supply method independent of the main data path (e.g., powered by an auxiliary power supply), so that even when the main system is in hibernation or powered off state, it can still continuously monitor physical intrusion attempts (such as detecting unauthorized opening of the chassis) and trigger key destruction logic.

[0151] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods according to the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method.

[0152] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0153] The foregoing has provided a detailed description of a computing device provided in this application. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the embodiments above are only intended to help understand the method and core ideas of this application. It should be noted that those skilled in the art can make various improvements and modifications to this application without departing from its principles, and these improvements and modifications also fall within the protection scope of the claims of this application.

Claims

1. A computing device, characterized in that, include: The processor and memory, the memory including: a memory controller, a key generator, and a storage device, the processor being connected to the memory controller, the memory controller being connected to both the key generator and the storage device, wherein... The processor is configured to initiate a data access request to the memory controller during the execution of a processor task, wherein the data access request is configured to request the execution of a target access operation on the target task data of the processor task. The memory controller is configured to respond to the data access request, encrypt and decrypt the target task data using the data key corresponding to the target task data to obtain reference task data, and invoke the memory to perform the target access operation on the reference task data; The key generator is used to generate data keys; The memory is used to store task data of the processor tasks for the processor.

2. The computing device according to claim 1, characterized in that, The memory further includes a power interface and a memory register. The power interface is connected to both the memory controller and the key generator. The memory register is connected to the memory controller. The power interface is used to supply power to the memory controller and the key generator; The memory register is used to store data keys, wherein the physical address space corresponding to the memory register is not mapped to the physical address space of the processor; The memory controller is also configured to detect the power supply status of the power interface; and if the power supply status indicates an abnormal power supply to the power interface, delete the data key stored in the memory register.

3. The computing device according to claim 2, characterized in that, The memory controller is used for: When the data access request is used to request the execution of a target write operation on the target task data of the processor task, the target task data is encrypted using the data key corresponding to the target task data; When the data access request is used to request the execution of a target read operation on the target task data of the processor task, the target task data is decrypted using the data key corresponding to the target task data. The target access operation includes the target write operation and the target read operation, and the encryption / decryption process includes the encryption process and the decryption process.

4. The computing device according to claim 3, characterized in that, The memory controller is used for: The target task data is extracted from the data access request, and the idle data key is obtained from the memory register as a reference data key, wherein the idle data key is the data key for which no encryption or decryption task is currently being performed; The target task data is encrypted using the reference data key.

5. The computing device according to claim 4, characterized in that, The memory controller is used for: Detect whether there is an idle data key in the memory register; If no idle data key exists in the memory register, a key generation request is sent to the key generator to obtain a candidate data key returned by the key generator in response to the key generation request; the candidate data key is stored in the memory register and used as the reference data key; If a data key exists in the memory register that is in an idle state, the data key in the idle state is obtained as the reference data key.

6. The computing device according to claim 3, characterized in that, The memory controller is used for: Extract the target read address from the data access request, wherein the target read address is the physical address of the target task data in the memory; The target task data is retrieved from the memory according to the target read address, and the target data key corresponding to the target task data is found from the memory register. The target task data is the data obtained after encrypting the reference task data using the target data key. The target data key is used to decrypt the target task data.

7. The computing device according to claim 1, characterized in that, The key generator includes a transmitting unit and a receiving unit, which are connected together. The memory controller is connected to both the transmitting unit and the receiving unit. The transmitting unit is configured to respond to a key generation request, generate an optical signal carrying multiple target quantum states, and transmit the optical signal carrying the multiple target quantum states to the receiving unit, wherein the target quantum states include at least one of a target polarization state, a target phase state, a target time-coded state, and a target photon number state; The receiving unit is configured to receive an optical signal carrying the plurality of target quantum states; detect the optical signal carrying the plurality of target quantum states to obtain the plurality of target quantum states; find the plurality of target bit values ​​corresponding to the plurality of target quantum states from the quantum states and bit values ​​with corresponding relationships; combine the plurality of target bit values ​​to obtain the data key; and send the data key to the memory controller.

8. The computing device according to claim 7, characterized in that, The transmitting unit includes a light source assembly and a modulation assembly. The light source assembly is connected to the receiving unit via the modulation assembly. The light source assembly is also connected to the memory controller. The light source component is used to respond to the key generation request, emit a light beam of a preset wavelength, and direct the light beam into the modulation component; The modulation component is used to perform quantum state modulation on the light beam to obtain an optical signal carrying the plurality of target quantum states, and to transmit the optical signal carrying the plurality of target quantum states to the receiving unit. The quantum state modulation includes at least one of polarization state modulation, phase state modulation, time-coded state modulation, and photon number state modulation. The polarization state modulation is used to control the photon polarization direction of the light beam, the phase state modulation is used to control the photon phase difference of the light beam, the time-coded state modulation is used to control the photon emission time interval of the light beam in the time domain, and the photon number state modulation is used to control the photon number distribution of the light beam.

9. The computing device according to claim 7, characterized in that, The receiving unit includes a detection component and a demodulation component. The transmitting unit is connected to the demodulation component via the detection component. The demodulation component is connected to the memory controller. The detection component is used to receive an optical signal carrying the plurality of target quantum states; perform quantum state detection on the optical signal carrying the plurality of target quantum states to obtain the plurality of target quantum states, and transmit the plurality of target quantum states to the demodulation component. The quantum state detection includes at least one of polarization state detection, phase state detection, time-coded state detection, and photon number state detection. The polarization state detection is used to detect the polarization direction of photons in the optical signal; the phase state detection is used to detect the phase difference of photons in the optical signal; the time-coded state detection is used to detect the emission time interval of photons in the optical signal in the time domain; and the photon number state detection is used to detect the number distribution of photons in the optical signal. The demodulation component is used to find the multiple target bit values ​​corresponding to the multiple target quantum states from the quantum states and bit values ​​with corresponding relationships; combine the multiple target bit values ​​to obtain the data key; and send the data key to the memory controller.

10. The computing device according to claim 1, characterized in that, The memory controller is used for: When the data access request is used to request a target write operation on the target task data of the processor task, the target write address is extracted from the data access request, wherein the target write address is the physical address of the target task data to be written to the memory; the memory is invoked to write the reference task data to the target write address; When the data access request is used to request a target read operation on the target task data of the processor task, the reference task data is transferred to the processor, wherein the target access operation includes the target write operation and the target read operation.

Images