Cost-efficient solid state disk based on host end resource borrowing and host

Abstract

The invention discloses a cost-effective solid state disk based on host end resource borrowing and a host. The hard disk comprises a nonvolatile memory, a memory resource, a CXL TSP characteristic module, a CXL driven communication module, a load detection module and a firmware binary code. The firmware binary code is stored in a nonvolatile memory and is used for executing a solid state disk management function by borrowing computing resources of a host after being uploaded to an enclave of the host; the communication module driven by the CXL is responsible for performing communication interaction with an SGX enclave in a host end; the CXL TSP characteristic module is used for ensuring confidentiality and integrity of communication interaction; the load detection module is used for monitoring the load of the I / O request, and when the load is higher than a threshold value, a daemon thread located at a host end is notified to load a firmware binary code to a host and start the host; the nonvolatile memory is used for storing data. According to the invention, efficient and safe host end resource use can be realized.

Description

Technical Field

[0001] This invention belongs to the field of computer technology and relates to a cost-effective solid-state drive and host based on host-side resource borrowing. Background Technology

[0002] A solid-state drive (SSD) is a storage device that uses flash memory chips as its storage medium. This storage device mainly consists of flash memory chips and an SSD controller. The SSD controller comprises multiple embedded ARM processors, a DRAM controller, an NVMe controller, and dedicated processing elements (such as a DMA engine). Due to the ever-increasing bandwidth available in SSDs, a significant amount of computing and memory resources are required. These substantial and expensive computing and memory resources account for 30% and 10% of the cost of a 1TB SSD, respectively, prompting the exploration of cost-effective SSD architectures.

[0003] Compute eXpress Link (CXL) is an emerging interconnect standard that reshapes the interaction between hosts and peripheral devices such as solid-state drives (SSDs). Specifically, CXL introduces three protocols: an I / O semantic protocol (CXL.io) and a cache-coherent memory semantic protocol for accessing host memory (CXL.cache) and device memory (CXL.mem). CXL.mem allows the host CPU to map device memory as cacheable storage into the host address space, i.e., host-managed device memory (HDM). This allows the host to access device memory through fine-grained load and store instructions. Similarly, CXL.cache allows devices to cache host memory with cache coherency. These protocols not only establish a unified memory space with cache coherency between the host and devices but also enable fast, direct access to memory without operating system intervention.

[0004] A Trusted Execution Environment (TEE) is an isolated runtime environment developed to defend against attacks from compromised operating systems or malicious entities. TEEs allow applications to execute securely. CPU manufacturers offer different TEE implementations for their respective computing platforms, such as Intel's Software Guard Extensions (SGX). Applications are divided into untrusted and sensitive parts. To protect the sensitive (trusted) parts, SGX provides a protected secure container called an "enclave." During runtime, sensitive application data and code are encrypted in a special host memory region called the "enclave page cache." The processor decrypts this encrypted data when loading it into the CPU cache and encrypts it again when writing it to the enclave page cache. This encryption process prevents other software from accessing the sensitive enclave page cache contents. Furthermore, SGX implements access control to ensure that only the enclave can access its enclave page cache memory.

[0005] To achieve cost-effective solid-state drives (SSDs), the industry has proposed an Open Channel Solid-State Drive (OCSSD). Unlike traditional SSDs, OCSSDs retain only basic flash memory control functions (such as flash read and write), while delegating flash memory management to the host machine.

[0006] However, OCSSD simply replaces the internal resources of the SSD with host resources, which can actually lead to resource contention issues on the host side. In particular, OCSSD statically reserves excessive memory to accommodate the mapping table. In general-purpose computing platforms, when servers deploy multiple large storage devices (e.g., exceeding 500TB of storage capacity), this huge memory demand directly competes with user applications because the applications are also memory-intensive. On the other hand, this open-source implementation violates the principle of protecting firmware algorithm confidentiality for SSD manufacturers, making them less motivated to promote the development of OCSSD.

[0007] Open Channel Solid State Drives (OCSSDs) are currently a representative cost-effective solid state drive architecture, such as... Figure 1As shown. Unlike traditional solid-state drives (SSDs), OCSSD retains only basic flash control functions (such as flash read / write) instead of a complete controller, thus eliminating expensive internal computing and memory resources. OCSSD delegates flash management to the Linux LightNVM subsystem. On top of LightNVM, Linux implements host-based open-source firmware functionality, which maintains the entire Flash Translation Layer (FTL) mapping table in host memory and performs firmware tasks to organize the raw flash memory into a traditional SSD.

[0008] While the above approach offers some cost-effectiveness, it also presents a trade-off between memory contention and performance: even under low I / O traffic, the OCSSD static memory usage scheme consistently consumes a significant amount of memory. Deploying multiple SSDs on the server further complicates the memory contention issue, especially considering that applications typically consume over 90% of the host's memory. However, OCSSD performance is heavily reliant on using a large amount of memory to store all flash translation layer metadata. Summary of the Invention

[0009] To address the problems existing in the prior art, the purpose of this invention is to provide a cost-effective solid-state drive and host based on host-side resource borrowing.

[0010] This invention assists internal SSD tasks by dynamically utilizing host resources: Static resource usage schemes for OCSSDs struggle to balance resource contention and SSD performance; however, this invention's in-depth analysis of host resource utilization characteristics inspires a dynamic resource usage method to ensure stable SSD performance and prevent excessive resource contention. Specifically, this invention observes that a limited number of SSDs occasionally experience I / O bursts at any given time. This indicates that dynamically allocating host memory to SSDs on demand can potentially reduce concurrent memory usage. Furthermore, CPU utilization trends suggest that SSDs can utilize unused host CPUs during high I / O loads without impacting application performance. Based on the above analysis, this invention proposes a novel cost-effective SSD architecture that reserves adequate internal resources (such as compute and memory resources) to meet the resource requirements of internal SSD tasks under low I / O loads, thereby isolating internal SSD tasks from user applications during low I / O loads. In addition, this architecture integrates a load detection module into the SSD firmware, which dynamically utilizes host resources to handle I / O bursts when high I / O loads are detected.

[0011] This invention enables efficient and secure host-side resource utilization: Impaired collaboration between the host and the SSD, along with the risk of firmware leakage, hinders host-side resource utilization. This invention utilizes CXL to unify host memory with the SSD's internal DRAM, while providing fine-grained and cache-consistent memory semantics, thereby enhancing this collaboration. Furthermore, TEE technology effectively defends against potential attacks on host-based firmware execution. However, integrating these two technologies simultaneously is not easy. Enabling CXL's unified memory exposes the SSD's internal DRAM to potential unauthorized access by host-side attackers, potentially leading to sensitive information leakage. To mitigate this risk, this invention utilizes the TEE security protocol to establish an authentication mechanism that restricts access to the SSD's internal DRAM to only trusted enclaves. This invention further designs a secure and efficient communication mechanism that enables the enclave and the SSD to collaboratively handle I / O bursts.

[0012] This invention is based on a cost-effective solid-state drive that utilizes host-side resources, such as... Figure 2 As shown: 1. Initialization: a) An internal key is generated at the factory and stored in the NAND flash memory. This internal key is then used to encrypt the firmware binary code of the solid-state drive and store it in the NAND flash memory to ensure that the firmware logic cannot be stolen by malicious programs. The binary code will be used to upload to an enclave on the host to utilize the host's computing resources to perform solid-state drive management functions.

[0013] b) Initialize the load detection module inside the solid-state drive (SSD), which continuously monitors the I / O load by monitoring the load of the NVMe controller inside the SSD.

[0014] 2. Load detection: a) When the load detection module detects a peak load, it sends a signal to the daemon thread on the host, prompting the thread to start the enclave and then load the encrypted firmware.

[0015] 3. Utilize host-side resources: a) The enclave utilizes the host's computing power to handle most I / O requests.

[0016] b) The enclave uses the efficient communication mechanism built by CXL to receive requests from the solid-state drive, process them, and transmit the translated addresses back to the flash memory.

[0017] c) The enclave acquires a portion of the host's memory resources to build the FTL cache.

[0018] The technical solution of this invention is as follows: A cost-effective solid-state drive based on host-side resource borrowing is characterized by comprising non-volatile memory, memory resources, a CXL TSP feature module, a CXL-driven communication module, a load detection module, and firmware binary code. The firmware binary code is stored in the non-volatile memory and is used to upload to the host's enclave and then use the host's computing resources to perform solid-state drive management functions, process I / O requests, and drive the non-volatile memory to read and write data. The communication module driven by CXL is responsible for communicating and interacting with the SGX enclave in the host. The CXL TSP feature module is used to ensure the confidentiality and integrity of communication interactions; The load detection module is used to monitor the load of I / O requests. When the load is higher than a set threshold, it notifies the daemon thread located on the host to load the firmware binary code into the host and start it. The non-volatile memory is used to store data.

[0019] Furthermore, the CXL TSP feature module first utilizes CXL's support for SGX to achieve secure CXL memory access that relies solely on PCIe encrypted communication; then, it utilizes CXL's cache consistency to enable memory-based message communication between SGX and the solid-state drive.

[0020] Furthermore, the CXL TSP feature module utilizes the fine-grained memory access provided by CXL to implement a CXL-based FTL cache, thereby accelerating FTL mapping conversion.

[0021] Furthermore, the load detection module monitors the load of I / O requests by monitoring the load of the NVMe controller inside the solid-state drive.

[0022] Furthermore, the non-volatile memory is NAND Flash.

[0023] Furthermore, the firmware binary code is encrypted using the internal key generated when the solid-state drive is manufactured and then stored in the NAND flash memory module.

[0024] A host computer, characterized in that it comprises a high-speed volatile storage unit, a CXL root complex, a central processing unit (Host CPU), and the aforementioned cost-effective solid-state drive; wherein, The central processing unit (Host CPU) is used to perform computing tasks and manage system operations. The high-speed volatile storage unit is used to store the stack and data during program execution; wherein, the high-speed volatile storage unit is provided with an EPC area for storing encrypted FTL information; The CXL root complex is used to run the CXL interconnect protocol stack and handle CXL requests with the solid-state drive; The central processing unit (Host CPU) has a daemon thread for running the SGX enclave and the high-load processing module. The high-load processing module receives high-load signals from the solid-state drive (SSD) and initializes the SGX enclave. After the SGX enclave is initialized, the ecall instruction is used to enter the SGX enclave and execute the firmware binary code to handle the load. When the load decreases, the SGX enclave will exit to the daemon thread via the ocall instruction. The SGX enclave is used to run a set confidential program and protect the data within the program.

[0025] Furthermore, the confidential program set in the SGX enclave includes the firmware binary code, the CXL-driven communication module, and the CXL TSP feature module. The firmware binary code in the SGX enclave is used to ensure firmware confidentiality while handling I / O requests. The CXL-driven communication module in the SGX enclave is used to send the firmware-processed I / O requests to the solid-state drive. The CXL TSP feature module in the SGX enclave is used to ensure the confidentiality and integrity of communication between the CXL-driven communication module in the SGX enclave and the CXL-driven communication module in the cost-effective solid-state drive.

[0026] Furthermore, the EPC area stores the CPU-encrypted FTL information of the host.

[0027] Furthermore, the high-speed volatile storage unit is DRAM; the daemon thread loads the firmware binary code into the SGX enclave and starts it.

[0028] The advantages of this invention are as follows: 1. Traditional OCSSD solid-state drive architectures employ a static host-side resource usage model, which leads to severe resource contention issues with applications. This invention, however, uses a dynamic host-side resource usage model, reducing this resource contention while ensuring solid-state drive performance.

[0029] 2. This invention introduces dynamic host-side resource borrowing, CXL, and TEE technologies. Dynamic host-side resource borrowing can alleviate the resource contention problem caused by the fixed occupation of host-side resources in OCSSD, while CXL technology can simplify the coordination problem between the host and SSD. At the same time, TEE technology ensures that the firmware algorithm can be securely executed on the host without being attacked by malicious entities and causing the confidential firmware algorithm to be leaked. Attached Figure Description

[0030] Figure 1 This is the architecture diagram of OCSSD.

[0031] Figure 2 This invention relates to a cost-effective solid-state drive based on host-side resource borrowing. Detailed Implementation

[0032] The present invention will now be described in further detail with reference to the accompanying drawings. The examples given are only for explaining the present invention and are not intended to limit the scope of the present invention.

[0033] This invention is used in solid-state drive (SSD) storage devices that require cost reduction while maintaining SSD performance. This design helps these devices achieve cost-effectiveness and ensure stable performance. Its specific architecture is as follows: Figure 2 As shown. Specifically, this cost-effective solid-state drive (SSD) first modifies the SSD architecture, retaining only a moderate amount of memory and computing resources. To further optimize the secure interaction between the enclave and the SSD, this invention integrates a CXL module and CXL's support for SGX into the SSD, thereby allowing low-overhead CXL memory access. The CXL controller, memory resources, computing resources, and NAND flash memory in the SSD are all hardware units, connected by the SSD's internal bus. The NAND flash memory is a non-volatile memory used to store data. The computing unit, composed of the computing resources (i.e., the ARM processor) and the CXL controller, deploys a CXL TSP feature module, a CXL-driven communication module, a load detection module, and protected firmware. The protected firmware handles I / O requests and drives the NAND flash memory to read and write data, while the CXL-driven communication module handles interaction with the SGX enclave on the host side, and the CXL TSP feature module ensures the confidentiality and integrity of this communication interaction. Furthermore, this invention integrates a load detection module into the firmware within the solid-state drive (SSD) to continuously monitor I / O load. When the load exceeds a threshold, the load detection module notifies a daemon thread located on the host side. Upon receiving the high I / O load signal, the daemon thread loads the encrypted SSD firmware binary code from within the SSD into a trusted SGX enclave and starts it. By starting this firmware on the host side, the SSD can utilize host resources to handle its internal tasks.

[0034] On the host side, the Host CPU is the central processing unit, responsible for executing computing tasks and managing system resources. DRAM is the host's high-speed volatile storage unit, storing the program's runtime stack and data. A small area within DRAM is the Enclave Page Cache (EPC) area, which is encrypted by the CPU to protect the stored FTL information. The CXL Root Complex (CXL RC) runs the CXL interconnect protocol stack, handling CXL requests with the SSD. The daemon threads running on the Host CPU include an SGX enclave and a high-load processing module, both software modules. The high-load processing module receives high-load signals from the SSD and initializes the SGX enclave. Once the SGX enclave is initialized, this module uses the `ecall` instruction to enter the SGX enclave and execute the SSD's firmware binary code to handle the high load. When the load decreases, the SGX enclave exits to the daemon threads using the `ocall` instruction. The SGX enclave is responsible for securely running confidential programs and protecting their confidential data. It runs software modules such as the solid-state drive's firmware binary code, the CXL-driven communication module, and the CXL TSP feature module. The protected firmware within the SGX enclave handles I / O requests while ensuring the confidentiality of the solid-state drive's firmware binary code. The CXL-driven communication module sends the firmware-processed I / O requests to the solid-state drive for NAND flash data read / write operations. The CXL TSP feature module ensures the confidentiality and integrity of this communication. Subsequently, this invention leverages CXL's cache coherency and fine-grained characteristics to construct a memory-based message communication mechanism and an efficient FTL cache.

[0035] 1) Reservation of internal resources of solid-state drives a) To avoid resource competition between the SSD and applications under low load, this invention reserves an appropriate amount of memory and computing resources within the SSD to achieve a certain level of processing power and ensure a certain degree of performance isolation between the SSD and the application. Other underutilized resources and their corresponding costs can be removed to eliminate these costs.

[0036] 2) Efficient and secure dynamic borrowing of host-side resources a) Under high I / O loads, this invention ensures SSD performance through dynamic borrowing. This invention securely executes SSD firmware algorithms in an enclave by borrowing computing resources, while avoiding the leakage of critical algorithm details.

[0037] b) In order to enable the enclave to interact securely with peripheral devices, the present invention first utilizes CXL’s support for SGX to achieve secure CXL memory access that relies solely on low-overhead PCIe encrypted communication, which prevents untrusted enclaves from accessing the internal memory of the solid-state drive.

[0038] c) Building upon secure memory access, this invention further leverages the cache coherency provided by CXL to implement a memory-based message communication mechanism for SGX and solid-state drives, thereby enabling efficient interaction between the two.

[0039] d) Regarding host-side memory borrowing, this invention utilizes the fine-grained memory access provided by CXL to implement a CXL-based high-efficiency FTL cache, thereby accelerating FTL mapping conversion.

[0040] Although specific embodiments of the invention have been disclosed for illustrative purposes to aid in understanding and implementing the invention, those skilled in the art will understand that various substitutions, variations, and modifications are possible without departing from the spirit and scope of the invention and the appended claims. Therefore, the invention should not be limited to the content disclosed in the preferred embodiments, and the scope of protection claimed by the invention is defined by the claims.

Claims

1. A cost-effective solid-state drive based on host-side resource borrowing, characterized in that, This includes non-volatile memory, memory resources, CXL TSP feature modules, CXL-driven communication modules, load detection modules, and firmware binary code; The firmware binary code is stored in the non-volatile memory and is used to upload to the host's enclave and then use the host's computing resources to perform solid-state drive management functions, process I / O requests, and drive the non-volatile memory to read and write data. The communication module driven by CXL is responsible for communicating and interacting with the SGX enclave in the host. The CXL TSP feature module is used to ensure the confidentiality and integrity of communication interactions; The load detection module is used to monitor the load of I / O requests. When the load is higher than a set threshold, it notifies the daemon thread located on the host to load the firmware binary code into the host and start it. The non-volatile memory is used to store data.

2. The cost-effective solid-state drive according to claim 1, characterized in that, The CXL TSP feature module first utilizes CXL's support for SGX to achieve secure CXL memory access that relies solely on PCIe encrypted communication; then, it utilizes CXL's cache consistency to enable memory-based message communication between SGX and the solid-state drive.

3. The cost-effective solid-state drive according to claim 2, characterized in that, The CXL TSP feature module utilizes the fine-grained memory access provided by CXL to implement a CXL-based FTL cache, accelerating FTL mapping conversion.

4. The cost-effective solid-state drive according to claim 1, 2, or 3, characterized in that, The load detection module monitors the load of I / O requests by monitoring the load of the NVMe controller inside the solid-state drive.

5. The cost-effective solid-state drive according to claim 1, 2, or 3, characterized in that, The non-volatile memory is NAND Flash.

6. The cost-effective solid-state drive according to claim 1, characterized in that, The firmware binary code is encrypted using an internal key generated at the time of manufacture of the solid-state drive and then stored in the NAND flash memory module.

7. A host computer, characterized in that, It includes a high-speed volatile memory unit, a CXL root complex, a central processing unit (HostCPU), and the cost-effective solid-state drive as described in claim 1; wherein, The central processing unit (Host CPU) is used to perform computing tasks and manage system operations. The high-speed volatile storage unit is used to store the stack and data during program execution; wherein, the high-speed volatile storage unit is provided with an EPC area for storing encrypted FTL information; The CXL root complex is used to run the CXL interconnect protocol stack and handle CXL requests with the solid-state drive; The central processing unit (Host CPU) has a daemon thread for running the SGX enclave and the high-load processing module. The high-load processing module receives high-load signals from the solid-state drive (SSD) and initializes the SGX enclave. After the SGX enclave is initialized, the ecall instruction is used to enter the SGX enclave and execute the firmware binary code to handle the load. When the load decreases, the SGX enclave will exit to the daemon thread via the ocall instruction. The SGX enclave is used to run a set confidential program and protect the data within the program.

8. The host computer according to claim 7, characterized in that, The confidential program set in the SGX enclave includes the firmware binary code, the CXL-driven communication module, and the CXL TSP feature module. The firmware binary code in the SGX enclave is used to ensure firmware confidentiality while handling I / O requests. The CXL-driven communication module in the SGX enclave is used to send the firmware-processed I / O requests to the solid-state drive. The CXL TSP feature module in the SGX enclave is used to ensure the confidentiality and integrity of communication between the CXL-driven communication module in the SGX enclave and the CXL-driven communication module in the cost-effective solid-state drive.

9. The host computer according to claim 7, characterized in that, The EPC area stores the CPU-encrypted FTL information of the host.

10. The host computer according to claim 7, characterized in that, The high-speed volatile memory unit is DRAM; the daemon thread loads the firmware binary code into the SGX enclave and starts it.

Images