WO2019041272A1 - 一种计算机内存数据加解密的方法及装置 - Google Patents

一种计算机内存数据加解密的方法及装置 Download PDF

Info

Publication number
WO2019041272A1
WO2019041272A1 PCT/CN2017/100067 CN2017100067W WO2019041272A1 WO 2019041272 A1 WO2019041272 A1 WO 2019041272A1 CN 2017100067 W CN2017100067 W CN 2017100067W WO 2019041272 A1 WO2019041272 A1 WO 2019041272A1
Authority
WO
WIPO (PCT)
Prior art keywords
data
nvdimm
written
processor
read
Prior art date
Application number
PCT/CN2017/100067
Other languages
English (en)
French (fr)
Inventor
朗诺斯弗洛里安
杨峰
杨伟
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to CN201780059409.2A priority Critical patent/CN109791589B/zh
Priority to PCT/CN2017/100067 priority patent/WO2019041272A1/zh
Publication of WO2019041272A1 publication Critical patent/WO2019041272A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data

Definitions

  • the present application relates to the field of information technology, and in particular, to a method and an apparatus for encrypting and decrypting computer memory data.
  • Dynamic random access memory is the most commonly used storage system in computers today.
  • the system data and file information of the computer will be stored in the DRAM, but the DRAM saves the data for a short time.
  • the computer needs to refresh the DRAM at a certain time, if the DRAM is certain The data stored in the DRAM will be lost if it is not refreshed within the time limit. When the computer is powered off, it will also cause the data stored in the DRAM to be lost, which may cause the computer system to crash.
  • Non-volatile dual in-line memory module integrates DRAM and non-volatile memory chips. When the computer is powered off, the data can still be saved normally. It will be lost, and when the computer is back to normal and running, it can continue to use the data stored in the NVDIMM, so you can avoid the computer system crash.
  • NVDIMMs have gradually attracted attention.
  • data stored in NVDIMMs needs to be encrypted.
  • the data encryption/decryption operation is usually performed by a central processing unit (CPU) in the computer.
  • CPU central processing unit
  • the CPU in the computer needs to store the data when it is to be stored.
  • the data in the NVDIMM performs encryption operations, and the additional encryption operation increases the CPU bandwidth, causing delays in writing data in the NVDIMM, increasing the power consumption of the CPU, and ultimately reducing the processing efficiency of the computer.
  • the existing method of encrypting and decrypting all data stored in the NVDIMM causes the processing efficiency of the computer to decrease, resulting in an increase in the latency of reading and writing data.
  • the present invention provides a method and apparatus for encrypting and decrypting computer memory data, which is used to solve the problem of encrypting and decrypting all data stored in an NVDIMM existing in the prior art, which may result in a decrease in processing efficiency and an increase in latency of reading and writing data.
  • the big problem is that, in the manner of the present application, the NVDIMM replaces the computer processor to perform the encryption operation, and does not need to encrypt and decrypt all the data stored in the NVDIMM, which can reduce the occupied bandwidth of the processor and reduce the power consumption of the processor. In turn, the delay of reading and writing data by the processor is reduced.
  • the present application provides a method for encrypting computer memory data, the method comprising: when the processor determines that data needs to be written to the NVDIMM, the processor can send a data write command and the data to be written to the NVDIMM
  • the data write command may include an encryption requirement for the data to be written, and the data write command may include an indication bit, where the indication bit is used to indicate whether the data to be written is encrypted;
  • the NVDIMM receives a data write command sent by the processor and data to be written, determining, according to the indication bit, that the data to be written needs to be encrypted, and encrypting the data to be written, and encrypting the data to be written
  • the data to be written is written into the NVDIMM.
  • the processor can set the encryption requirement of the data to be written, and send the requirement to the NVDIMM through the data write instruction, and the NVDIMM completes the encryption and write operation of the data, which can effectively reduce the occupied bandwidth of the processor. Reduce power consumption without encrypting all data written to NVDIMMs, making encryption more flexible.
  • the NVDIMM obtains an encryption key after determining that the data to be written needs to be encrypted, and the encryption key may be generated by the processor of the computer and saved in advance; The encryption key may also be encrypted when the key is encrypted, and then the encrypted encryption key is saved, and then the NVDIMM uses the encryption key to encrypt the data to be written.
  • the encryption key is generated by the processor to ensure that the encryption key is not easily stolen, and the security of the encrypted data is ensured.
  • the present application provides a method for encrypting computer memory data, the method comprising: the processor can send data encryption when determining that the data needs to be written to the NVDIMM and the data to be written is encrypted. And the data to be written to the NVDIMM, the data encryption instruction is used to indicate that the data to be written is encrypted.
  • the NVDIMM receives the data encryption command sent by the processor and the data to be written; the NVDIMM encrypts the data to be written according to the data encryption instruction, and writes the encrypted data to be written In the NVDIMM.
  • the processor can set the encryption requirement of the data to be written, and send the requirement to the NVDIMM through the data encryption instruction, and the NVDIMM completes the encryption and writing operation of the data, which can effectively reduce the occupied bandwidth of the processor. Reduce power consumption without encrypting all data written to NVDIMMs, making encryption more flexible.
  • an encryption key is first acquired, and the encryption key may be generated by the processor and saved in advance; when the encryption key is saved.
  • the encryption key may also be encrypted, and then the encrypted encryption key may be saved, and then the NVDIMM uses the encryption key to encrypt the data to be written.
  • the encryption key is generated by the processor to ensure that the encryption key is not easily stolen, and the security of the encrypted data is ensured.
  • the present application provides a method for decrypting computer memory data, the method comprising: when the processor determines that data needs to be read from the NVDIMM, the processor can send a data read command to the NVDIMM, wherein the data is read.
  • the instruction may include a decryption requirement for the read data, where the data read command may include an indication bit, the indication bit is used to indicate whether to decrypt the read data, and the NVDIMM receives the sent by the processor.
  • a data read command the NVDIMM determines, after the decryption process, that the read data needs to be decrypted according to the indication bit, reads data from the NVDIMM according to the data read command, and performs the read data. Decrypt and send the decrypted data to the processor.
  • the processor can set the decryption requirement for the read data, and send the requirement to the NVDIMM through the data read command, and the NVDIMM completes the decryption and read operation of the data, thereby effectively reducing the bandwidth of the processor. Reduce power consumption without decrypting all data written to NVDIMMs, making the decryption method more flexible.
  • the NVDIMM first acquires a decryption key when determining that the data to be read out needs to be decrypted, wherein the decryption key is generated by the processor and saved in advance; When decrypting the key The decryption key may also be encrypted, and then the encrypted decryption key may be saved, and the NVDIMM decrypts the read data using the decryption key.
  • the decryption key is generated by the processor to ensure that the decryption key is not easily stolen, and the security of the data stored in the NVDIMM is ensured.
  • the present application provides a method for decrypting computer memory data, the method comprising: the processor can send data when determining that data needs to be read from the NVDIMM and the read data needs to be decrypted Decrypting the instruction to the NVDIMM, the data decrypting instruction is for instructing decryption of the read data, the NVDIMM receiving the data decrypting instruction sent by the processor; reading data in the NVDIMM according to the data decrypting instruction, and reading The data is decrypted and the decrypted data is sent to the processor.
  • the processor can set the decryption requirement for the read data, and send the requirement to the NVDIMM through the data decryption instruction, and the NVDIMM completes the decryption and read operation of the data, which can effectively reduce the bandwidth of the processor. Reduce power consumption without eliminating the need to decrypt all data written to NVDIMMs, making the decryption method more flexible.
  • the NVDIMM first acquires a decryption key when determining that the data to be read out needs to be decrypted, wherein the decryption key is generated by the processor and saved in advance;
  • the decryption key may also be encrypted when the key is decrypted, and the encrypted decryption key may be stored, and the NVDIMM decrypts the read data using the decryption key.
  • the decryption key is generated by the processor to ensure that the decryption key is not easily stolen, and the security of the data stored in the NVDIMM is ensured.
  • an embodiment of the present invention provides a storage device, where the storage device has a function of encrypting computer memory data in the example of the foregoing method.
  • the functions may be implemented by hardware or by corresponding software implemented by hardware.
  • the hardware or software includes one or more modules corresponding to the functions described above.
  • the storage device includes a receiving unit, a processing unit, and a storage unit, where the receiving unit is configured to receive a data write command sent by the processor and the data to be written, where the data write command includes an indication bit.
  • the indication bit is used to indicate whether the storage device encrypts the data to be written; the receiving unit sends the data writing instruction and the data to be written to the processing unit; the processing unit is configured to receive the And the data write instruction sent by the receiving unit and the data to be written, and after determining, according to the indication bit in the data write instruction, that the data to be written needs to be encrypted, the to-be-written
  • the data is encrypted, and the encrypted data to be written is written into the storage unit in the storage device, and the storage unit is configured to store data.
  • the processing unit acquires an encryption key when performing encryption processing on the data to be written, wherein the encryption key is generated by the processor and saved in advance; The processing unit performs encryption processing on the data to be written by using the encryption key.
  • the storage device is a non-volatile dual in-line memory module NVDIMM.
  • an embodiment of the present invention provides a storage device, where the storage device has a function of encrypting computer memory data in the example of the foregoing method.
  • the functions may be implemented by hardware or by corresponding software implemented by hardware.
  • the hardware or software includes one or more modules corresponding to the functions described above.
  • the storage device includes a receiving unit, a processing unit, and a storage unit, where the receiving unit is configured to receive a data encryption instruction sent by a processor of the computer and the data to be written, where the data encryption instruction is used to indicate the The data to be written is encrypted, and the data encryption instruction and the data to be written are sent to the processing unit; the processing unit is configured to receive the data encryption instruction and the data to be written by the receiving unit, Write data to be added And encrypting the encrypted data to be written into the storage unit in the storage device according to the data encryption instruction; the storage unit is configured to store data.
  • the processing unit acquires an encryption key when performing encryption processing on the data to be written, wherein the encryption key is generated by the processor and saved in advance; The processing unit performs encryption processing on the data to be written by using the encryption key.
  • the storage device is a non-volatile dual in-line memory module NVDIMM.
  • an embodiment of the present invention provides a storage device, which has a function of decrypting computer memory data in the foregoing method example.
  • the functions may be implemented by hardware or by corresponding software implemented by hardware.
  • the hardware or software includes one or more modules corresponding to the functions described above.
  • the storage device includes a receiving unit, a processing unit, and a storage unit.
  • the receiving unit is configured to receive a data read command sent by a processor of the computer, where the data read command includes an indication bit, where the indicator bit is used to indicate whether the read data is decrypted, and the data read command is sent to a processing unit, configured to receive a data readout command sent by the receiving unit, and determine, according to the indication bit in the data readout instruction, that the read data needs to be decrypted, according to the data
  • the read command reads data from the storage unit of the storage device, decrypts the read data, and transmits the decrypted data to a processor; the storage unit is configured to store data.
  • the decryption key is first acquired, where the decryption key is generated by the processor and saved in advance; The key decrypts the data read.
  • the storage device is a non-volatile dual in-line memory module NVDIMM.
  • an embodiment of the present invention provides a storage device, where the storage device has a function of decrypting computer memory data in the foregoing method example.
  • the functions may be implemented by hardware or by corresponding software implemented by hardware.
  • the hardware or software includes one or more modules corresponding to the functions described above.
  • the storage device includes a receiving unit, a processing unit, and a storage unit.
  • the receiving unit is configured to receive a data decryption instruction sent by a processor of the computer, where the data decryption instruction is used to indicate that the read data is decrypted, and the data decryption instruction is sent to the processing unit;
  • the processing unit is configured to receive the Decoding a data decryption instruction sent by the receiving unit, reading data in the storage unit of the storage device according to the data decryption instruction; performing decryption processing on the read data, and sending the decrypted data to the data a processor;
  • the storage unit is configured to store data;
  • the processing unit first acquires a decryption key when decrypting the read data, wherein the decryption key is generated by the processor and saved in advance; The key decrypts the data read.
  • the storage device is a non-volatile dual in-line memory module NVDIMM.
  • an embodiment of the present invention provides a computer, where the computer includes a processor and an NVDIMM, and the processor is configured to send a data write command and when determining that the data to be written needs to be written to the NVDIMM Data to be written to the NVDIMM, the data write command includes an indication bit for indicating whether to encrypt the data to be written; and the NVDIMM is configured to receive data sent by the processor of the computer Writing an instruction and data to be written, after determining, according to the indication bit, that the data to be written needs to be encrypted, encrypting the data to be written, and encrypting the data to be written Write to the NVDIMM.
  • the NVDIMM first acquires an encryption key when encrypting data to be written, wherein the encryption key is generated by the processor and saved in advance; and then the encryption key is used to The write data is described for encryption processing.
  • an embodiment of the present invention provides a computer, where the computer includes a processor and an NVDIMM, and the processor is configured to: when it is determined that data to be written needs to be written to the NVDIMM, When the data is written for encryption, the data encryption instruction and the data to be written are sent to the NVDIMM, the data encryption instruction is used to indicate that the data to be written is encrypted; and the NVDIMM is used to receive data sent by the processor of the computer. Encrypting instructions and data to be written; encrypting the data to be written according to the data encryption instruction, and writing the encrypted data to be written into the NVDIMM.
  • an encryption key is first acquired, wherein the encryption key is generated by the processor and saved in advance; and the encryption is reused.
  • the key performs encryption processing on the data to be written.
  • an embodiment of the present invention provides a computer, where the computer includes a processor and an NVDIMM, and the processor is configured to send a data read command to the NVDIMM when determining that data needs to be read from the NVDIMM.
  • the data read command includes an indication bit, the indication bit is used to indicate whether the NVDIMM decrypts the read data, and the NVDIMM is configured to receive a data read command sent by the processor, according to the indication bit. Determining that the read data needs to be decrypted, reading data from the NVDIMM according to the data read command, decrypting the read data, and transmitting the decrypted data to a process Device.
  • the NVDIMM when the NVDIMM decrypts the read data, first acquire a decryption key, wherein the decryption key is generated by a processor of the computer and saved in advance; The key decrypts the read data.
  • an embodiment of the present invention provides a computer, where the computer includes a processor and an NVDIMM, and the processor is configured to: when determining that data needs to be read from the NVDIMM, and the read data needs to be decrypted, Transmitting a data decryption instruction to the NVDIMM, the data decryption instruction is for indicating decryption of the read data; the NVDIMM is configured to receive a data decryption instruction sent by the processor of the computer; and the data decryption instruction is in the NVDIMM according to the data The data is read, the read data is decrypted, and the decrypted data is sent to the processor.
  • the method is: acquiring a decryption key, where the decryption key is generated by the processor and saved in advance; The decryption key decrypts the read data.
  • the embodiment of the present application further provides a computer storage medium, where the software program stores a software program, where the software program can implement the first aspect and the second when being read and executed by one or more processors.
  • the third aspect, the fourth aspect, or any one of the above aspects provides a method of designing.
  • the embodiment of the present application further provides a computer chip, where the chip is connected to a memory, and is configured to read and execute a software program stored in the memory, so that the computer performs the first aspect and the second aspect.
  • a method provided by any one of the third aspect, the fourth aspect or any of the above aspects.
  • the processor when the data needs to be written, the processor informs the NVDIMM of the encryption requirement of the data to be written by the indication bit of the data write instruction or the data encryption instruction by the requirement; when the data needs to be read, the processor Through the requirement, the indication bit of the data readout instruction or the data decryption instruction informs the NVDIMM of the decryption requirement of the read data, and the NVDIMM completes the operation of adding/decrypting and reading and writing data, thereby effectively reducing the occupation of the processor. Wide, reduce power consumption, and eliminate the need to encrypt and decrypt all data written to NVDIMM, making the encryption and decryption method more flexible.
  • FIG. 1 is a schematic structural diagram of a system of a computer according to an embodiment of the present application.
  • FIG. 2 is a schematic structural diagram of a page table according to an embodiment of the present application.
  • FIG. 3 is a schematic diagram of a method for determining a C-bit bit according to an embodiment of the present disclosure
  • FIG. 4 is a flowchart of a method for encrypting computer memory data according to an embodiment of the present application
  • FIG. 5 is a flowchart of a method for encrypting computer memory data according to an embodiment of the present application
  • FIG. 6 is a flowchart of a method for decrypting computer memory data according to an embodiment of the present application.
  • FIG. 7 is a flowchart of a method for decrypting computer memory data according to an embodiment of the present application.
  • FIG. 8 is a schematic structural diagram of a first storage device according to an embodiment of the present disclosure.
  • FIG. 9 is a schematic structural diagram of a first computer according to an embodiment of the present application.
  • FIG. 10 is a schematic structural diagram of a second storage device according to an embodiment of the present disclosure.
  • FIG. 11 is a schematic structural diagram of a second computer according to an embodiment of the present application.
  • FIG. 12 is a schematic structural diagram of a third storage device according to an embodiment of the present application.
  • FIG. 13 is a schematic structural diagram of a third computer according to an embodiment of the present application.
  • FIG. 14 is a schematic structural diagram of a fourth storage device according to an embodiment of the present disclosure.
  • FIG. 15 is a schematic structural diagram of a fourth computer according to an embodiment of the present application.
  • the processor of the embodiment of the present invention includes, but is not limited to, a central processing unit (CPU), an ASIC (application specific integrated circuit), and an FPGA (field-programmable gate array).
  • CPU central processing unit
  • ASIC application specific integrated circuit
  • FPGA field-programmable gate array
  • a programming gate array, a CPLD (complex programmable logic device), and an IC circuit having an information processing function are all applicable to the embodiments of the present invention.
  • the encryption key and the decryption key, the parameters required for the encryption/decryption processing of the data, the encryption key and the decryption key correspond to each other, and may be the same or different, depending on the key generation algorithm.
  • the storage address information or the data encryption instruction needs to include the storage address information for processing.
  • the data is written to the storage area corresponding to the storage address information, and the storage address information may be physical address information of the storage area in the NVDIMM, corresponding to the storage area of the NVDIMM; in the embodiment of the present invention, when the processor When the data needs to be read, the read address information may be included in the data read command or the data decryption instruction to obtain the data stored in the storage area corresponding to the read address information, and the read address information may be the storage area in the NVDIMM. Physical address information corresponding to a storage area of the NVDIMM.
  • data to be read and data to be written in the embodiment of the present invention, when the processor needs to write data to the NVDIMM, the data that needs to be written into the NVDIMM can be referred to as data to be written;
  • the data that needs to be read in the NVDIMM can be referred to as data to be read, and the data to be read is the storage area corresponding to the read address information in the data read instruction or the data decryption instruction.
  • the encryption status of the data stored in the NVDIMM may be stored in the processor or the NVDIMM, for example, using a C-bit record in a page table entry, where the encryption status is used to indicate storage. Whether the data is in an encrypted state or a non-encrypted state, if it is in an encrypted state, it indicates that encryption processing is required when writing the data, decryption processing is required when reading the data, and writing is performed in the case of non-encrypted state. Encryption processing is not required when the data is entered, and decryption processing is not required when reading the data.
  • data write command and data read command when the processor needs to write data to the NVDIMM, the processor sends a command to the NVDIMM as a data write command, wherein an indication bit can be set to instruct the NVDIMM to write the data.
  • the indicator bit can set different setting values to indicate that the NVDIMM is to be encrypted for writing data and the NVDIMM to be written data is not encrypted; when the processor needs to read data from the NVDIMM, the processor sends the NVDIMM to the NVDIMM
  • the instruction is a data read command, wherein an indication bit can be set to indicate whether the NVDIMM is to decrypt the data to be read, and the indication bit can be set with different set values to respectively instruct the NVDIMM to decrypt the data to be read and the NVDIMM to read the data. Do not decrypt.
  • data encryption instruction and data decryption instruction when the processor needs to write data to the NVDIMM, and needs to encrypt the data to be written, the instruction sent by the processor to the NVDIMM is a data encryption instruction, and the processor needs to be slave NVDIMM
  • the instructions sent by the processor to the NVDIMM are data decryption instructions
  • the data encryption instructions and the data decryption instructions are newly defined data instructions, which may include storing address information and reading Address information indicating the storage address to be written to the NVDIMM and the read address when reading data from the NVDIMM.
  • multiple means two or more.
  • the solution of the embodiment of the present application can be applied to various devices, including but not limited to a personal computer, a server computer, a handheld or laptop device, a mobile device (such as a tablet computer, a personal digital assistant, etc.), a small computer, a large computer. Wait.
  • a personal computer a server computer, a handheld or laptop device, a mobile device (such as a tablet computer, a personal digital assistant, etc.), a small computer, a large computer. Wait.
  • a mobile device such as a tablet computer, a personal digital assistant, etc.
  • FIG. 1 it is a schematic diagram of a hardware structure of a computer 100 applied to an embodiment of the present application.
  • the computer includes a processor 110, an NVDIMM 120, and a memory 130.
  • the memory 130 can be used to store software programs and data, and the processor 110 executes various functions of the computer and performs data processing by running software programs and data stored in the memory 130.
  • the memory 130 mainly includes a program storage area and a data storage area, wherein the program storage area can store an operating system, an application required for at least one function (such as a function of controlling a computer to enter a sleep state, etc.), and the like; the data storage area can be stored according to the computer
  • the data created by the use process such as a page table (PT), etc., can store a plurality of page tables in the memory 130, and each page table corresponds to one physical storage area in the NVDIMM.
  • the memory 130 may be a high speed random access memory, and may also be a nonvolatile memory such as at least one magnetic disk storage device, flash memory device, or other volatile solid state storage device.
  • the processor 110 is a control center of a computer that connects various parts of the entire computer using various interfaces and lines, and performs various functions and data processing of the computer by running or executing software programs and/or data stored in the memory 130, thereby Overall monitoring of the computer.
  • the processor 110 includes a memory management unit (MMU) 111, a memory controller 112, and the like for performing related operations to implement the technical solutions provided by the embodiments of the present application.
  • MMU memory management unit
  • the NVDIMM 120 includes a decoder 121, a controller 122, and an NVDIMM storage area 123.
  • the decoder 121 decodes the instructions sent by the processor 110, and sends the instructions to the controller 122.
  • the controller 122 performs related operations.
  • the NVDIMM storage area 123 is an area in the NVDIMM for storing data, and includes a nonvolatile storage area and a volatile storage area (for example, may be DRAM).
  • the processor 110 controls the memory management unit 111 to write data or read data in the NVDIMM according to the page table stored in the memory 130, as shown in FIG. 2, which is a page table structure diagram, and the page table includes multiple page tables.
  • each page table entry includes information such as a page virtual address and a page physical address and a C-bit bit.
  • the memory management unit 111 may be based on a page in the page table.
  • the table entry is implemented to perform a write data operation in the NVDIMM, and the memory management unit 111 can set the C-bit of the page table entry to indicate the encryption status of the data stored in one storage area of the corresponding NVDIMM.
  • the memory management unit 111 can set C.
  • a -bit of 1 indicates that the data stored in one of the storage areas of the corresponding NVDIMM is in an encrypted state; setting a C-bit of 0 indicates that the data stored in one of the corresponding NVDIMMs is in an unencrypted state.
  • the above-described manner of recording the encrypted state and the non-encrypted state of the data stored by the NVDIMM by using the C-bit is merely an example, and some compact structures of the memory controller 112 may be utilized, for example, Bloom Filter may be used for recording encryption.
  • Bloom Filter may be used for recording encryption.
  • the manner in which the encryption status of the data stored by the NVDIMM can be recorded is applicable to the embodiment of the present invention.
  • the first case the computer needs to store data, and the stored data needs to be encrypted.
  • the processor allocates a new page table entry PTE in the memory for the data to be stored, and records the data storage in the page table entry.
  • the page virtual address and the information of the offset within the cache block and controls the memory management unit to set the C-bit of the page table entry in the new page table entry to 1 to indicate that the stored data needs to be encrypted.
  • the processor caches the set new page table entry into a TLB (translation lookaside buffer).
  • TLB translation lookaside buffer
  • the control memory management unit translates the virtual address into a physical address and determines a new page table. Whether the C-bit of the entry is 0 or 1, the C-bit information in the new page table entry is recorded in the corresponding cacheline metadata according to the C-bit information of the new page table entry.
  • the memory management unit writes the page table entry cached in the TLB to the memory controller, and then the memory controller parses when receiving the C-bit information in the cache coherent interconnect (CHI) request.
  • the C-bit information in the cache coherent interconnect request after determining that the C-bit is 1, the memory controller sends a data write command and a data to be written to the NVDIMM, where the data write command includes Having storage address information and an indication bit, the indication bit is used to instruct the NVDIMM to encrypt the data to be written; or the memory controller sends a data encryption instruction and a data to be written to the NVDIMM, the data encryption instruction And is used to instruct the NVDIMM to encrypt the data to be written.
  • the decoder in the NVDIMM After the decoder in the NVDIMM receives the data write command or the data encryption command, the decoder decodes the data write command or the data encryption command, and writes the decoded data into the command. Or the data encryption command is sent to the controller in the NVDIMM, and the controller in the NVDIMM selects the data to be written to be encrypted according to the decoded data write command or the data encryption command, and saves the encrypted data to be written in the The data write instruction or the storage area corresponding to the storage address information indicated by the data encryption instruction.
  • the second case the computer needs to store data, and the stored data does not need to be encrypted.
  • the processor determines that data needs to be stored, and the stored data does not need to be encrypted, the processor allocates a new page table entry PTE for the data to be stored in the storage area, and controls the memory management unit to set a new page table entry.
  • the C-bit is 0 to indicate that the data to be stored does not need to be encrypted.
  • the processor caches the set new page table entry into the TLB, and the processing operation of the page table entry is similar to the process described in the first case above, and details are not described herein again.
  • the memory management unit writes a new page table entry cached in the TLB to the memory controller, and when the received cache coherent interconnect request carries the C-bit information, the memory controller parses the cache coherent interconnect The information of the C-bit in the request, after determining that the C-bit is 0, the memory controller sends a data write command and a data to be written to the NVDIMM, wherein the data write command includes the storage address information and the indication. Bit, the indication bit is used to indicate that the NVDIMM does not encrypt the data to be written.
  • the decoder in the NVDIMM After the decoder in the NVDIMM receives the data write command, the decoder decodes the data write command, and sends the decoded data write command to the controller in the NVDIMM, in the NVDIMM.
  • the controller directly saves the data to be written in the storage area corresponding to the storage address information indicated by the data write instruction according to the decoded data write instruction.
  • the first case the computer needs to read the data, and the data to be read needs to be decrypted.
  • the processor determines that the data stored in the NVDIMM needs to be read, the processor retrieves the page table entry PTE corresponding to the data to be read, and determines that the C-bit in the retrieved page table entry is 0 or 1, C-bit information in the corresponding cacheline metadata record page table entry (PTE) according to the C-bit information of the page table entry; the memory management unit writes the page table entry cached in the TLB to the memory controller, followed by When the memory controller carries the C-bit information in the received cache coherent interconnection request, the memory controller parses the C-bit information in the cache coherent interconnection request, and after determining that the C-bit is 1, The memory controller sends a data read command to the NVDIMM, where the data read command includes read address information and an indication bit, the indication bit indicates that the NVDIMM is to decrypt the data to be read; or the memory controller sends the data. Decrypting instructions into the NVDIMM, the data decryption instructions instructing the NVDIMM to decrypt
  • the decoder in the NVDIMM After the decoder in the NVDIMM receives the data read command, the decoder decodes the data read command or the data decrypt command, and sends the decoded data read command or data decrypt command to the NVDIMM.
  • the controller in the NVDIMM reads the data stored in the storage area corresponding to the read address information according to the decoded data read command or the data decryption command, decrypts the read data, and decrypts The subsequent data is sent to the processor.
  • the second case the computer needs to read the data, and the data to be read does not need to be decrypted.
  • the processor determines that the data stored in the NVDIMM needs to be read, the processor retrieves the page table entry PTE corresponding to the data to be read, and the processor caches the page table entry retrieved into the TLB.
  • the memory management unit writes a page table entry cached in the TLB to the memory controller, and when the memory controller subsequently receives the cached coherent interconnect request, the memory controller parses the C- in the cache coherent interconnect request Bit information, after determining that the C-bit is 0, the memory controller sends a data read command to the NVDIMM; the data read command includes read address information and an indication bit, the indication bit indicating that the NVDIMM is treated Reading data is not decrypted.
  • the decoder in the NVDIMM After the decoder in the NVDIMM receives the data read command, the decoder decodes the data read command, and sends the decoded data read command to the controller in the NVDIMM, in the NVDIMM.
  • the controller acquires data stored in the storage area corresponding to the read address information according to the decoded data read command, and transmits the read data to the processor.
  • the present application provides a method and apparatus for encrypting/decrypting computer memory data, which is used to solve the problem of encrypting and decrypting data stored in an NVDIMM existing in the prior art, which may result in a decrease in processing efficiency of the computer. And the problem of large read and write data delay.
  • the method and the device are based on the same inventive concept. Since the principles of the method and the device for solving the problem are similar, the implementation of the device and the method can be referred to each other, and the repeated description is not repeated.
  • the method provided by the embodiment of the present application is introduced.
  • the method is applicable to the computer 100 shown in FIG. 1 . Therefore, in the embodiment of the present application, only the computer 100 is taken as an example, but the present invention is not limited. Embodiments are applied to other types of terminal devices. Referring to FIG. 4, the specific process of the method includes:
  • Step 401 The storage device receives a data write command and a data to be written sent by a processor of the computer, where the data write command includes an indication bit, where the indicator bit is used to indicate whether the storage device is Write data to be encrypted;
  • Step 402 The storage device determines, according to the indication bit, that the data to be written needs to be encrypted, encrypts the data to be written, and writes the encrypted data to be written into the storage. In addition, if the storage device determines, according to the indication bit, that the data to be written does not need to be encrypted, the data to be written is directly written into the storage device without performing encryption processing.
  • the storage device may be an NVDIMM or other storage device having a data storage function.
  • the storage device is an NVDIMM, and other storage devices having a data storage function are also applicable to the method provided by the embodiments of the present invention.
  • the data write command may further include storage address information for instructing the NVDIMM to store the to-be-written data in a storage area corresponding to the storage address information in the NVDIMM.
  • the data write instruction and the data to be written are respectively sent to the NVDIMM through different buses, and may be assembled and sent to the NVDIMM in a message.
  • the processor may send one through the instruction bus in the computer respectively.
  • the message includes a data write instruction and a data to be written, and the data write instruction and the data to be written are sent to the NVDIMM in a synchronous manner; or the data is written to the instruction and to be written in an asynchronous manner.
  • the incoming data is sent to the NVDIMM; when the computer processor sends the data write command and the data to be written, the data write command and the data to be written may also be included in one data packet and sent to the NVDIMM.
  • the above data writing instruction and the transmission mode of the data to be written are merely exemplified, and any manner that can be used for transmitting the data writing instruction and the data to be written is applicable to the embodiment of the present invention.
  • the processor When the processor needs to write data, and the data to be written needs to be encrypted, the processor sends a data write instruction and a data to be written, where the data write instruction includes an indication bit.
  • the indication bit indicates that the NVDIMM encrypts the data to be written; after receiving the data write instruction sent by the processor and the data to be written, the NVDIMM encrypts the data to be written, and according to The data write command writes the encrypted data to be written into the NVDIMM.
  • the indication bit may be a first set value, and the first set value may be used to instruct the NVDIMM to encrypt the data to be written.
  • the processor When the processor needs to write data, and the data to be written does not need to be encrypted, the processor sends a data write instruction and a data to be written, where the data write instruction includes an indication bit, The indication bit indicates that the NVDIMM does not encrypt the data to be written; after receiving the data write instruction sent by the processor and the data to be written, the NVDIMM according to the data write instruction The data to be written is directly written into the NVDIMM without performing encryption processing on the data to be written.
  • the indication bit may be a second set value, and the second set value may be used to indicate that the NVDIMM does not encrypt the data to be written.
  • the data write command may adopt an existing data write command format, for example, a data write command, an XWRITE command or a PWRITE command in an NVDIMM-P protocol under a DDR4 interface; an existing data write command usually exists.
  • Some reserved bits may use part or all of the reserved bits as indication bits.
  • the A10/AP included in the XWRITE instruction in the NVDIMM-P protocol on the DDR4 interface may be used as a reserved bit.
  • the NVDIMM When the NVDIMM receives the XWRITE command or the PWRITE command, it first determines whether the reserved bit in the data write command is an indication bit, and if the reserved bit is an indication bit, Determining that the indication bit indicates that the data to be written is encrypted, the data to be written is encrypted, and the encrypted data to be written is written into the NVDIMM.
  • the XWRITE command in the NVDIMM-P protocol under the DDR4 interface includes a reserved bit A10/AP, and one bit of the A10/AP can be set to the SEC bit (safety indication bit) bit for use as an indication.
  • SEC bit safety indication bit
  • the NVDIMM is instructed to not encrypt the data to be written; the multiple bits in the reserved bits may also be set to the SEC bit, and used as an indication bit, and the specific indication manner may be set according to a specific scenario.
  • the NVDIMM may acquire an encryption key, and perform encryption processing on the data to be written by using the encryption key.
  • the encryption key may be generated by a processor of the computer and saved in advance; the encryption key may be pre-stored in the NVDIMM, or may be pre-stored in other storage areas in the computer, such as a computer. Volatile memory.
  • the encryption key may be encrypted, for example, the encryption key is encrypted by SALT, and the encrypted encryption key may be stored in the NVDIMM or other storage in the computer.
  • the key that encrypts the encryption key is stored in another storage area, that is, stored on a different storage medium than the storage medium storing the encryption key, for example, the encrypted encryption key.
  • the SALT and unencrypted encryption keys are stored in a volatile storage area in the computer.
  • the encrypted encryption key and the key for encrypting the encryption key may be stored in a storage area other than the NVDIMM in the computer.
  • the encryption key may also be generated by the NVDIMM itself, but because the NVDIMM is vulnerable to attack, the encryption key may be generated or the encryption key may be acquired, so that the NVDIMM is stored in the NVDIMM. The data security is poor.
  • the encryption key may be encrypted, and the encrypted encryption key may be stored in the NVDIMM.
  • the key used to encrypt the encryption key is stored in a storage area other than the NVDIMM in the computer.
  • a method for encrypting computer memory data includes:
  • Step 501 The storage device receives a data encryption instruction and a to-be-written data sent by a processor of the computer, where the data encryption instruction is used to indicate that the data to be written is encrypted.
  • Step 502 The storage device encrypts the data to be written according to the data encryption instruction, and writes the encrypted data to be written into the storage device.
  • the storage device may be an NVDIMM or other storage device having a data storage function.
  • the storage device is an NVDIMM, and other storage devices having a data storage function are also applicable to the method provided by the embodiments of the present invention.
  • the data encryption instruction may further include storage address information, configured to instruct the NVDIMM to encrypt the to-be-written data and store the data in the storage area corresponding to the storage address information in the NVDIMM.
  • the data encryption instruction and the data to be written are respectively sent to the NVDIMM through different buses, and may be assembled and sent to the NVDIMM in a message.
  • the processor may send a message through the instruction bus in the computer respectively.
  • the message includes a data encryption instruction and a data to be written, and the data encryption instruction and the data to be written are sent to the NVDIMM in a synchronous manner; or the data encryption instruction and the data to be written are respectively sent to the asynchronous method.
  • the NVDIMM; when the computer processor sends the data encryption instruction and the data to be written, the data encryption instruction and the data to be written may also be included in a data packet and sent to the NVDIMM.
  • the above data encryption instruction and the transmission mode of the data to be written are only examples, and any manner in which the data write instruction and the data to be written can be used is applicable to the embodiment of the present invention.
  • the processor sends a data encryption instruction and a data to be written when the processor needs to write data, and the data to be written needs to be encrypted, the data encryption instruction is used to indicate the NVDIMM pair
  • the data to be written is encrypted and written into the NVDIMM.
  • the NVDIMM After receiving the data encryption command sent by the processor and the data to be written, the NVDIMM encrypts the data to be written, and writes the encrypted data to be written according to the data encryption command. In the NVDIMM.
  • the processor may send an existing data write instruction and data to be written, and the existing data write instruction may be The XWRITE command and the PWRITE command in the NVDIMM-P protocol on the DDR4 interface, and the XWRITE command and the PWRITE command in the NVDIMM-P protocol on the DDR5 interface can select corresponding data write commands according to the specific scenario and the access processing interface of the NVDIMM.
  • the NVDIMM After receiving the data write command sent by the processor and the data to be written, the NVDIMM directly writes the data to be written into the NVDIMM according to the data write command, and does not need to write the data to be written.
  • the incoming data performs encryption processing.
  • the data encryption instruction may be a newly defined instruction, and adopts a coding manner different from the existing XWRITE and PWRITE command codes, for example, setting an S-XWRITE instruction and an S-PWRITE instruction in the NVDIMM-P protocol under the DDR5 interface, a data encryption instruction, wherein the S-XWRITE is used to indicate that the data to be written is encrypted and stored in a volatile storage area in the NVDIMM, and the S-PWRITE is used to indicate that the data to be written is encrypted and stored in the In the non-volatile storage area in the NVDIMM.
  • the NVDIMM After receiving the data encryption instruction and the data to be written, the NVDIMM needs to perform encryption processing on the data to be written. First, an encryption key needs to be acquired, and then the data to be written is encrypted by using the encryption key. deal with.
  • the storage and encryption of the encryption key are the same as the storage and encryption of the encryption key in the embodiment shown in FIG. 4, and details are not described herein again.
  • a method for decrypting computer memory data includes:
  • Step 601 The storage device receives a data readout command sent by a processor of the computer, where the data read command includes an indication bit, where the indication bit is used to indicate whether the storage device decrypts data to be read;
  • Step 602 The storage device determines, according to the indication bit, that the data to be read needs to be decrypted, and reads data from the storage device according to the data read command, and decrypts the read data. And sending the decrypted read to the processor; the storage device determines, according to the indication bit, that the data to be read is not required to be decrypted, and reads from the storage device according to the data readout instruction Take the data and send the read to the processor.
  • the storage device may be an NVDIMM or other storage device having a data storage function.
  • the storage device is an NVDIMM, and other storage devices having a data storage function are also applicable to the method provided by the embodiments of the present invention.
  • the data read command may further include read address information for instructing the NVDIMM to read data stored in a storage area corresponding to the read address information in the NVDIMM.
  • the processor When the processor needs to read data, and the data to be read needs to be decrypted, the processor sends a data read command, where the data read command includes an indication bit, and the indicator bit indicates to be read. Taking data for decryption; after receiving the data read command sent by the processor, the NVDIMM reads data according to the data read command, decrypts the read data, and sends the decrypted data to processor.
  • the indication bit may be a third set value, and the third set value may be used to instruct the NVDIMM to decrypt the data to be read.
  • the processor When the processor in the computer needs to read data, and the data to be read does not need to be decrypted, the processor sends a data read command, where the data read command includes an indication bit, The indication bit indicates that the data to be read is not decrypted; after receiving the data read command sent by the processor, the NVDIMM reads the data according to the data read command, directly reads the data, and sends the read data to the processor.
  • the indication bit may be a fourth set value, and the fourth set value may be used to indicate that the data to be read is not decrypted.
  • the data read command may adopt an existing data read command format, such as a data read command XREAD, SREAD command in the NVDIMM-P protocol under the DDR4 interface, and a data read command XREAD in the NVDIMM-P protocol under the DDR5 interface.
  • the existing data read command usually has some reserved bits, and the reserved bit can be used as an indication bit.
  • the XREAD instruction in the NVDIMM-P protocol under the DDR4 interface and the A10/AP included in the SREAD instruction are Reserved bits, A10/AP can be used as an indication bit; for example, CA5 in the command/address start signal (Command/Address Signal Rising CLK_t) contained in the data read command XREAD in the NVDIMM-P protocol under the DDR5 interface
  • CA6 is a reserved bit, and some or all of the bits in CA5 and CA6 can be selected as an indication bit.
  • the NVDIMM When the NVDIMM receives the XREAD instruction or the SREAD instruction, it is first determined whether the reserved bit in the XREAD instruction or the SREAD instruction is And indicating, if the reserved bit is an indication bit, after determining that the indication bit instructs the NVDIMM to decrypt the data to be read, decrypting the to-be-read data, and decrypting The latter to be read is sent to the processor.
  • the XREAD command in the NVDIMM-P protocol under the DDR4 interface includes a reserved bit A10/AP, and one bit of the A10/AP can be set to the SEC bit, which is used as an indicator bit to indicate the NVDIMM.
  • Decrypting the data to be read may be set to indicate that the NVDIMM decrypts the data to be read when the SEC bit is 1, and when the SEC bit is 0, indicating the NVDIMM pair The read data is not decrypted. It is also possible to set a plurality of bits in the reserved bits as SEC bits for use as indicator bits, and the specific indication manner can be set according to a specific scenario.
  • the NVDIMM may acquire a decryption key after determining that the data to be read needs to be decrypted according to the indication bit, and decrypt the data to be read by using the decryption key.
  • the decryption key may be generated by a processor of the computer and saved in advance; the decryption key may be pre-stored in the NVDIMM, or may be pre-stored in another storage area in the computer, such as a computer. Volatile memory.
  • the decryption key may be encrypted, for example, the decryption key is encrypted by SALT, and the encrypted decryption key may be stored in the NVDIMM or other storage in the computer.
  • the key for encrypting the decryption key is stored in another storage area, that is, stored on another storage medium different from the storage medium storing the encryption key, for example, the encrypted decryption key is encrypted.
  • the key is stored in the non-volatile storage area of the NVDIMM, and the SALT and the unencrypted decryption key are stored in a volatile storage area in the computer.
  • the encrypted decryption key and the key for encrypting the decryption key may be stored in a storage area other than the NVDIMM in the computer.
  • the decryption key may also be generated by the NVDIMM itself, but because the NVDIMM is vulnerable to attack, the generation mode of the decryption key may be leaked or the decryption key may be acquired, so that the NVDIMM is stored in the NVDIMM. The data security is poor.
  • the decryption key may be encrypted, and the encrypted decryption key is stored in the NVDIMM.
  • the key used to decrypt the decryption key is stored in a storage area other than the NVDIMM in the computer.
  • a method for decrypting computer memory data includes:
  • Step 701 The storage device receives a data decryption instruction sent by a processor of the computer, where the data decryption instruction is used to indicate that the read data is decrypted.
  • Step 702 The storage device reads data in the storage device according to the data decryption instruction.
  • Step 703 The storage device performs decryption processing on the read data, and sends the decrypted data to the processor.
  • the storage device may be an NVDIMM or other storage device having a data storage function.
  • the storage device is an NVDIMM, and other storage devices having a data storage function are also applicable to the method provided by the embodiments of the present invention.
  • the data decryption instruction may further include read address information for instructing the NVDIMM to read data stored in a storage area corresponding to the read address information in the NVDIMM.
  • the processor When the processor needs to read data and needs to decrypt the data to be read, the processor sends a data decryption instruction, where the data decryption instruction is used to indicate that the data to be read is decrypted Send to the processor.
  • the NVDIMM After receiving the data decryption instruction sent by the processor, the NVDIMM reads the data stored in the storage area corresponding to the read address information according to the read address information in the data decryption instruction, and reads the data in the storage area. Decryption is performed, and the decrypted data is sent to the processor.
  • the processor may send an existing data read command, and the existing data read command may be an NVDIMM under the DDR4 interface.
  • the XREAD instruction, the SREAD instruction in the -P protocol, the XREAD instruction, the SREAD instruction in the NVDIMM-P protocol under the DDR5 interface, etc. can select the corresponding data readout instruction according to the specific scenario and the NVDIMM access processing interface; the NVDIMM receives the location After the data read command sent by the processor, the data is read in the NVDIMM according to the data read command, and the read data is directly sent to the processor without performing decryption processing on the read data.
  • the data decryption instruction may be a newly defined instruction, and adopts an encoding method different from the existing XREAD instruction and the SREAD command encoding, for example, an S-XREAD instruction and an S-SREAD instruction set in the NVDIMM-P protocol under the DDR5 interface, and is used as the instruction.
  • a data encryption instruction wherein the S-XREAD is used to instruct the NVDIMM to decrypt the data to be read in an asynchronous manner and then send the data to the processor, and the S-SREAD is used to indicate that the NVDIMM is to be read in a synchronous manner. The data is decrypted and sent to the processor.
  • the computer stores an encryption status of data stored in the NVDIMM, for example, using a C-bit in the PTE to record an encryption status of the data stored in the NVDIMM, when the processor needs to read data.
  • the processor may first determine whether the data to be read in the encryption status of the data stored in the NVDIMM is an encrypted state, and if the data is in an encrypted state, the processor sends the data decryption instruction, otherwise the processor sends the current Some data read instructions can be.
  • an encryption status of data stored in the NVDIMM is stored in the NVDIMM, and when the processor needs to read data, the processor does not need to check the encryption status of the data to be read, and directly sends the data.
  • a data decryption instruction when the NVDIMM receives the data decryption command, the NVDIMM first determines whether the data to be read in the encrypted state of the stored data in the NVDIMM is in an encrypted state, and if the data is in an encrypted state, The NVDIMM performs decryption processing on the data to be read. Otherwise, the NVDIMM does not perform decryption processing on the data to be read.
  • the NVDIMM After receiving the data decryption instruction, the NVDIMM determines that the decrypted data needs to be decrypted after the data decryption instruction is received, and decrypts the to-be-read data by using the decryption key.
  • the manner of storing and encrypting the decryption key has been described in the embodiment shown in FIG. 6, and details are not described herein again.
  • command code of the data read/write instruction defined in the NVDIMM-P protocol under the DDR4 interface in the embodiment of the present invention is as follows:
  • CKE0, CS_n, ACT_n, RAS_n/A16, CAS_n/A15, WE_n/A14, C0_C2, BG0_BG1, BA0_BA1, A17, A12/BC_n, A13, A11, A10/AP, A9, A8, A0_A7 indicate data reading.
  • the position identification of each bit in the write instruction it should be noted that only some of the bits in the data read/write instruction are shown in Table 1.
  • H represents a high potential
  • L represents a low point
  • ADDR[39:33] represents address information carried by the data read/write instruction
  • numbers inside the brackets indicate address bits of a storage area in the NVDIMM
  • WGID[7: 0] indicates the information carried when the write result is fed back to the processor after the data is written, so that the processor determines that the corresponding data has been written when receiving the information including the WID
  • RID[7:0] indicates After the data is read, the read data is fed back to the information carried by the processor, so that the processor determines the corresponding read data when receiving the data packet containing the RID; a WID is usually There should be multiple PWRITE instructions and data to be written.
  • SEC indicates the indication bits of the data write command and the data read command in the embodiment of the present invention.
  • the RFU represents a reserved bit in the data read and write instruction.
  • the data write commands defined in the NVDIMM-P protocol under the DDR4 interface are buffered write (XWRITE) and persistent write (PWRITE), respectively; and the XWRITE command is used to instruct the NVDIMM to write data to In the volatile memory area of the NVDIMM, the PWRITE instruction is used to instruct the NVDIMM to write data into the non-volatile storage area of the NVDIMM to ensure that the data can be permanently stored.
  • reserved bits in the XWRITE command defined in the NVDIMM-P protocol on the DDR4 interface which are A10/AP, A17, A12, and A13.
  • the reserved bits can be used as indicator bits.
  • A10/AP is used to indicate SEC. Bit, used as an indicator bit.
  • the NVDIMM receives data sent by the processor of the computer and writes an XWRITE instruction and a data to be written, where the data write instruction includes a security SEC indicator bit, and the SEC indicator bit is used to indicate the data to be written. Whether to encrypt?
  • the NVDIMM determines, after the SEC indication bit needs to perform encryption processing on the data to be written, encrypts the data to be written, and writes the encrypted data to be written into the NVDIMM;
  • the NVDIMM determines, according to the SEC indication bit, that the data to be written is not required to be encrypted, and the data to be written is written into the NVDIMM.
  • the data read commands defined in the NVDIMM-P protocol under the DDR4 interface are respectively an asynchronous read command (XREAD) and a speculative read (SREAD) command; the XREAD command is used to instruct the NVDIMM to be asynchronously from the NVDIMM.
  • the storage area reads data, and the SREAD instruction is used to instruct the NVDIMM to read data from the storage area of the NVDIMM in a synchronized manner.
  • the reserved bits included in the XREAD instruction defined in the NVDIMM-P protocol under the DDR4 interface are A10/AP, and A10/AP can be used as an indication bit.
  • the SEC bit is indicated by A10/AP, which is used as an indicator bit.
  • the reserved bit of the SREAD instruction is A10/AP, and A10/AP can be used as an indication bit.
  • A10/AP is used to indicate the SEC bit, which is used as an indication bit.
  • the NVDIMM receives a data read by the processor of the computer to read a XREAD command, where the XREAD command includes a security SEC indicator bit, and the SEC indicator bit is used to indicate whether the NVDIMM reads data to be decrypted;
  • the NVDIMM determines, according to the SEC indication bit, that the data to be read needs to be decrypted, reads data from the NVDIMM according to the XREAD instruction, decrypts the read data, and reads the decrypted data. Send to the processor;
  • the NVDIMM determines, according to the SEC indication bit, that after the decryption process is not performed on the data to be read, the data is read from the NVDIMM according to the data readout instruction, and the read is sent to the processor.
  • the NVDIMM receives a data read SREAD command sent by the processor of the computer, where the SREAD command includes a security SEC indicator bit, and the SEC indicator bit is used to indicate whether the NVDIMM reads data to be decrypted;
  • the NVDIMM determines, according to the SEC indication bit, that the data to be read needs to be decrypted, reads data from the NVDIMM according to the XREAD instruction, decrypts the read data, and reads the decrypted data. Send to the processor;
  • the NVDIMM determines, according to the SEC indication bit, that after the decryption process is not performed on the data to be read, the data is read from the NVDIMM according to the SREAD instruction, and the read is sent to the processor.
  • the XADR instruction is also defined under the NVDIMM-P protocol under the DDR4 interface.
  • the XADR instruction is sent back-to-back after receiving XWRITE/XREAD/SREAD/PWRITE.
  • the XADR instruction can send 40-bit address ADDR[39:0] and 8-bit RID[7:0] or WGID[ 7:0].
  • the command code of the data read/write command and the data encryption/decryption command defined in the NVDIMM-P protocol under the DDR5 interface in the embodiment of the present invention is as follows:
  • CS Command/Address Signal Rising CLK_t
  • Command/Address Signal Falling CLK_t indicate the position identifier of each bit in the data read/write instruction
  • Command/Address Signal Rising CLK_t and Command/Address Signal Falling CLK_t correspond to CA0-CA6 respectively.
  • Different bits it should be noted that only some of the bits in the data read and write instructions are shown in Table 2.
  • H represents a high potential
  • L represents a low point
  • ADDR[11:5] represents address information carried by the data read/write instruction
  • numbers inside the brackets indicate address bits of a storage area in the NVDIMM
  • WGID[9 :0] indicates the information carried when the write result is fed back to the processor after the data is written, so that the processor determines that the corresponding data has been written when receiving the information containing the WGID
  • RID[9:0] Represents the information carried when the read data is fed back to the processor after the data is read, so that the processor determines the corresponding read data when receiving the data packet containing the RID
  • BL* L
  • BL indicates The burst length
  • SEC indicates the indication bits of the data write command and the data read command in the embodiment of the present invention.
  • the data write commands defined in the NVDIMM-P protocol under the DDR5 interface are buffered write (XWRITE) and persistent write (PWRITE), respectively; and the XWRITE command is used to instruct the NVDIMM to write data to In the volatile memory area of the NVDIMM, the PWRITE instruction is used to instruct the NVDIMM to write data into the non-volatile storage area of the NVDIMM to ensure that the data can be permanently stored.
  • XWRITE buffered write
  • PWRITE persistent write
  • the XWRITE command defined in the NVDIMM-P protocol on the DDR5 interface has some reserved bits, which are CA4, CA5, and CA6 in Command/Address Signal Falling CLK_t.
  • the reserved bits can be used as indicator bits.
  • the NVDIMM receives data sent by the processor of the computer to write an XWRITE command and a data to be written, the data write command includes a security SEC indicator bit, and the SEC indicator bit is used to indicate whether the NVDIMM is to the Data to be written for encryption;
  • the NVDIMM determines, after the SEC indication bit needs to perform encryption processing on the data to be written, encrypts the data to be written, and writes the encrypted data to be written into the NVDIMM;
  • the NVDIMM determines, according to the SEC indication bit, that the data to be written is not required to be encrypted, and the data to be written is written into the NVDIMM.
  • the data encryption instructions can be defined by using reserved code instructions.
  • the newly defined data encryption instructions have a secure buffer write command. (S-XWRITE) and Secure Persistence Write Command (S-PWRITE).
  • S-XWRITE secure buffer write command
  • S-PWRITE Secure Persistence Write Command
  • the S-XWRITE command is used to indicate that the NVDIMM is to be written to the volatile memory area of the NVDIMM after being encrypted.
  • the S-PWRITE instruction is used to indicate The NVDIMM is encrypted and written to the non-volatile storage area of the NVDIMM to ensure that the data can be permanently stored.
  • the levels are not exactly the same in CA0-CA6 in Command/Address Signal Rising CLK_t.
  • the S/XWRITE Command/Address Signal Rising CLK_t in CA0-CA3 respectively Set H, H, L, L, XWRITE Command/Address Signal Rising CLK_t CA0-CA3 are H, L, H, H respectively.
  • the levels are not exactly the same in CA0-CA6 in Command/Address Signal Rising CLK_t.
  • the CA-CA3 of the S/PWRITE Command/Address SignalRising CLK_t is set separately. H, H, L, L; Command/Address Signal Rising CLK_t of PWRITE Sets H, L, H, and H in CA0-CA3.
  • the NVDIMM receives the data encrypted S-XWRITE command sent by the processor of the computer and the data to be written.
  • the NVDIMM After receiving the S-XWRITE command sent by the processor and the data to be written, the NVDIMM encrypts the data to be written, and writes the encrypted data to be written according to the S-XWRITE instruction. Into the NVDIMM.
  • the NVDIMM receives the data encrypted S-PWRITE command sent by the processor of the computer and the data to be written.
  • the NVDIMM After receiving the S-PWRITE command sent by the processor and the data to be written, the NVDIMM encrypts the to-be-written data, and writes the encrypted data to be written according to the S-PWRITE instruction. Into the NVDIMM.
  • the data read commands defined in the NVDIMM-P protocol under the DDR5 interface are respectively an asynchronous read command (XREAD) and a speculative read (SREAD) command; the XREAD command is used to instruct the NVDIMM to be asynchronously from the NVDIMM.
  • the storage area reads data, and the SREAD instruction is used to instruct the NVDIMM to read data from the storage area of the NVDIMM in a synchronized manner.
  • the reserved bits of the XREAD instruction defined in the NVDIMM-P protocol under the DDR5 interface are CA5 and CA6 in Command/Address Signal Rising CLK_t.
  • the reserved bits can be used as indicator bits.
  • Command/Address Signal is used in the XREAD instruction in Table 3.
  • CA6 in Rising CLK_t represents the SEC bit and is used as an indicator bit.
  • reserved code instructions in the NVDIMM-P protocol under the DDR5 interface.
  • these reserved code instructions can be used to define data decryption instructions.
  • Table 2 an example is to decrypt the newly defined data.
  • the instruction is a decryption speculative read command (S-SREAD), and the S-SREAD instruction is used to instruct the NVDIMM to read data from the storage area of the NVDIMM in a synchronized manner and decrypt the read data.
  • S-SREAD decryption speculative read command
  • the levels are not exactly the same in CA0-CA6 in Command/Address Signal Rising CLK_t.
  • the S/SREAD Command/Address Signal Rising CLK_t in CA0-CA3 respectively Set H, H, L, L, SREADE Command/Address Signal Rising CLK_t CA0-CA3 are H, L, H, H respectively.
  • the NVDIMM receives a data read XREAD command sent by the processor, where the XREAD command includes a decryption SEC indicator bit, and the SEC indicator bit is used to indicate whether the NVDIMM is to be decrypted for reading data;
  • the NVDIMM determines, according to the SEC indication bit, that the data to be read needs to be decrypted, reads data from the NVDIMM according to the XREAD instruction, decrypts the read data, and reads the decrypted data. Send to the processor.
  • the NVDIMM receives the data sent by the processor to read an S-SREAD instruction, and the S-SREAD instruction is used to indicate that the data to be read is decrypted;
  • the NVDIMM reads data from the NVDIMM in accordance with an S-SREAD instruction, decrypts the read data, and transmits the decrypted read to the processor.
  • the XADR instruction is also defined under the NVDIMM-P protocol under the DDR5 interface.
  • the XADR instruction is sent back-to-back after receiving XWRITE/XREAD/SREAD/PWRITE.
  • the XADR instruction can send 40-bit address ADDR[39:0] and 10-bit RID[9:0] or WGID[ 9:0].
  • the processor may instruct the NVDIMM to encrypt all data to be written into the NVDIMM, and the processor indicates, by using an encryption command of a configuration mode register, whether the NVDIMM is Encrypting all data that needs to be written to the NVDIMM. For example, when the processor configures the Encryption Enable bit to be 1, the NVDIMM is instructed to encrypt all data to be written. When the Encryption Enable bit is 0, the indication is The NVDIMM can use the embodiment shown in FIG. 4 and FIG. 5 to encrypt data.
  • Table 3 shows the indication information and corresponding description of each address bit of the mode register in the NVDIMM-P protocol under the DDR4 interface.
  • the bit of the Encryption Enable bit When the bit of the Encryption Enable bit is set to 1 in the reserved bit A17, it is used to indicate that the NVDIMM needs to encrypt all the data to be written. When the bit of the Encryption Enable bit is 0, it is used to indicate that the NVDIMM is required to write all the data to be written. No encryption is performed, and the data to be written may be further encrypted according to a data write command or a data encryption command sent by the processor.
  • the embodiment of the present invention provides a storage device 800, specifically for implementing the method described in the embodiment of FIG. 4, wherein the specific implementation manner may be implemented by referring to the method shown in FIG. For example, the repetition will not be described again.
  • the structure of the device is as shown in FIG. 8, and includes a receiving unit 801, a storage unit 802, and a processing unit 803, where:
  • the receiving unit 801 is configured to receive a data write command sent by the processor and the data to be written, where the data write command includes an indication bit, where the indicator bit is used to indicate whether the data to be written is Encryption;
  • a storage unit 802 configured to store data
  • the processing unit 803 is configured to receive the data write command sent by the receiving unit 801 and the data to be written, and determine, according to the indication bit in the data write command, that the After the data is written to perform encryption processing, the data to be written is encrypted, and the encrypted information is to be written into the storage unit 802.
  • the storage device may be an NVDIMM or other storage device having a data storage function.
  • the processor When the processor needs to write data, and the data to be written needs to be encrypted, the processor sends a data write instruction and a data to be written, where the data write instruction includes an indication bit.
  • the indication bit indicates that the data to be written is encrypted; the receiving unit 801 receives the data write instruction sent by the processor and the data to be written, and the processing unit 803 encrypts the data to be written, and according to the The data write command writes the encrypted data to be written into the storage unit 802.
  • the indication bit may be a first set value, and the first set value may be used to instruct the processing unit 803 to encrypt the data to be written.
  • the processor When the processor needs to write data, and the data to be written does not need to be encrypted, the processor sends a data write instruction and a data to be written, where the data write instruction includes an indication bit, The indication bit indicates that the NVDIMM does not encrypt the data to be written; the receiving unit 801 receives the data write instruction and the data to be written sent by the processor, and the processing unit 803 writes the instruction according to the data.
  • the data to be written is directly written into the storage unit 802 without performing encryption processing on the data to be written.
  • the indication bit may be a second set value, and the second set value may be used to indicate that the NVDIMM does not encrypt the data to be written.
  • the processing unit 803 may acquire an encryption key, and perform encryption processing on the data to be written by using the encryption key.
  • the encryption key may be generated by a processor of the computer and saved in advance;
  • the receiving unit 801 receives the data sent by the processor of the computer and writes the XWRITE instruction and the data to be written, where the data write instruction includes a security SEC indicator bit, and the SEC indicator bit is used to indicate that the to-be-written Whether the incoming data is encrypted;
  • the processing unit 803 determines, after the SEC indication bit needs to perform encryption processing on the data to be written, encrypts the data to be written, and writes the encrypted data to be written into the storage unit. 802;
  • the processing unit 803 determines, according to the SEC indication bit, that the data to be written is not required to be encrypted, and then writes the data to be written into the storage unit 802.
  • each functional unit in each embodiment of the present application may be integrated into one processing. In the device, it may be physically existed alone, or two or more units may be integrated into one module.
  • the above integrated unit can be implemented in the form of hardware or in the form of a software function module.
  • the integrated unit if implemented in the form of a software functional unit and sold or used as a standalone product, may be stored in a computer readable storage medium.
  • the instructions include a plurality of instructions for causing a terminal device (which may be a personal computer, a cell phone, or a network device, etc.) or a processor to perform all or part of the steps of the methods described in various embodiments of the present application.
  • the foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, and the like, which can store program code. .
  • the embodiment of the present invention further provides a computer, which is used to implement the method described in the embodiment of FIG. 4, wherein the specific implementation manner may be repeated with reference to the method embodiment shown in FIG. No further details are provided.
  • the device includes a processor 901, an NVDIMM 902, and a memory 903.
  • connection medium between the processor 901, the NVDIMM 902, and the memory 903 is not limited in the embodiment of the present application.
  • the memory 903, the processor 901, and the NVDIMM 902 are connected by a bus 904 in FIG. 9.
  • the bus is indicated by a thick line in FIG. 9, and the connection manner between other components is only schematically illustrated, and Not limited to limit.
  • the bus can be divided into an address bus, a data bus, a control bus, and the like. For ease of representation, only one thick line is shown in FIG. 10, but it does not mean that there is only one bus or one type of bus.
  • the memory 903 may be a volatile memory, such as a random-access memory (RAM); the memory 903 may also be a non-volatile memory, such as a read-only memory, flashing A flash memory, a hard disk drive (HDD) or a solid-state drive (SSD), or a memory 903 is a program code that can be used to carry or store a desired program or data structure and can be Any other medium accessed by the computer, but is not limited to this.
  • the memory 903 may be a combination of the above memories.
  • the processor 901 and the NVDIMM 902 are used to implement the method of image processing as shown in FIG. 4, wherein:
  • a processor configured to send a data write command and a data to be written to the NVDIMM when determining that the data to be written needs to be written to the NVDIMM, where the data write command includes an indication bit, where the indicator bit is used for Instructing whether to encrypt the data to be written;
  • An NVDIMM is configured to receive a data write command and a data to be written sent by the processor, and after determining, according to the indication bit, that the data to be written needs to be encrypted, encrypt the data to be written. And encrypting the to-be-written data into the NVDIMM.
  • the NVDIMM may first acquire an encryption key when encrypting the data to be written, wherein the encryption key is generated by the processor and saved in advance; and the encryption key is used to Write data for encryption processing.
  • the embodiment of the present invention provides a storage device 1000, specifically for implementing the method described in the embodiment described in FIG. 5, wherein the specific implementation manner may be implemented by referring to the method shown in FIG. For example, the details of the device will not be described again.
  • the structure of the device is as shown in FIG. 10, and includes a receiving unit 1001, a storage unit 1002, and a processing unit 1003, where:
  • the receiving unit 1001 is configured to receive a data encryption instruction and a to-be-written data sent by the processor, where the data encryption instruction is used to indicate that the data to be written is encrypted;
  • a storage unit 1002 configured to store data
  • the processing unit 1003 is configured to receive, by the receiving unit 1001, the data encryption instruction and the data to be written, encrypt the data to be written, and encrypt the to-be-written according to the data encryption instruction.
  • the incoming data is written into the storage unit 1002.
  • the storage device may be an NVDIMM or other storage device having a data storage function.
  • the processor When the processor needs to write data, and the data to be written needs to be encrypted, the processor sends a data encryption instruction and a data to be written, where the data encryption instruction is used to indicate that the data to be written is to be written.
  • the data is encrypted and written into the storage unit 1002.
  • the receiving unit 1001 receives the data encryption instruction and the data to be written sent by the processor, and the processing unit 1003 encrypts the data to be written, and the encrypted data to be written according to the data encryption instruction. It is written in the storage unit 1002.
  • the processor may send an existing data write instruction and data to be written, which may be connected according to a specific scenario and NVDIMM.
  • the processing interface selects a corresponding data write command, the receiving unit 1001 receives the data write command sent by the processor and the data to be written, and the processing unit 1003 directly writes the data to be written according to the data write command.
  • the storage unit 1002 it is not necessary to perform encryption processing on the data to be written.
  • the receiving unit 1001 receives the data encrypted S-XWRITE command and the data to be written sent by the processor of the computer.
  • the processing unit 1003 encrypts the data to be written, and writes the encrypted data to be written into the NVDIMM according to the S-XWRITE instruction.
  • the receiving unit 1001 receives the data encrypted S-PWRITE command sent by the processor of the computer and the data to be written.
  • the processing unit 1003 encrypts the data to be written, and writes the encrypted data to be written into the NVDIMM according to the S-PWRITE instruction.
  • each functional unit in each embodiment of the present application may be integrated into one processing. In the device, it may be physically existed alone, or two or more units may be integrated into one module.
  • the above integrated unit can be implemented in the form of hardware or in the form of a software function module.
  • the integrated unit if implemented in the form of a software functional unit and sold or used as a standalone product, may be stored in a computer readable storage medium.
  • the instructions include a number of instructions for causing a terminal device (which may be a personal computer, a cell phone, or a network device, etc.) or a processor to perform all or part of the steps of the methods described in various embodiments of the present application.
  • the foregoing storage medium includes various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read only memory, a random access memory, a magnetic disk, or an optical disk.
  • the embodiment of the present invention further provides a computer, which is used to implement the method described in the embodiment of FIG. 5, wherein the specific implementation manner may be repeated with reference to the method embodiment shown in FIG. No further details are provided.
  • the device includes a processor 1101, an NVDIMM 1102, and a memory 1103.
  • connection medium between the processor 1101, the NVDIMM 1102, and the memory 1103 is not limited in the embodiment of the present application.
  • the memory 1103, the processor 1101, and the NVDIMM 1102 are connected by a bus 1104 in FIG. 11, and the bus is indicated by a thick line in FIG. 11, and the connection manner between other components is only schematically illustrated, and Not limited to limit.
  • the bus can be divided into an address bus, a data bus, a control bus, and the like. For ease of representation, only one thick line is shown in FIG. 10, but it does not mean that there is only one bus or one type of bus.
  • the memory 1103 may be a volatile memory such as a random access memory; the memory 1103 may also be a non-volatile memory such as a read only memory, a flash memory, a hard disk or a solid state hard disk, or the memory 1103 is capable of being carried or stored with The desired program code in the form of an instruction or data structure and any other medium that can be accessed by a computer, but is not limited thereto.
  • the memory 1103 may be a combination of the above memories.
  • the processor 1101 and the NVDIMM 1102 are used to implement a method of image processing as shown in FIG. 5, wherein:
  • the processor 1101 is configured to send a data encryption instruction and a data to be written to the NVDIMM 1102 when determining that the data to be written needs to be written to the NVDIMM 1102 and the data to be written needs to be encrypted, where the data encryption instruction is used for Instructing to encrypt the data to be written;
  • the NVDIMM 1102 is configured to receive data encryption instructions and data to be written sent by the processor 1101; encrypt the data to be written according to the data encryption instruction, and write the encrypted data to be written Into the NVDIMM 1102.
  • the NVDIMM 1102 When the NVDIMM 1102 performs encryption processing on the data to be written, it is specifically used to:
  • the NVDIMM 1102 may first acquire an encryption key when encrypting the data to be written, wherein the encryption key is generated by the processor 1101 and saved in advance; and the encryption key is used to The data to be written is encrypted for processing.
  • the embodiment of the present invention provides a storage device 1200, specifically for implementing the method described in the embodiment of FIG. 6, wherein the specific implementation manner may be implemented by referring to the method shown in FIG. For example, the repetition will not be described again.
  • the structure of the device is as shown in FIG. 12, and includes a receiving unit 1201, a storage unit 1202, and a processing unit 1203, where:
  • the receiving unit 1201 is configured to receive a data readout command sent by the processor, where the data read command includes an indication bit, where the indication bit is used to indicate whether the read data is decrypted;
  • a storage unit 1202 configured to store data
  • the processing unit 1203 is configured to receive a data readout command sent by the receiving unit 1201, and after determining, according to the indication bit in the data read command, that the read data needs to be decrypted, according to the data read.
  • the instruction reads data from the storage unit 1202, decrypts the read data, and transmits the decrypted data to the processor.
  • the processor When the processor needs to read data, and the data to be read needs to be decrypted, the processor sends a data read command, where the data read command includes an indication bit, and the indicator bit indicates to be read.
  • the data is decrypted; after receiving the data read command sent by the processor, the processing unit 1201 reads the data according to the data read command, and decrypts the read data, and decrypts the decoded data.
  • the data is sent to the processor.
  • the indication bit may be a third set value, and the third set value may be used to instruct the processing unit 1203 to decrypt the data to be read.
  • the processor When the processor in the computer needs to read data, and the data to be read does not need to be decrypted, the processor sends a data read command, where the data read command includes an indication bit, The indication bit indicates that the data to be read is not decrypted; the receiving unit 1201 receives the data readout command sent by the processor, and the processing unit 1203 reads the data according to the data readout instruction, directly reads the data and reads the read data. Data is sent to the processor.
  • the indication bit may be a fourth set value, and the fourth set value may be used to indicate that the data to be read is not decrypted.
  • the receiving unit 1201 receives a data read XREAD command sent by the processor of the computer, where the XREAD command includes a security SEC indicator bit, and the SEC indicator bit is used to indicate whether the data to be read is decrypted;
  • the processing unit 1203 determines, after the SEC indication bit needs to perform decryption processing on the data to be read, reads data from the storage unit 1202 according to the XREAD instruction, decrypts the read data, and decrypts the data.
  • the read is sent to the processor;
  • the processing unit 1203 determines, according to the SEC indication bit, that after the decryption process is not performed on the data to be read, the data is read from the storage unit 1202 according to the data readout instruction, and the read is sent to the process. Device.
  • the receiving unit 1201 receives a data read SREAD command sent by the processor of the computer, where the SREAD command includes a security SEC indicator bit, and the SEC indicator bit is used to indicate whether the data to be read is decrypted;
  • the processing unit 1203 determines, after the SEC indication bit needs to perform decryption processing on the data to be read, reads data from the storage unit 1202 according to the XREAD instruction, decrypts the read data, and decrypts the data.
  • the read is sent to the processor;
  • the processing unit 1203 determines, according to the SEC indication bit, that after the decryption process is not performed on the data to be read, the data is read from the storage unit 1202 according to the SREAD instruction, and the read is sent to the processor.
  • each functional unit in each embodiment of the present application may be integrated into one processing. In the device, it may be physically existed alone, or two or more units may be integrated into one module.
  • the above integrated unit can be implemented in the form of hardware or in the form of a software function module.
  • the integrated unit if implemented in the form of a software functional unit and sold or used as a standalone product, may be stored in a computer readable storage medium.
  • the technical solution of the present application may contribute to the prior art or all or part of the technical solution may be embodied in the form of a software product.
  • the computer software product is stored in a storage medium and includes instructions for causing a terminal device (which may be a personal computer, a mobile phone, or a network device, etc.) or a processor to perform all of the methods described in the various embodiments of the present application. Or part of the steps.
  • the foregoing storage medium includes various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read only memory, a random access memory, a magnetic disk, or an optical disk.
  • the embodiment of the present invention further provides a computer, which is used to implement the method described in the embodiment of FIG. 6, wherein the specific implementation manner may be repeated with reference to the method embodiment shown in FIG. No further details are provided.
  • the device includes a processor 1301, an NVDIMM 1302, and a memory 1303.
  • connection medium between the processor 1301, the NVDIMM 1302, and the memory 1303 is not limited in the embodiment of the present application.
  • the memory 1303, the processor 1301, and the NVDIMM 1302 are connected by a bus 1304 in FIG. 13, and the bus is indicated by a thick line in FIG. 13, and the connection manner between other components is only schematically illustrated, and Not limited to limit.
  • the bus can be divided into an address bus, a data bus, a control bus, and the like. For ease of representation, only one thick line is shown in FIG. 13, but it does not mean that there is only one bus or one type of bus.
  • the memory 1303 may be a volatile memory such as a random access memory; the memory 1303 may also be a non-volatile memory such as a read only memory, a flash memory, a hard disk or a solid state hard disk, or the memory 1303 is capable of being carried or stored with The desired program code in the form of an instruction or data structure and any other medium that can be accessed by a computer, but is not limited thereto.
  • the memory 1303 may be a combination of the above memories.
  • the processor 1301 and the NVDIMM 1302 are used to implement a method of image processing as shown in FIG. 6, wherein:
  • the processor 1301 is configured to send a data read command to the NVDIMM 1302 when determining that data needs to be read from the NVDIMM 1302, where the data read command includes an indication bit, where the indication bit is used to indicate whether the read data is Decryption;
  • the NVDIMM 1302 is configured to receive a data read command sent by the processor 1301, and after determining that the read data needs to be decrypted according to the indication bit, read from the NVDIMM 1302 according to the data read command. Data, decrypting the read data, and transmitting the decrypted data to the processor 1301.
  • the NVDIMM 1302 decrypts the read data, first acquires a decryption key, wherein the decryption key is generated by the processor 1301 and saved in advance; and then read out by using the decryption key pair. The data is decrypted.
  • the embodiment of the present invention provides a storage device 1400, specifically for implementing the method described in the embodiment of FIG. 7, wherein the specific implementation manner may be implemented by referring to the method shown in FIG. For example, the repetition will not be described again.
  • the structure of the device is as shown in FIG. 14, and includes a receiving unit 1401, a storage unit 1402, and a processing unit 1403, where:
  • the receiving unit 1401 is configured to receive a data decryption instruction sent by the processor, where the data decryption instruction is used to indicate that the read data is decrypted;
  • a storage unit 1402 configured to store data
  • the processing unit 1403 is configured to receive a data decryption instruction sent by the receiving unit 1401, read data in the storage unit 1402 according to the data decryption instruction, decrypt the read data, and decrypt the data.
  • the subsequent data is sent to the processor.
  • the storage device may be an NVDIMM or other storage device having a data storage function.
  • the processor When the processor needs to read data and needs to decrypt the data to be read, the processor sends a data decryption instruction, where the data decryption instruction is used to indicate that the data to be read is decrypted Send to the processor.
  • the processing unit 1403 After the receiving unit 1401 receives the data decryption instruction sent by the processor, the processing unit 1403 reads the data stored in the storage unit 1402 according to the read address information in the data decryption instruction, and reads the data. The fetched data is decrypted, and the decrypted data is sent to the processor.
  • the processor may send an existing data read instruction, and may select a corresponding according to a specific scenario and an NVDIMM access processing interface.
  • the processing unit 1403 reads out the data in the storage unit 1402 according to the data read command, and reads the read data. It is sent directly to the processor without performing decryption processing on the read data.
  • the receiving unit 1401 receives a data read S-SREAD command sent by the processor, where the S-SREAD command is used to indicate that the data to be read is decrypted;
  • the processing unit 1403 reads data from the storage unit 1402 according to the S-SREAD instruction, decrypts the read data, and transmits the decrypted read to the processor.
  • each functional unit in each embodiment of the present application may be integrated into one processing. In the device, it may be physically existed alone, or two or more units may be integrated into one module.
  • the above integrated unit can be implemented in the form of hardware or in the form of a software function module.
  • the integrated unit if implemented in the form of a software functional unit and sold or used as a standalone product, may be stored in a computer readable storage medium.
  • the instructions include a number of instructions for causing a terminal device (which may be a personal computer, a cell phone, or a network device, etc.) or a processor to perform all or part of the steps of the methods described in various embodiments of the present application.
  • the foregoing storage medium includes various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read only memory, a random access memory, a magnetic disk, or an optical disk.
  • the embodiment of the present invention further provides a computer, which is used to implement the method described in the embodiment of FIG. 7, wherein the specific implementation manner may be repeated with reference to the method embodiment shown in FIG. No further details are provided.
  • the device includes a processor 1501, an NVDIMM 1502, and a memory 1503.
  • connection medium between the processor 1501, the NVDIMM 1502, and the memory 1503 is not limited in the embodiment of the present application.
  • the memory 1503, the processor 1501, and the NVDIMM 1502 are connected by a bus 1504 in FIG. 15, and the bus is indicated by a thick line in FIG. 15, and the connection manner between other components is only schematically illustrated, and Not limited to limit.
  • the bus can be divided into an address bus, a data bus, a control bus, and the like. For ease of representation, only one thick line is shown in Figure 15, but it does not mean that there is only one bus or one type of bus.
  • the memory 1503 may be a volatile memory such as a random access memory; the memory 1503 may also be a non-volatile memory such as a read only memory, a flash memory, a hard disk or a solid-state drive (SSD), or a memory 1503. Any other medium that can be used to carry or store desired program code in the form of an instruction or data structure and that can be accessed by a computer, but is not limited thereto.
  • the memory 1503 may be a combination of the above memories.
  • the processor 1501 and the NVDIMM 1502 are used to implement the method of image processing as shown in FIG. 7, wherein:
  • the processor 1501 is configured to: when determining that data needs to be read from the NVDIMM 1502 and the read data needs to be decrypted, send a data decryption instruction to the NVDIMM 1502, where the data decryption instruction is used to indicate that the read data is decrypted;
  • the NVDIMM 1502 is configured to receive a data decryption instruction sent by the processor 1501, read data in the NVDIMM 1502 according to the data decryption instruction, perform decryption processing on the read data, and decrypt the data. Send to processor 1501.
  • the NVDIMM 1502 decrypts the read data, first acquires a decryption key, wherein the decryption key is generated by the processor 1501 and saved in advance; and then read out by using the decryption key pair. The data is decrypted.
  • the embodiment of the present invention further provides a computer readable storage medium storing computer program instructions and data required by the processor to perform the above method.
  • the storage medium may be a storage medium or the like similar to the above.
  • the NVDIMM determines whether the encryption/decryption needs to be performed by determining the indication bit in the received data write/read command, and the NVDIMM executes the corresponding data after the received data is added/unwritten.
  • the encryption and decryption operation eliminates the need for encryption and decryption operations by the processor, and the NVDIMM performs encryption and decryption operations by itself, which reduces the occupied processor bandwidth, thereby reducing the delay of the processor when reading and writing data, and does not require writing to all.
  • the data entered or read is encrypted and decrypted, and no additional encryption and decryption operations are required, which provides flexibility in encryption and decryption operations.
  • embodiments of the present application can be provided as a method, system, or computer program product.
  • the present application can take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment in combination of software and hardware.
  • the application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) including computer usable program code.
  • the computer program instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer readable memory produce an article of manufacture comprising the instruction device.
  • the apparatus implements the functions specified in one or more blocks of a flow or a flow and/or block diagram of the flowchart.
  • These computer program instructions can also be loaded onto a computer or other programmable data processing device such that a series of operational steps are performed on a computer or other programmable device to produce computer-implemented processing for execution on a computer or other programmable device.
  • the instructions provide steps for implementing the functions specified in one or more of the flow or in a block or blocks of a flow diagram.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Health & Medical Sciences (AREA)
  • Bioethics (AREA)
  • General Health & Medical Sciences (AREA)
  • Computer Hardware Design (AREA)
  • Computer Security & Cryptography (AREA)
  • Software Systems (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Storage Device Security (AREA)

Abstract

一种计算机内存数据加解密的方法及装置，用以解决现有技术中存在的对NVDIMM中存储的所有数据进行加解密的方式会导致计算机的处理效率降低，导致读写数据的延时增大的问题。NVDIMM通过确定接收到的数据写入/读出指令中的指示位确定是否需要加解密，NVDIMM在接收到数据加/解密指令后，执行对应的加解密操作，使得处理器无需进行加解密的操作，而由NVDIMM自行进行加解密操作，减少了占用的处理器带宽，进而减少读写数据时处理器的时延，同时不需要对所有的写入或读出的数据进行加解密，不需进行额外的加解密操作，可以提供加解密操作的灵活性。

Description

一种计算机内存数据加解密的方法及装置 技术领域
本申请涉及信息技术领域，尤其涉及一种计算机内存数据加解密的方法及装置。
背景技术
动态随机存取存储器(dynamic random access memory，DRAM)是现在计算机中最常使用的存储系统。计算机的系统数据和文件信息都会保存在DRAM中，但DRAM保存数据的时间较短，为了保证数据能够在DRAM中保存较长的时间，计算机需要隔一定的时间对DRAM进行刷新，若DRAM在一定时长内没有被刷新，DRAM中存储的数据将会丢失。而当计算机掉电时也会导致DRAM中存储的数据丢失，进而可能导致计算机系统崩溃。
非易失性双列直插内存模块(non-volatile dual in-line memory module,NVDIMM)由于集成了DRAM和非易失性内存芯片，在计算机掉电的情况下，数据仍可以正常保存且不会丢失，当计算机恢复正常并开始运行后，仍能继续使用NVDIMM中存储的数据，因此可以避免计算机系统崩溃。
鉴于NVDIMM的上述优点，NVDIMM逐渐被人们所关注，为了保证NVDIMM中存储的数据安全，需要对NVDIMM中存储的数据进行加密，而现有技术中只能对存储在NVDIMM中的全部数据进行加密，且数据的加/解密操作通常由计算机中的中央处理器(central processing unit，CPU)执行，例如当计算机需要将数据写入到NVDIMM时，计算机中的CPU在写入数据时需要对将要存储在NVDIMM中的数据执行加密操作，而额外的加密操作会增加CPU带宽，使得NVDIMM中写入数据时存在延时，且增加CPU的功耗，最终降低计算机的处理效率。
综上所述，现有的对NVDIMM中存储的所有数据进行加解密的方式会导致计算机的处理效率降低，导致读写数据的延时增大。
发明内容
本申请提供一种计算机内存数据加解密的方法及装置，用以解决现有技术中存在的对NVDIMM中存储的所有数据进行加解密的方式会导致处理效率降低，导致读写数据的延时增大的问题，采用本申请的方式，NVDIMM代替计算机的处理器执行加密操作，且不需要对所有保存在NVDIMM的数据进行加解密，能够减少处理器的占用带宽，减小处理器的功耗，进而减少处理器读写数据的时延。
第一方面，本申请提供了一种计算机内存数据加密的方法，所述方法包括：处理器在确定需要将数据写入到NVDIMM时，处理器可以发送数据写入指令和待写入数据至NVDIMM，数据写入指令中可以包含有对待写入数据的加密需求，所述数据写入指令中可以包含有指示位，所述指示位用于指示对所述待写入数据是否进行加密；NVDIMM接收所述处理器发送的数据写入指令和待写入数据，根据所述指示位确定需要对所述待写入数据进行加密处理后，对所述待写入数据进行加密，并将加密后的所述待写入数据写入所述NVDIMM中。
通过上述设计，处理器可以设置待写入数据的加密需求，并将所述需求通过数据写入指令发送给NVDIMM，由NVDIMM完成数据的加密和写入的操作，可以有效降低处理器的占用带宽，降低功耗，同时无需对所有写入NVDIMM的数据进行加密，使得加密方式更加灵活。
一种可能的设计中NVDIMM在确定需要对所述待写入数据进行加密处理后，先获取加密密钥，所述加密密钥可以由所述计算机的处理器生成并预先保存；在保存加密密钥时也可以对所述加密密钥进行加密，再保存加密后的加密密钥，之后所述NVDIMM利用所述加密密钥对所述待写入数据进行加密处理。
通过上述设计，所述加密密钥由所述处理器生成能够保证加密密钥不易被窃取，保证加密数据的安全性。
第二方面，本申请提供了一种计算机内存数据加密的方法，所述方法包括：处理器在确定需要将数据写入到NVDIMM，且需要对待写入数据进行加密时，处理器可以发送数据加密指令和待写入数据至NVDIMM，所述数据加密指令用于指示对所述待写入数据进行加密。NVDIMM接收所述处理器发送的数据加密指令和待写入数据；所述NVDIMM根据所述数据加密指令，对所述待写入数据进行加密，并将加密后的所述待写入数据写入所述NVDIMM中。
通过上述设计，处理器可以设置待写入数据的加密需求，并将所述需求通过数据加密指令发送给NVDIMM，由NVDIMM完成数据的加密和写入的操作，可以有效降低处理器的占用带宽，降低功耗，同时无需对所有写入NVDIMM的数据进行加密，使得加密方式更加灵活。
一种可能的设计中，NVDIMM在需要对所述待写入数据进行加密处理后，先获取加密密钥，所述加密密钥可以由所述处理器生成并预先保存；在保存加密密钥时也可以对所述加密密钥进行加密，再保存加密后的加密密钥，之后所述NVDIMM利用所述加密密钥对所述待写入数据进行加密处理。
通过上述设计，所述加密密钥由所述处理器生成能够保证加密密钥不易被窃取，保证加密数据的安全性。
第三方面，本申请提供了一种计算机内存数据解密的方法，所述方法包括：处理器在确定需要从NVDIMM中读取数据时，处理器可以发送数据读出指令至NVDIMM，其中数据读取指令中可以包含有对读取的数据的解密需求，所述数据读出指令中可以包含有指示位，所述指示位用于指示对读取数据是否进行解密；NVDIMM接收所述处理器发送的数据读出指令，所述NVDIMM根据所述指示位确定需要对所述读取数据进行解密处理后，根据所述数据读出指令从所述NVDIMM中读取数据，对读取的所述数据进行解密，并将解密后的所述数据发送至处理器。
通过上述设计，处理器可以设置对读取的数据的解密需求，并将所述需求通过数据读出指令发送给NVDIMM，由NVDIMM完成数据的解密和读出的操作，可以有效降低处理器的带宽，降低功耗，同时无需对所有写入NVDIMM的数据进行解密，使得解密方式更加灵活。
一种可能的设计中，所述NVDIMM在确定需要对读出的所述数据进行解密处理时，先获取解密密钥，其中，所述解密密钥由所述处理器生成并预先保存；在保存解密密钥时 也可以对所述解密密钥进行加密，再保存加密后的解密密钥，所述NVDIMM利用所述解密密钥对读出的所述数据进行解密处理。
通过上述设计，所述解密密钥由所述处理器生成能够保证解密密钥不易被窃取，保证NVDIMM中存储的数据的安全性。
第四方面，本申请提供了一种计算机内存数据解密的方法，所述方法包括：处理器在确定需要从NVDIMM中读取数据，且需要对读取的数据进行解密时，处理器可以发送数据解密指令至NVDIMM，所述数据解密指令用于指示对读取的数据进行解密，NVDIMM接收所述处理器发送的数据解密指令；根据所述数据解密指令在所述NVDIMM中读取数据，对读取的所述数据进行解密处理，并将解密后的所述数据发送至处理器。
通过上述设计，处理器可以设置对读取的数据的解密需求，并将所述需求通过数据解密指令发送给NVDIMM，由NVDIMM完成数据的解密和读出的操作，可以有效降低处理器的带宽，降低功耗，同时无需对所有写入NVDIMM的数据进行解密，使得解密方式更加灵活。
一种可能的设计中，所述NVDIMM在确定需要对读出的所述数据进行解密处理时，先获取解密密钥，其中，所述解密密钥由所述处理器生成并预先保存；在保存解密密钥时也可以对所述解密密钥进行加密，再保存加密后的解密密钥，所述NVDIMM利用所述解密密钥对读出的所述数据进行解密处理。
通过上述设计，所述解密密钥由所述处理器生成能够保证解密密钥不易被窃取，保证NVDIMM中存储的数据的安全性。
第五方面，本发明实施例提供了一种存储装置，所述存储装置具有实现上述方法实例中计算机内存数据加密的功能。所述功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。所述硬件或软件包括一个或多个与上述功能相对应的模块。
一种可能的设计中，存储装置包括接收单元、处理单元和存储单元，接收单元用于接收处理器发送的数据写入指令和待写入数据，所述数据写入指令中包含有指示位，所述指示位用于指示所述存储装置是否对所述待写入数据进行加密；接收单元将所述数据写入指令和待写入数据发送给处理单元；所述处理单元用于接收所述接收单元发来的所述数据写入指令和待写入数据，以及在根据所述数据写入指令中的指示位确定需要对所述待写入数据进行加密处理后，对所述待写入数据进行加密，并将加密后的所述待写入数据写入所述存储装置中所述存储单元中，所述存储单元用于存储数据。
一种可能的设计中，所述处理单元在对所述待写入数据进行加密处理时，获取加密密钥，其中，所述加密密钥由所述处理器生成并预先保存；之后，所述处理单元利用所述加密密钥对所述待写入数据进行加密处理。
一种可能的设计中，所述存储装置为非易失性双列直插内存模块NVDIMM。
第六方面，本发明实施例提供了一种存储装置，所述存储装置具有实现上述方法实例中计算机内存数据加密的功能。所述功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。所述硬件或软件包括一个或多个与上述功能相对应的模块。
一种可能的设计中，存储装置包括接收单元、处理单元和存储单元，接收单元用于接收计算机的处理器发送的数据加密指令和待写入数据，所述数据加密指令用于指示对所述待写入数据进行加密，将所述数据加密指令和待写入数据发送给处理单元；所述处理单元用于接收所述接收单元发来的所述数据加密指令和待写入数据，对所述待写入数据进行加 密，并根据所述数据加密指令将加密后的所述待写入数据写入所述存储装置中存储单元中；所述存储单元用于存储数据。
一种可能的设计中，所述处理单元在对所述待写入数据进行加密处理时，获取加密密钥，其中，所述加密密钥由所述处理器生成并预先保存；之后，所述处理单元利用所述加密密钥对所述待写入数据进行加密处理。
一种可能的设计中，所述存储装置为非易失性双列直插内存模块NVDIMM。
第七方面，本发明实施例提供了一种存储装置，所述存储装置具有实现上述方法实例中计算机内存数据解密的功能。所述功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。所述硬件或软件包括一个或多个与上述功能相对应的模块。
一种可能的设计中，存储装置包括接收单元、处理单元和存储单元。接收单元用于接收计算机的处理器发送的数据读出指令，所述数据读出指令中包含有指示位，所述指示位用于指示对读取数据是否进行解密，将数据读出指令发送给处理单元；所述处理单元用于接收所述接收单元发来的数据读出指令，在根据所述数据读出指令中指示位确定需要对所述读出数据进行解密处理后，根据所述数据读出指令从所述存储装置的存储单元中读取数据，对读取的所述数据进行解密处理，并将解密后的所述数据发送至处理器；所述存储单元用于存储数据。
一种可能的实施方式，所述处理单元对读取的所述数据进行解密处理时，先获取解密密钥，其中，所述解密密钥由所述处理器生成并预先保存；利用所述解密密钥对读取的所述数据进行解密处理。
一种可能的设计中，所述存储装置为非易失性双列直插内存模块NVDIMM。
第八方面，本发明实施例提供了一种存储装置，所述存储装置具有实现上述方法实例中计算机内存数据解密的功能。所述功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。所述硬件或软件包括一个或多个与上述功能相对应的模块。
一种可能的设计中，存储装置包括接收单元、处理单元和存储单元。所述接收单元用于接收计算机的处理器发送的数据解密指令，所述数据解密指令用于指示对读取的数据进行解密，将数据解密指令发送给处理单元；所述处理单元用于接收所述接收单元发来的数据解密指令，根据所述数据解密指令在所述存储装置的存储单元中读取数据；对读取的所述数据进行解密处理，并将解密后的所述数据发送至处理器；所述存储单元用于存储数据；
一种可能的设计中，所述处理单元对读取的所述数据进行解密处理时，先获取解密密钥，其中，所述解密密钥由所述处理器生成并预先保存；利用所述解密密钥对读取的所述数据进行解密处理。
一种可能的设计中，所述存储装置为非易失性双列直插内存模块NVDIMM。
第九方面，本发明实施例提了一种计算机，所述计算机中包含有处理器和NVDIMM，所述处理器用于在确定需要将待写入数据写入到NVDIMM时，发送数据写入指令和待写入数据至NVDIMM，所述数据写入指令中包含有指示位，所述指示位用于指示对所述待写入数据是否进行加密；NVDIMM用于接收所述计算机的处理器发送的数据写入指令和待写入数据，在根据所述指示位确定需要对所述待写入数据进行加密处理后，对所述待写入数据进行加密，并将加密后的所述待写入数据写入所述NVDIMM中。
一种可能的设计中，所述NVDIMM在对待写入数据进行加密时先获取加密密钥，其中，所述加密密钥由所述处理器生成并预先保存；之后利用所述加密密钥对所述待写入数据进行加密处理。
第十方面，本发明实施例提了一种计算机，所述计算机中包含有处理器和NVDIMM，所述处理器，用于在确定需要将待写入数据写入到NVDIMM且需要对所述待写入数据进行加密时，发送数据加密指令和待写入数据至NVDIMM，所述数据加密指令用于指示对所述待写入数据进行加密；NVDIMM用于接收所述计算机的处理器发送的数据加密指令和待写入数据；根据所述数据加密指令，对所述待写入数据进行加密，并将加密后的所述待写入数据写入所述NVDIMM中。
一种可能的设计中，所述NVDIMM对所述待写入数据进行加密处理时，先获取加密密钥，其中，所述加密密钥由所述处理器生成并预先保存；再利用所述加密密钥对所述待写入数据进行加密处理。
第十一方面，本发明实施例提了一种计算机，所述计算机中包含有处理器和NVDIMM，处理器，用于在确定需要从NVDIMM中读取数据时，发送数据读取指令至NVDIMM，所述数据读出指令中包含有指示位，所述指示位用于指示所述NVDIMM对读取数据是否进行解密；NVDIMM用于接收所述处理器发送的数据读出指令，根据所述指示位确定需要对所述读取数据进行解密处理后，根据所述数据读出指令从所述NVDIMM中读取数据，对读取的所述数据进行解密，并将解密后的所述数据发送至处理器。
一种可能的设计中，所述NVDIMM对读取的所述数据进行解密时，先获取解密密钥，其中，所述解密密钥由所述计算机的处理器生成并预先保存；利用所述解密密钥对读出的所述数据进行解密处理。
第十二方面，本发明实施例提了一种计算机，所述计算机中包含有处理器和NVDIMM，处理器，用于在确定需要从NVDIMM中读取数据，且读取的数据需要解密时，发送数据解密指令至NVDIMM，所述数据解密指令用于指示对读取的数据进行解密；NVDIMM用于接收所述计算机的处理器发送的数据解密指令；根据所述数据解密指令在所述NVDIMM中读取数据，对读取的所述数据进行解密处理，并将解密后的所述数据发送至处理器。
一种可能的设计中，所述NVDIMM对读取的所述数据进行解密时，具体用于：获取解密密钥，其中，所述解密密钥由所述处理器生成并预先保存；利用所述解密密钥对读出的所述数据进行解密处理。
第十三方面，本申请实施例中还提供一种计算机存储介质，该存储介质中存储软件程序，该软件程序在被一个或多个处理器读取并执行时可实现第一方面、第二方面、第三方面、第四方面或上述各个方面的任意一种设计提供的方法。
第十四方面，本申请实施例中还提供一种计算机芯片，所述芯片与存储器相连，用于读取并执行所述存储器中存储的软件程序，使得计算机执行上述第一方面、第二方面、第三方面、第四方面或上述各个方面的任意一种设计提供的方法。
本发明实施例中，在需要写入数据时，处理器通过所述需求通过数据写入指令的指示位或数据加密指令告知NVDIMM对待写入数据的加密需求；在需要读出数据时，处理器通过所述需求通过数据读出指令的指示位或数据解密指令告知NVDIMM对读取的数据的解密需求，由NVDIMM完成数据的加/解密和读写的操作，可以有效降低处理器的占用带 宽，降低功耗，同时无需对所有写入NVDIMM的数据进行加解密，使得加解密方式更加灵活。
附图说明
图1为本申请实施例提供的一种计算机的系统架构示意图；
图2为本申请实施例提供的一种页表的结构示意图；
图3为本申请实施例提供的一种确定C-bit位的方法示意图；
图4为本申请实施例提供的一种计算机内存数据加密的方法的流程图；
图5为本申请实施例提供的一种计算机内存数据加密的方法的流程图；
图6为本申请实施例提供的一种计算机内存数据解密的方法的流程图；
图7为本申请实施例提供的一种计算机内存数据解密的方法的流程图；
图8为本申请实施例提供的第一种存储装置的结构示意图；
图9为本申请实施例提供的第一种计算机的结构示意图；
图10为本申请实施例提供的第二种存储装置的结构示意图；
图11为本申请实施例提供的第二种计算机的结构示意图；
图12为本申请实施例提供的第三种存储装置的结构示意图；
图13为本申请实施例提供的第三种计算机的结构示意图；
图14为本申请实施例提供的第四种存储装置的结构示意图；
图15为本申请实施例提供的第四种计算机的结构示意图。
具体实施方式
首先，对本申请涉及的部分用语进行解释说明，以便使本领域技术人员理解。
1)、处理器，本发明实施例的处理器包括但不限于中央处理器(central processing unit，CPU)、ASIC(application specific integrated circuit，专用集成电路)、FPGA(field－programmable gate array，现场可编程门阵列)、CPLD(complex programmable logic device，复杂可编程逻辑器件)，凡是具有信息处理功能的IC电路均适用于本发明实施例。
2)、加密密钥和解密密钥，对数据进行加/解密处理时所需要的参数，加密密钥和解密密钥对应，可以相同也可以不同，取决于密钥生成算法。
3)、存储地址信息和读取地址信息，在本发明实施例中，当处理器需要将数据写入到NVDIMM时，需要在数据写入指令或数据加密指令中包含存储地址信息，以使处理器将所述数据写入到存储地址信息对应的存储区域中，存储地址信息可以为NVDIMM中存储区的物理地址信息，对应于所述NVDIMM的存储区域；在本发明实施例中，当处理器需要读取数据时，可以在数据读出指令或数据解密指令中包含有读取地址信息，以获取读取地址信息对应的存储区域中存储的数据，读取地址信息可以为NVDIMM中存储区的物理地址信息，对应于所述NVDIMM的存储区域。
4)、待读取数据和待写入数据，在本发明实施例中，当处理器需要将数据写入到NVDIMM时，可以将需要写入到NVDIMM中的数据称为待写入数据；当处理器需要读取数据时，可以将需要在NVDIMM中读取的数据称为待读取数据，所述待读取数据即为数据读出指令或数据解密指令中读取地址信息对应的存储区域中存储的数据。
5)、加密状况，在本发明实施例中，处理器或者NVDIMM中可以保存有NVDIMM中存储数据的加密状况，例如采用在页表条目中的C-bit记录，所述加密状况用于表明存储的数据是处于加密状态还是非加密状态，若处于加密状态则说明在写入所述数据时需要进行加密处理，在读取所述数据时需要进行解密处理，若为非加密状态则说明在写入所述数据时不需要进行加密处理，在读取所述数据时不需要进行解密处理。
6)、数据写入指令和数据读出指令，处理器在需要将数据写入到NVDIMM时，处理器发送给NVDIMM的指令为数据写入指令，其中可以设置指示位，指示NVDIMM对待写入数据是否进行加密，指示位可设置不同的设定值，以分别指示NVDIMM对待写入数据进行加密和NVDIMM对待写入数据不进行加密；处理器在需要从NVDIMM读取数据时，处理器发送给NVDIMM的指令为数据读出指令，其中可以设置指示位，指示NVDIMM对待读取数据是否进行解密，指示位可设置不同的设定值，以分别指示NVDIMM对待读取数据进行解密和NVDIMM对待读取数据不进行解密。
7)、数据加密指令和数据解密指令，处理器在需要将数据写入到NVDIMM，且需要对待写入数据进行加密时，处理器发送给NVDIMM的指令为数据加密指令，处理器在需要从NVDIMM读取数据，且需要对读取的数据进行解密时，处理器发送给NVDIMM的指令为数据解密指令，数据加密指令和数据解密指令为新定义的数据指令，其中可包含存储地址信息和读取地址信息，分别指示待写入数据要写入NVDIMM中的存储地址和从NVDIMM读取数据时的读取地址。
8)、多个，是指两个或两个以上。
本申请实施例方案可应用于各种装置，该装置包括但不限于个人计算机、服务器计算机、手持式或膝上型设备、移动设备(比如平板电脑、个人数字助理等)、小型计算机、大型计算机等。下面以计算机为例对本申请实施例提供的方案进行具体描述，下述先简单介绍计算机的具体结构组成。
参考图1所示，为本申请实施例应用的计算机100硬件结构示意图。如图1所示，计算机包括处理器110、NVDIMM120，存储器130。存储器130可用于存储软件程序以及数据，处理器110通过运行存储在存储器130中存储的软件程序以及数据，从而执行计算机的各种功能以及进行数据处理。存储器130主要包括程序存储区和数据存储区，其中，程序存储区可存储操作系统、至少一个功能所需的应用程序(比如控制计算机进入睡眠状态的功能等)等；数据存储区可存储根据计算机的使用过程所创建的数据，比如页表(page table，PT)等，在存储器130中可以保存多个页表，每个页表对应NVDIMM中一个物理存储区域。此外，存储器130可以为高速随机存取存储器，还可以为非易失性存储器，例如至少一个磁盘存储器件、闪存器件、或其他易失性固态存储器件。
处理器110是计算机的控制中心，利用各种接口和线路连接整个计算机的各个部分，通过运行或执行存储在存储器130内的软件程序和/或数据，执行计算机的各种功能和数据处理，从而对计算机进行整体监控。处理器110包括内存管理单元(memory management unit，MMU)111、内存控制器112等，用于执行相关操作，以实现本申请实施例所提供的技术方案。
NVDIMM120中包含有译码器121、控制器122和NVDIMM存储区123，所述译码器121对处理器110发送的指令进行译码后，发送给控制器122，由控制器122执行相关操作， NVDIMM存储区123为NVDIMM中用于存储数据的区域，其中包含有非易失性存储区域和易失性存储区域(例如可以是DRAM)。
处理器110控制内存管理单元111根据存储器130中保存的页表在NVDIMM中进行写入数据或读取数据，如图2所示，为一个页表结构示意图，页表中包含有多个页表条目(page table entry，PTE)，每个页表条目中包含有页虚拟地址和页物理地址及C-bit位等信息，在本发明实施例中，内存管理单元111可以根据页表中的页表条目来实现在NVDIMM中进行写入数据操作，内存管理单元111可以设置页表条目的C-bit来表示对应NVDIMM中一个存储区域存储的数据的加密状况，例如，内存管理单元111可以设置C-bit为1表示对应NVDIMM中的一个存储区域存储的数据为加密状态；设置C-bit为0表示对应NVDIMM中的一个存储区域存储的数据为非加密状态。上述利用C-bit记录NVDIMM存储的数据的加密状态和非加密状态的方式仅是举例说明，也可以利用内存控制器112的一些紧凑结构，例如可以采用Bloom Filter(布鲁姆过滤器)记录加密状况，凡是可以记录NVDIMM存储的数据的加密状况的方式均适用于于本发明实施例。
下面以利用页表条目中的C-bit记录NVDIMM存储的数据的加密状况的方式为例分别介绍计算机在自身中的NVDIMM中存储数据和读取数据的处理过程：
1、存储数据：
第一种情况：计算机需要存储数据，且存储的数据需要进行加密。
如图3所示，当处理器确定需要存储数据，且存储的数据需要进行加密时，处理器在存储器中为需要存储的数据分配一个新的页表条目PTE，页表条目内记录数据存储的页虚拟地址和缓存块内偏移的信息，并控制内存管理单元设置新页表条目中的页表条目的C-bit为1，以表示需要对存储的数据进行加密。之后，处理器将设置的新页表条目缓存至TLB(translation lookaside buffer，转换检测缓冲区)中，在TLB中，控制内存管理单元将完成虚拟地址翻译为物理地址的操作，并确定新页表条目的C-bit是否为0或为1，根据新页表条目的C-bit的信息在对应的cacheline元数据中记录新页表条目中C-bit的信息。
内存管理单元将缓存在TLB中的页表条目写入到内存控制器中，后续在接收到缓存相干互连(cache coherent interconnect，CHI)请求中携带有C-bit的信息时，内存控制器解析所述缓存相干互连请求中的C-bit的信息，在确定C-bit为1后，内存控制器发送数据写入指令和待写入数据至NVDIMM，其中，所述数据写入指令中包含有存储地址信息和指示位，所述指示位用于指示所述NVDIMM对所述待写入数据进行加密；或内存控制器发送数据加密指令和待写入数据至NVDIMM中，所述数据加密指令用于指示所述NVDIMM对所述待写入数据进行加密。
所述NVDIMM中的译码器接收到数据写入指令或数据加密指令后，所述译码器(decoder)对数据写入指令或数据加密指令进行译码，将译码后的数据写入指令或数据加密指令发送给NVDIMM中的控制器，NVDIMM中的控制器根据译码后的数据写入指令或数据加密指令选择将待写入数据进行加密，并将加密后的待写入数据保存在数据写入指令或数据加密指令指示的存储地址信息对应的存储区域中。
第二种情况：计算机需要存储数据，且存储的数据不需要进行加密。
当处理器确定需要存储数据，且存储的数据不需要进行加密时，处理器在存储区中为需要存储的数据分配一个新的页表条目PTE，并控制内存管理单元设置新页表条目中的 C-bit为0，以表示对待存储的数据不需要加密处理。之后，处理器将设置的新页表条目缓存至TLB中，页表条目的处理操作与上述第一种情况中介绍的过程类似，此处不再赘述。
内存管理单元将缓存在TLB的新页表条目写入到内存控制器中，后续在接收到的缓存相干互连请求中携带有C-bit的信息时，内存控制器解析所述缓存相干互连请求中的C-bit的信息，在确定C-bit为0后，内存控制器发送数据写入指令和待写入数据至NVDIMM，其中，所述数据写入指令中包含有存储地址信息和指示位，所述指示位用于指示所述NVDIMM对所述待写入数据不进行加密。
所述NVDIMM中的译码器接收到数据写入指令后，所述译码器对数据写入指令进行译码，将译码后的数据写入指令发送给NVDIMM中的控制器，NVDIMM中的控制器根据译码后的数据写入指令将待写入数据直接保存在数据写入指令指示的存储地址信息对应的存储区域中。
2、读取数据：
第一种情况：计算机需要读取数据，且待读取的数据需要进行解密。
当处理器确定需要读取保存在NVDIMM中的数据时，处理器调取需要读取的数据对应的页表条目PTE，并确定调取的页表条目中的C-bit为0或为1，根据页表条目的C-bit的信息在对应的cacheline元数据记录页表条目(PTE)中C-bit的信息；内存管理单元将缓存在TLB的页表条目写入到内存控制器中，后续内存控制器在接收到的缓存相干互连请求中携带有C-bit的信息时，内存控制器解析所述缓存相干互连请求中的C-bit的信息，在确定C-bit为1后，内存控制器发送数据读出指令至NVDIMM中，所述数据读出指令中包含有读取地址信息和指示位，所述指示位指示所述NVDIMM对待读取数据进行解密；或内存控制器发送数据解密指令至NVDIMM中，所述数据解密指令指示所述NVDIMM对待读取数据进行解密。
所述NVDIMM中的译码器接收到数据读出指令后，所述译码器对数据读出指令或数据解密指令进行译码，将译码后的数据读出指令或数据解密指令发送给NVDIMM中的控制器，NVDIMM中的控制器根据译码后的数据读出指令或数据解密指令读取对应读取地址信息的存储区域中存储的数据，并对读取的数据进行解密，并将解密后的数据发送至处理器。
第二种情况：计算机需要读取数据，且待读取的数据不需要进行解密。
当处理器确定需要读取保存在NVDIMM中的数据时，处理器调取需要读取的数据对应的页表条目PTE，处理器将调取的页表条目缓存至TLB中。内存管理单元将缓存在TLB的页表条目写入到内存控制器中，内存控制器后续在接收到的缓存相干互连请求中时，内存控制器解析所述缓存相干互连请求中的C-bit的信息，在确定C-bit为0后，内存控制器发送数据读出指令至NVDIMM；所述数据读出指令中包含有读取地址信息和指示位，所述指示位指示所述NVDIMM对待读取数据不进行解密。
所述NVDIMM中的译码器接收到数据读出指令后，所述译码器对数据读出指令进行译码，将译码后的数据读出指令发送给NVDIMM中的控制器，NVDIMM中的控制器根据译码后的数据读出指令获取与读取地址信息对应的存储区域中存储的数据，并将读取的数据发送至处理器。
基于上述介绍，本申请提供一种计算机内存数据加/解密的方法及装置，用以解决现有技术中存在的对NVDIMM中存储的数据进行加解密的方式会导致计算机的处理效率降低 且读写数据延迟较大的问题。其中，方法和装置是基于同一发明构思的，由于方法及装置解决问题的原理相似，因此装置与方法的实施可以相互参见，重复之处不再赘述。
首先，介绍本申请实施例提供的方法，该方法适用于上述图1所示的计算机100，因此，在本申请实施例中，仅以所述计算机100为例进行描述，但是并不限制本发明实施例应用到其他类型的终端设备中。参阅图4所示，该方法的具体流程包括：
步骤401：存储装置接收所述计算机的处理器发送的数据写入指令和待写入数据，所述数据写入指令中包含有指示位，所述指示位用于指示所述存储装置是否对所述待写入数据进行加密；
步骤402：存储装置根据所述指示位确定需要对所述待写入数据进行加密处理后，对所述待写入数据进行加密，并将加密后的所述待写入数据写入所述存储装置中；此外，若存储装置根据所述指示位确定不需要对所述待写入数据进行加密处理后，将所述待写入数据直接写入所述存储装置中，而无需执行加密处理。
较佳的，所述存储装置可以为NVDIMM，也可以为其他具有数据存储功能的存储装置。
下面以存储装置是NVDIMM为例进行说明，其他具有数据存储功能的存储装置也适用于本发明实施例所提供的方法。
所述数据写入指令中还可以包含有存储地址信息，用于指示所述NVDIMM将所述待写入数据存储到所述NVDIMM中与所述存储地址信息对应的存储区域中。
所述数据写入指令和待写入数据分别通过不同的总线，同时发送到NVDIMM，也可以是组装在一个消息中发送到NVDIMM，例如，所述处理器可以分别通过计算机中的指令总线发送一个消息，该消息中包括数据写入指令和待写入数据，采用同步的方式将数据写入指令和待写入数据发送至NVDIMM；也可以是采用异步的方式分别将数据写入指令和待写入数据发送至NVDIMM；所述计算机处理器在发送数据写入指令和待写入数据时，也可以将数据写入指令和待写入数据包含在一个数据包中，发送给NVDIMM。上述数据写入指令和待写入数据的发送方式仅是举例说明，凡是可以用于发送数据写入指令和待写入数据的方式均适用于本发明实施例。
当所述处理器需要写入数据、且所述待写入数据需要进行加密时，所述处理器发送数据写入指令和待写入数据，所述数据写入指令中包含有指示位，所述指示位指示所述NVDIMM对所述待写入数据进行加密；NVDIMM在接收到所述处理器发送的数据写入指令和待写入数据后，对所述待写入数据进行加密，并根据所述数据写入指令将加密后的所述待写入数据写入所述NVDIMM中。
其中，所述指示位可以为第一设定值，所述第一设定值可以用于指示所述NVDIMM对所述待写入数据进行加密。
当所述处理器需要写入数据、且所述待写入数据不需要进行加密时，所述处理器发送数据写入指令和待写入数据，所述数据写入指令中包含有指示位，所述指示位指示所述NVDIMM对所述待写入数据不进行加密；NVDIMM在接收到所述处理器发送的数据写入指令和待写入数据后，根据所述数据写入指令将所述待写入数据直接写入所述NVDIMM中，而无需对待写入数据执行加密处理。
其中，所述指示位可以为第二设定值，所述第二设定值可以用于指示所述NVDIMM不对所述待写入数据进行加密。
所述数据写入指令可以采用现有的数据写入指令格式，例如，DDR4接口下NVDIMM-P协议中的数据写入指令，XWRITE指令或PWRITE指令等；现有的数据写入指令中通常存在一些预留比特位(RFU)，可以将预留比特位的部分或全部作为指示位，例如DDR4接口下NVDIMM-P协议中的XWRITE指令中包括的A10/AP作为预留的比特位，就可以将A10/AP作为指示位；当NVDIMM接收到XWRITE指令或PWRITE指令时，先确定所述数据写入指令中的预留比特位是否为指示位，若所述预留比特位为指示位，在确定所述指示位指示对所述待写入数据进行加密后，对所述待写入数据进行加密，并将加密后的所述待写入数据写入所述NVDIMM中。
例如，在DDR4接口下的NVDIMM-P协议中的XWRITE指令中包含有预留比特位A10/AP，可以将A10/AP中的一个比特位设置为SEC bit(安全指示比特)位，用作指示位，指示所述NVDIMM是否对所述待写入数据进行加密，可以设置当SEC bit位为1时，指示所述NVDIMM对所述待写入数据进行加密，设置当SEC bit位为0时，指示所述NVDIMM对所述待写入数据不进行加密；也可以将预留比特位中的多个比特位设置为SEC bit位，用作指示位，具体指示方式可根据具体场景进行设置。
所述NVDIMM在根据指示位确定需要对所述待写入数据进行加密处理后，可以获取加密密钥，并利用所述加密密钥对所述待写入数据进行加密处理。其中，所述加密密钥可以由所述计算机的处理器生成并预先保存；所述加密密钥可以预先存储在所述NVDIMM中，也可以预先存储在计算机中的其他存储区域，例如计算机中的易失性存储器中。
为了进一步保证加密密钥的安全性，可以对加密密钥进行加密，例如通过SALT对加密密钥进行加密，加密后的加密密钥可以保存在所述NVDIMM中，也可以在计算机中的其他存储区域中，而将对加密密钥进行加密的密钥存储到另外的存储区域中，即存储到与存储有加密密钥的存储介质不同的其他存储介质上，例如，将加密后的加密密钥存储在NVDIMM的非易失性存储区域，将SALT和未加密的加密密钥存储在计算机中的易失性存储区域中。当然，为了获得更好的安全效果，可以将加密后的加密密钥、对加密密钥进行加密的密钥保存在计算机中除NVDIMM以外的存储区域中。
另一种实现方式中，所述加密密钥也可以由所述NVDIMM自己生成，但由于NVDIMM易受到攻击，可能导致加密密钥的生成方式泄露或加密密钥被获取，使得存储在NVDIMM中的数据安全性较差，为了避免加密密钥被窃取，可以在所述NVDIMM生成所述加密密钥后，对所述加密密钥进行加密，将加密后的加密密钥保存在NVDIMM中，将对加密密钥进行加密的密钥保存在计算机中除NVDIMM以外的存储区域中。
如图5所示，本发明实施例一种计算机内存数据加密的方法，该方法包括：
步骤501：存储装置接收所述计算机的处理器发送的数据加密指令和待写入数据，所述数据加密指令用于指示对所述待写入数据进行加密；
步骤502：存储装置根据所述数据加密指令对所述待写入数据进行加密，并将加密后的所述待写入数据写入所述存储装置中；
较佳的，所述存储装置可以为NVDIMM，也可以为其他具有数据存储功能的存储装置。
下面以存储装置是NVDIMM为例进行说明，其他具有数据存储功能的存储装置也适用于本发明实施例所提供的方法。
所述数据加密指令中还可以包含有存储地址信息，用于指示所述NVDIMM将所述待写入数据加密后存储到所述NVDIMM中与所述存储地址信息对应的存储区域中。
所述数据加密指令和待写入数据分别通过不同的总线，同时发送到NVDIMM，也可以是组装在一个消息中发送到NVDIMM，例如，所述处理器可以分别通过计算机中的指令总线发送一个消息，该消息中包括数据加密指令和待写入数据，采用同步的方式将数据加密指令和待写入数据发送至NVDIMM；也可以是采用异步的方式分别将数据加密指令和待写入数据发送至NVDIMM；所述计算机处理器在发送数据加密指令和待写入数据时，也可以将数据加密指令和待写入数据包含在一个数据包中，发送给NVDIMM。上述数据加密指令和待写入数据的发送方式仅是举例说明，凡是可以用于发送数据写入指令和待写入数据的方式均适用于本发明实施例。
当所述处理器需要写入数据、且所述待写入数据需要进行加密时，所述处理器发送数据加密指令和待写入数据，所述数据加密指令用于指示所述NVDIMM对所述待写入数据进行加密后写入到所述NVDIMM中。NVDIMM在接收到所述处理器发送的数据加密指令和待写入数据后，对所述待写入数据进行加密，并根据所述数据加密指令将加密后的所述待写入数据写入所述NVDIMM中。
当所述处理器需要写入数据、且所述待写入数据不需要进行加密时，所述处理器可以发送现有的数据写入指令和待写入数据，现有的数据写入指令可是DDR4接口下NVDIMM-P协议中的XWRITE指令、PWRITE指令、DDR5接口下NVDIMM-P协议中的XWRITE指令、PWRITE指令等，可根据具体场景和NVDIMM的接入处理接口选择相应的数据写入指令，NVDIMM在接收到所述处理器发送的数据写入指令和待写入数据后，根据所述数据写入指令直接将所述待写入数据写入所述NVDIMM中，不需要对所述待写入数据执行加密处理。
所述数据加密指令可以是新定义的指令，采用与现有XWRITE、PWRITE的命令编码不同的编码方式，例如在DDR5接口下NVDIMM-P协议中设置S-XWRITE指令，S-PWRITE指令，用作数据加密指令，其中，S-XWRITE用于指示将待写入数据进行加密后存储在所述NVDIMM中的易失性存储区域中，S-PWRITE用于指示将待写入数据进行加密后存储在所述NVDIMM中的非易失性存储区域中。
所述NVDIMM接收到数据加密指令和待写入数据后，需要对所述待写入数据进行加密处理，首先需要获取加密密钥，之后利用所述加密密钥对所述待写入数据进行加密处理。所述加密密钥的存储和加密方式与在图4所示的实施例中所述加密密钥的存储和加密方式相同，此处不再赘述。
如图6所示，本发明实施例一种计算机内存数据解密的方法，该方法包括：
步骤601：存储装置接收所述计算机的处理器发送的数据读出指令，所述数据读出指令中包含有指示位，所述指示位用于指示所述存储装置对待读取数据是否进行解密；
步骤602：存储装置根据所述指示位确定需要对所述待读取数据进行解密处理后，根据所述数据读出指令从所述存储装置中读取数据，对所述读取数据进行解密，并将解密后的所述读取发送至处理器；存储装置根据所述指示位确定不需要对所述待读取数据进行解密处理后，根据所述数据读出指令从所述存储装置中读取数据，并将所述读取发送至处理器。
较佳的，所述存储装置可以为NVDIMM，也可以为其他具有数据存储功能的存储装置。
下面以存储装置是NVDIMM为例进行说明，其他具有数据存储功能的存储装置也适用于本发明实施例所提供的方法。
所述数据读出指令中还可以包含有读取地址信息，用于指示所述NVDIMM读取存储在所述NVDIMM中与所述读取地址信息对应的存储区域中存储的数据。
当所述处理器需要读出数据、所述待读取数据需要进行解密时，所述处理器发送数据读出指令，所述数据读出指令中包含有指示位，所述指示位指示对待读取数据进行解密；NVDIMM在接收到所述处理器发送的数据读出指令后，根据数据读出指令读取数据，并对所述读取的数据进行解密，将解密后的所述数据发送至处理器。
其中，所述指示位可以为第三设定值，所述第三设定值可以用于指示所述NVDIMM对所述待读取数据进行解密。
当所述计算机中的处理器需要读取数据、且所述待读取数据不需要进行解密时，所述处理器发送数据读出指令，所述数据读出指令中包含有指示位，所述指示位指示对待读取数据不进行解密；NVDIMM在接收到所述处理器发送的数据读出指令后，根据数据读出指令读取数据，直接读取数据并将读取的所述数据发送至处理器。
其中，所述指示位可以为第四设定值，所述第四设定值可以用于指示对所述待读取数据不进行解密。
所述数据读出指令可以采用现有的数据读出指令格式，例如DDR4接口下NVDIMM-P协议中的数据读出指令XREAD、SREAD指令和DDR5接口下NVDIMM-P协议中的数据读出指令XREAD指令；现有的数据读出指令中通常存在一些预留比特位，可以将预留比特位作为指示位，例如DDR4接口下NVDIMM-P协议中的XREAD指令、SREAD指令中包括的A10/AP为预留比特位，可以将A10/AP作为指示位；又例如DDR5接口下NVDIMM-P协议中的数据读出指令XREAD中包含的命令/地址起始信号(Command/Address Signal Rising CLK_t)中的CA5和CA6为预留比特位，可以将CA5和CA6中的部分或全部比特位选做指示位，当NVDIMM接收到XREAD指令或SREAD指令，先确定XREAD指令或SREAD指令中的预留比特位是否为指示位，若所述预留比特位为指示位，在确定所述指示位指示所述NVDIMM对所述待读取数据进行解密后，对所述待读取数据进行解密，并将解密后的所述待读取发送至处理器。
例如，在DDR4接口下NVDIMM-P协议中的XREAD指令中包含有预留比特位A10/AP，可以将A10/AP中的一个比特位设置为SEC bit位，用作指示位，指示所述NVDIMM对所述待读取数据是否进行解密，可以设置当SEC bit位为1时，指示所述NVDIMM对所述待读取数据进行解密，设置当SEC bit位为0时，指示所述NVDIMM对所述待读取数据不进行解密。也可以将预留比特位中的多个比特位设置为SEC bit位，用作指示位，具体指示方式可根据具体场景进行设置。
所述NVDIMM在根据指示位确定需要对所述待读取数据进行解密处理后，可以获取解密密钥，并利用所述解密密钥对所述待读取数据进行解密处理。其中，所述解密密钥可以由所述计算机的处理器生成并预先保存；所述解密密钥可以预先存储在所述NVDIMM中，也可以预先存储在计算机中的其他存储区域，例如计算机中的易失性存储器中。
为了进一步保证解密密钥的安全性，可以对解密密钥进行加密，例如通过SALT对解密密钥进行加密，加密后的解密密钥可以保存在所述NVDIMM中，也可以在计算机中的其他存储区域中，而将对对解密密钥进行加密的密钥存储到另外的存储区域中，即存储到与存储有加密密钥的存储介质不同的其他存储介质上，例如，将加密后的解密密钥存储在NVDIMM的非易失性存储区域，将SALT和未加密的解密密钥存储在计算机中的易失性存储区域中。当然，为了获得更好的安全效果，可以将加密后的解密密钥、对解密密钥进行加密的密钥保存在计算机中除NVDIMM以外的存储区域中。
另一种实现方式中，所述解密密钥也可以由所述NVDIMM自己生成，但由于NVDIMM易受到攻击，可能导致解密密钥的生成方式泄露或解密密钥被获取，使得存储在NVDIMM中的数据安全性较差，为了避免解密密钥被窃取，可以在所述NVDIMM生成所述解密密钥后，对所述解密密钥进行加密，将加密后的解密密钥保存在NVDIMM中，将对解密密钥进行加密的密钥保存在计算机中除NVDIMM以外的存储区域中。
如图7所示，本发明实施例一种计算机内存数据解密的方法，该方法包括：
步骤701：存储装置接收所述计算机的处理器发送的数据解密指令，所述数据解密指令用于指示对读取的数据进行解密；
步骤702：存储装置根据所述数据解密指令读取在所述存储装置中的数据；
步骤703：存储装置对所述读取的数据进行解密处理，并将所述解密后的数据发送至处理器；
较佳的，所述存储装置可以为NVDIMM，也可以为其他具有数据存储功能的存储装置。
下面以存储装置是NVDIMM为例进行说明，其他具有数据存储功能的存储装置也适用于本发明实施例所提供的方法。
所述数据解密指令中还可以包含有读取地址信息，用于指示所述NVDIMM读取存储在所述NVDIMM中与所述读取地址信息对应的存储区域中存储的数据。
当所述处理器需要读出数据、且需要对所述待读取数据进行解密时，所述处理器发送数据解密指令，所述数据解密指令用于指示对所述待读取数据进行解密后发送至处理器。NVDIMM在接收到所述处理器发送的数据解密指令后，根据数据解密指令中的读取地址信息读取所述读取地址信息对应的存储区域中存储的数据，并对所述读取的数据进行解密，将解密后的所述数据发送至处理器。
当所述处理器需要读取数据、且不需要对所述待读取数据进行解密时，所述处理器可以发送现有的数据读出指令，现有的数据读出指令可是DDR4接口下NVDIMM-P协议中的XREAD指令、SREAD指令、DDR5接口下NVDIMM-P协议中的XREAD指令、SREAD指令等，可根据具体场景和NVDIMM接入处理接口选择相应的数据读出指令；NVDIMM在接收到所述处理器发送的数据读出指令后，根据所述数据读出指令在NVDIMM中读出数据，并将所述读出的数据直接发送至处理器，而无需对读出的数据执行解密处理。
所述数据解密指令可以是新定义的指令，采用与现有XREAD指令、SREAD命令编码不同的编码方式，例如DDR5接口下NVDIMM-P协议中设置的S-XREAD指令、S-SREAD指令，用作数据加密指令，其中，S-XREAD用于指示所述NVDIMM采用异步的方式将待读取的数据进行解密后发送至处理器，S-SREAD用于指示所述NVDIMM采用同步的方式将待读取的数据进行解密后发送至处理器。
在一种实施方式中，所述计算机中保存有所述NVDIMM中存储数据的加密状况，例如采用PTE中C-bit记录所述NVDIMM中存储数据的加密状况，当处理器需要读取数据时，所述处理器可以先确定所述NVDIMM中存储数据的加密状况中所述待读取数据是否为加密状态，若为加密状态，则所述处理器发送所述数据解密指令，否则处理器发送现有的数据读取指令即可。
在另一种实施方式中，在所述NVDIMM中存储有所述NVDIMM中存储数据的加密状况，当处理器需要读取数据时，所述处理器无需查看待读取数据的加密状况，直接发送数据解密指令，当所述NVDIMM接收到数据解密指令后，所述NVDIMM先确定保存的所述NVDIMM中存储数据的加密状况中所述待读取数据是否为加密状态，若为加密状态，则所述NVDIMM对所述待读取数据进行解密处理，否则，所述NVDIMM对所述待读取数据不进行解密处理。
所述NVDIMM在收到数据解密指令后，确定需要对所述待读取数据进行解密处理后，可以获取解密密钥，并利用所述解密密钥对所述待读取数据进行解密处理。所述解密密钥的存储和加密方式已在图6所示的实施例中描述，此处不再赘述。
如下表1所示，为本发明实施例中DDR4接口下NVDIMM-P协议中定义的数据读写指令的命令编码：
Figure PCTCN2017100067-appb-000001
表1
表1中，CKE0、CS_n、ACT_n、RAS_n/A16、CAS_n/A15、WE_n/A14、C0_C2、BG0_BG1、BA0_BA1、A17、A12/BC_n、A13、A11、A10/AP、A9、A8、A0_A7表示数据读写指令中各个比特位的位置标识，需要说明的是，表1中只显示了数据读写指令中的部分比特位。表1中H表示高电位，L表示低点位，ADDR[39:33]表示所述数据读写指令携带的地址信息，中括号内部的数字表示NVDIMM中存储区域的地址位，WGID[7:0]表示在数据写入后将写入结果反馈给处理器时所携带的信息，以使处理器在收到包含有WID的信息时确定对应的数据已经写入，RID[7:0]表示在数据读取后将读出的数据反馈给处理器时所携带的信息，以使处理器在收到包含有RID的数据包时确定对应的读取数据；一个WID通常对 应多个PWRITE指令和待写入数据，对应这个WID的最后一个PWRITE必须利用Pe＝1表示所有对应这个WID的PWRITE数据所述NVDIMM已收到。SEC表示本发明实施例在数据写入指令和数据读出指令的指示位。RFU表示数据读写指令中的预留位。
其中，DDR4接口下NVDIMM-P协议中定义的数据写入指令分别为缓冲写命令(buffered write，XWRITE)、持久性写命令(persistent write，PWRITE)；XWRITE指令用于指示NVDIMM将数据写入到NVDIMM的易失性存储区域中，PWRITE指令用于指示NVDIMM将数据写入到NVDIMM的非易失性存储区域中，保证数据能够永久性保存。
DDR4接口下NVDIMM-P协议中定义的XWRITE指令存在一些预留位，分别为A10/AP,A17,A12,A13，上述预留位均可以作为指示位，在表1中用A10/AP表示SEC bit，用作指示位。
NVDIMM接收所述计算机的处理器发送的数据写入XWRITE指令和待写入数据，所述数据写入指令中包含有安全SEC指示位，所述SEC指示位用于指示对所述待写入数据是否进行加密；
NVDIMM根据所述SEC指示位确定需要对所述待写入数据进行加密处理后，对所述待写入数据进行加密，并将加密后的所述待写入数据写入所述NVDIMM中；
NVDIMM根据所述SEC指示位确定不需要对所述待写入数据进行加密处理后，将所述待写入数据写入所述NVDIMM中。
其中，DDR4接口下NVDIMM-P协议中定义的数据读出指令分别为异步读命令(transactional read，XREAD)，投机读命令(speculative read，SREAD)；XREAD指令用于指示NVDIMM采用异步的方式从NVDIMM的存储区域读取数据，SREAD指令用于指示NVDIMM采用同步的方式从NVDIMM的存储区域读取数据。
DDR4接口下NVDIMM-P协议中定义的XREAD指令中包括的预留位为A10/AP，A10/AP可以作为指示位，在表1中XREAD指令中用A10/AP表示SEC bit，用作指示位；SREAD指令的预留位为A10/AP，A10/AP可以作为指示位，在表1中SREAD指令中用A10/AP表示SEC bit，用作指示位。
NVDIMM接收所述计算机的处理器发送的数据读出XREAD指令，所述XREAD指令中包含有安全SEC指示位，所述SEC指示位用于指示所述NVDIMM对待读取数据是否进行解密；
NVDIMM根据所述SEC指示位确定需要对所述待读取数据进行解密处理后，根据XREAD指令从所述NVDIMM中读取数据，对所述读取数据进行解密，并将解密后的所述读取发送至处理器；
NVDIMM根据所述SEC指示位确定不需要对所述待读取数据进行解密处理后，根据所述数据读出指令从所述NVDIMM中读取数据，将所述读取发送至处理器。
NVDIMM接收所述计算机的处理器发送的数据读出SREAD指令，所述SREAD指令中包含有安全SEC指示位，所述SEC指示位用于指示所述NVDIMM对待读取数据是否进行解密；
NVDIMM根据所述SEC指示位确定需要对所述待读取数据进行解密处理后，根据XREAD指令从所述NVDIMM中读取数据，对所述读取数据进行解密，并将解密后的所述读取发送至处理器；
NVDIMM根据所述SEC指示位确定不需要对所述待读取数据进行解密处理后，根据所述SREAD指令从所述NVDIMM中读取数据，将所述读取发送至处理器。
需要说明的是，DDR4接口下NVDIMM-P协议下还定义了XADR指令。XADR指令是在接收到XWRITE/XREAD/SREAD/PWRITE后，采用背靠背的方式发送的，XADR指令中可以发40位的地址ADDR[39：0]和8位的RID[7：0]或者WGID[7：0]。
如下表2所示，为本发明实施例中DDR5接口下NVDIMM-P协议中定义的数据读写命令及数据加解密命令的命令编码：
Figure PCTCN2017100067-appb-000002
表2
表2中，CS、Command/Address Signal Rising CLK_t、Command/Address Signal Falling CLK_t表示数据读写指令中各个比特位的位置标识，Command/Address Signal Rising CLK_t和Command/Address Signal Falling CLK_t分别对应CA0-CA6不同的比特位，需要说明的是，表2中只显示了数据读写指令中的部分比特位。表2中H表示高电位，L表示低点位，ADDR[11:5]表示所述数据读写指令携带的地址信息，中括号内部的数字表示NVDIMM中的存储区域的地址位，WGID[9:0]表示在数据写入后将写入结果反馈给处理器时所携带的信息，以使处理器在收到包含有WGID的信息时确定对应的数据已经写入，RID[9:0]表示在数据读取后将读出的数据反馈给处理器时所携带的信息，以使处理器在收到包含有RID的数据包时确定对应的读取数据，BL*＝L，BL表示所述突发长度，BL＝L表示突发长度是16，SEC表示本发明实施例在数据写入指令和数据读出指令的指示位。
其中，DDR5接口下NVDIMM-P协议中定义的数据写入指令分别为缓冲写命令(buffered write，XWRITE)、持久性写命令(persistent write，PWRITE)；XWRITE指令用于指示NVDIMM将数据写入到NVDIMM的易失性存储区域中，PWRITE指令用于指示NVDIMM将数据写入到NVDIMM的非易失性存储区域中，以保证数据能够永久性保存。
DDR5接口下NVDIMM-P协议中定义的XWRITE指令存在一些预留位，分别为Command/Address Signal Falling CLK_t中的CA4、CA5、CA6，上述预留位均可以作为指示位。
NVDIMM接收所述计算机的处理器发送的数据写入XWRITE指令和待写入数据，所述数据写入指令中包含有安全SEC指示位，所述SEC指示位用于指示所述NVDIMM是否对所述待写入数据进行加密；
NVDIMM根据所述SEC指示位确定需要对所述待写入数据进行加密处理后，对所述待写入数据进行加密，并将加密后的所述待写入数据写入所述NVDIMM中；
NVDIMM根据所述SEC指示位确定不需要对所述待写入数据进行加密处理后，将所述待写入数据写入所述NVDIMM中。
DDR5接口下NVDIMM-P协议中存在一些预留的代码指令，在本发明实施例中可以利用预留的代码指令定义数据加密指令，在表2中，新定义的数据加密指令有安全缓冲写命令(S-XWRITE)和安全持久性写命令(S-PWRITE)，S-XWRITE指令用于指示NVDIMM对待写入数据加密后写入到NVDIMM的易失性存储区域中，S-PWRITE指令用于指示NVDIMM对待写入数据加密后写入到NVDIMM的非易失性存储区域中，以保证数据能够永久性保存。
为了区分S-XWRITE指令和XWRITE指令，在Command/Address Signal Rising CLK_t中CA0-CA6中设置不完全相同的电平，在表2中，S-XWRITE的Command/Address Signal Rising CLK_t中CA0-CA3分别设置H、H、L、L，XWRITE的Command/Address Signal Rising CLK_t中CA0-CA3分别为H、L、H、H。
为了区分S-PWRITE指令和PWRITE指令，在Command/Address Signal Rising CLK_t中CA0-CA6中设置不完全相同的电平，在表2中，S-PWRITE的Command/Address SignalRising CLK_t中CA0-CA3分别设置H、H、L、L；PWRITE的Command/Address Signal Rising CLK_t中CA0-CA3分别设置H、L、H、H。
NVDIMM接收所述计算机的处理器发送的数据加密S-XWRITE指令和待写入数据。
NVDIMM在接收到所述处理器发送的S-XWRITE指令和待写入数据后，对所述待写入数据进行加密，并根据所述S-XWRITE指令将加密后的所述待写入数据写入所述NVDIMM中。
NVDIMM接收所述计算机的处理器发送的数据加密S-PWRITE指令和待写入数据。
NVDIMM在接收到所述处理器发送的S-PWRITE指令和待写入数据后，对所述待写入数据进行加密，并根据所述S-PWRITE指令将加密后的所述待写入数据写入所述NVDIMM中。
其中，DDR5接口下NVDIMM-P协议中定义的数据读出指令分别为异步读命令(transactional read，XREAD)，投机读命令(speculative read，SREAD)；XREAD指令用于指示NVDIMM采用异步的方式从NVDIMM的存储区域读取数据，SREAD指令用于指示NVDIMM采用同步的方式从NVDIMM的存储区域读取数据。
DDR5接口下NVDIMM-P协议中定义的XREAD指令的预留位为Command/Address Signal Rising CLK_t中的CA5、CA6，上述预留位可以作为指示位，在表3中XREAD指令中用Command/Address Signal Rising CLK_t中的CA6表示SEC bit，用作指示位。
DDR5接口下NVDIMM-P协议中也存在一些预留的代码指令，在本发明实施例中可以利用这些预留的代码指令定义数据解密指令，在表2中，一种示例为新定义的数据解密指令为解密投机读命令(S-SREAD)，S-SREAD指令用于指示NVDIMM采用同步的方式从NVDIMM的存储区域读取数据并对读取的数据进行解密。
为了区分S-SREAD指令和SREAD指令，在Command/Address Signal Rising CLK_t中CA0-CA6中设置不完全相同的电平，在表2中，S-SREAD的Command/Address Signal Rising CLK_t中CA0-CA3分别设置H、H、L、L,SREADE的Command/Address Signal Rising CLK_t中CA0-CA3分别为H、L、H、H。
NVDIMM接收所述处理器发送的数据读出XREAD指令，所述XREAD指令中包含有解密SEC指示位，所述SEC指示位用于指示所述NVDIMM对待读取数据是否进行解密；
NVDIMM根据所述SEC指示位确定需要对所述待读取数据进行解密处理后，根据XREAD指令从所述NVDIMM中读取数据，对所述读取数据进行解密，并将解密后的所述读取发送至处理器。
NVDIMM接收所述处理器发送的数据读出S-SREAD指令，所述S-SREAD指令用于指示对待读取数据进行解密；
NVDIMM根据S-SREAD指令从所述NVDIMM中读取数据，对所述读取数据进行解密，并将解密后的所述读取发送至处理器。
需要说明的是，DDR5接口下NVDIMM-P协议下还定义了XADR指令。XADR指令是在接收到XWRITE/XREAD/SREAD/PWRITE后，采用背靠背的方式发送的，XADR指令中可以发40位的地址ADDR[39：0]和10位的RID[9：0]或者WGID[9：0]。
在一种可能的实施方式，所述处理器可以指示所述NVDIMM对所有需写入到所述NVDIMM中的数据进行加密，处理器通过配置模式寄存器的加密确定(Encryption Enable)指示所述NVDIMM是否对所有需写入到所述NVDIMM的数据进行加密，例如所述处理器配置Encryption Enable的bit位为1时，指示NVDIMM要加密所有需写入的数据，Encryption Enable的bit位为0时，指示所述NVDIMM可采用如图4、图5所示的实施例对数据进行加密。
如表3所示为DDR4接口下NVDIMM-P协议中的模式寄存器各个地址位的指示信息和对应描述。
其中在预留位A17中设置Encryption Enable的bit位为1时，用于指示NVDIMM要加密所有需写入的数据，Encryption Enable的bit位为0时，用于指示NVDIMM对所有需写入的数据均不进行加密，可根据处理器发送的数据写入指令或数据加密指令进一步再确定是否需要对待写入的数据进行加密。
Figure PCTCN2017100067-appb-000003
Figure PCTCN2017100067-appb-000004
表3
基于与方法实施例的同一发明构思，本发明实施例提供一种存储装置800，具体用于实现图4所述的实施例描述的方法，其中，具体实施方式可以参照图4所示的方法实施例，重复之处不再赘述，该装置的结构如图8所示，包括接收单元801、存储单元802和处理单元803，其中：
接收单元801，用于接收处理器发送的数据写入指令和待写入数据，所述数据写入指令中包含有指示位，其中，所述指示位用于指示对所述待写入数据是否进行加密；
存储单元802，用于存储数据；
处理单元803，用于接收所述接收单元801发来的所述数据写入指令和所述待写入数据，并根据所述数据写入指令中的所述指示位，确定需要对所述待写入数据进行加密处理后，对所述待写入数据进行加密，并将加密后的所述待写入所述存储单元802中。
较佳的，所述存储装置可以为NVDIMM，也可以为其他具有数据存储功能的存储装置。
当所述处理器需要写入数据、且所述待写入数据需要进行加密时，所述处理器发送数据写入指令和待写入数据，所述数据写入指令中包含有指示位，所述指示位指示对所述待写入数据进行加密；接收单元801接收所述处理器发送的数据写入指令和待写入数据，处理单元803对所述待写入数据进行加密，并根据所述数据写入指令将加密后的所述待写入数据写入所述存储单元802中。
其中，所述指示位可以为第一设定值，所述第一设定值可以用于指示所述处理单元803对所述待写入数据进行加密。
当所述处理器需要写入数据、且所述待写入数据不需要进行加密时，所述处理器发送数据写入指令和待写入数据，所述数据写入指令中包含有指示位，所述指示位指示所述NVDIMM对所述待写入数据不进行加密；接收单元801接收到所述处理器发送的数据写入指令和待写入数据，处理单元803根据所述数据写入指令将所述待写入数据直接写入所述存储单元802中，而无需对待写入数据执行加密处理。
其中，所述指示位可以为第二设定值，所述第二设定值可以用于指示所述NVDIMM不对所述待写入数据进行加密。
所述处理单元803在根据指示位确定需要对所述待写入数据进行加密处理后，可以获取加密密钥，并利用所述加密密钥对所述待写入数据进行加密处理。其中，所述加密密钥可以由所述计算机的处理器生成并预先保存；
接收单元801接收所述计算机的处理器发送的数据写入XWRITE指令和待写入数据，所述数据写入指令中包含有安全SEC指示位，所述SEC指示位用于指示对所述待写入数据是否进行加密；
处理单元803根据所述SEC指示位确定需要对所述待写入数据进行加密处理后，对所述待写入数据进行加密，并将加密后的所述待写入数据写入所述存储单元802中；
处理单元803根据所述SEC指示位确定不需要对所述待写入数据进行加密处理后，将所述待写入数据写入所述存储单元802中。
本申请实施例中对单元的划分是示意性的，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，另外，在本申请各个实施例中的各功能单元可以集成在一个处理器中，也可以是单独物理存在，也可以两个或两个以上单元集成在一个模块中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能模块的形式实现。
所述集成的单元如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的全部或部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台终端设备(可以是个人计算机，手机，或者网络设备等)或处理器(processor)执行本申请各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(read-only memory，ROM)、随机存取存储器(random access memory，RAM)、磁碟或者光盘等各种可以存储程序代码的介质。
基于以上实施例，本发明实施例还提供了一种计算机，所述计算机用于实现图4所述的实施例描述的方法，其中，具体实施方式可以参照图4所示的方法实施例，重复之处不再赘述，参阅如图9所示，所述设备包括处理器901、NVDIMM902和存储器903。
本申请实施例中不限定上述处理器901、NVDIMM902和存储器903之间的具体连接介质。本申请实施例在图9中以存储器903、处理器901以及NVDIMM902之间通过总线904连接，总线在图9中以粗线表示，其它部件之间的连接方式，仅是进行示意性说明，并不引以为限。所述总线可以分为地址总线、数据总线、控制总线等。为便于表示，图10中仅用一条粗线表示，但并不表示仅有一根总线或一种类型的总线。
存储器903可以是易失性存储器(volatile memory)，例如随机存取存储器(random-access memory，RAM)；存储器903也可以是非易失性存储器(non-volatile memory)，例如只读存储器，快闪存储器(flash memory)，硬盘(hard disk drive，HDD)或固态硬盘(solid-state drive，SSD)、或者存储器903是能够用于携带或存储具有指令或数据结构形式的期望的程序代码并能够由计算机存取的任何其他介质，但不限于此。存储器903可以是上述存储器的组合。
处理器901和NVDIMM902用于实现如图4所示的图像处理的方法，其中：
处理器，用于在确定需要将待写入数据写入到NVDIMM时，发送数据写入指令和待写入数据至NVDIMM，所述数据写入指令中包含有指示位，所述指示位用于指示对所述待写入数据是否进行加密；
NVDIMM，用于接收所述处理器发送的数据写入指令和待写入数据，在根据所述指示位确定需要对所述待写入数据进行加密处理后，对所述待写入数据进行加密，并将加密后的所述待写入数据写入所述NVDIMM中。
所述NVDIMM在对所述待写入数据进行加密时，可先获取加密密钥，其中，所述加密密钥由所述处理器生成并预先保存；再利用所述加密密钥对所述待写入数据进行加密处理。
基于与方法实施例的同一发明构思，本发明实施例提供一种存储装置1000，具体用于实现图5所述的实施例描述的方法，其中，具体实施方式可以参照图5所示的方法实施例，重复之处不再赘述，该装置的结构如图10所示，包括接收单元1001、存储单元1002和处理单元1003，其中：
接收单元1001，用于接收处理器发送的数据加密指令和待写入数据，所述数据加密指令用于指示对所述待写入数据进行加密；
存储单元1002，用于存储数据；
处理单元1003，用于接收所述接收单元1001发来所述数据加密指令和待写入数据，对所述待写入数据进行加密，并根据所述数据加密指令将加密后的所述待写入数据写入所述存储单元1002中。
较佳的，所述存储装置可以为NVDIMM，也可以为其他具有数据存储功能的存储装置。
当所述处理器需要写入数据、且所述待写入数据需要进行加密时，所述处理器发送数据加密指令和待写入数据，所述数据加密指令用于指示对所述待写入数据进行加密后写入到所述存储单元1002中。接收单元1001接收到所述处理器发送的数据加密指令和待写入数据，处理单元1003对所述待写入数据进行加密，并根据所述数据加密指令将加密后的所述待写入数据写入所述存储单元1002中。
当所述处理器需要写入数据、且所述待写入数据不需要进行加密时，所述处理器可以发送现有的数据写入指令和待写入数据，可根据具体场景和NVDIMM的接入处理接口选择相应的数据写入指令，接收单元1001接收所述处理器发送的数据写入指令和待写入数据，处理单元1003根据所述数据写入指令直接将所述待写入数据写入所述存储单元1002中，不需要对所述待写入数据执行加密处理。
接收单元1001接收所述计算机的处理器发送的数据加密S-XWRITE指令和待写入数据。
处理单元1003对所述待写入数据进行加密，并根据所述S-XWRITE指令将加密后的所述待写入数据写入所述NVDIMM中。
接收单元1001接收所述计算机的处理器发送的数据加密S-PWRITE指令和待写入数据。
处理单元1003对所述待写入数据进行加密，并根据所述S-PWRITE指令将加密后的所述待写入数据写入所述NVDIMM中。
本申请实施例中对单元的划分是示意性的，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，另外，在本申请各个实施例中的各功能单元可以集成在一个处理器中，也可以是单独物理存在，也可以两个或两个以上单元集成在一个模块中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能模块的形式实现。
所述集成的单元如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的全部或部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台终端设备(可以是个人计算机，手机，或者网络设备等)或处理器执行本申请各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器、随机存取存储器、磁碟或者光盘等各种可以存储程序代码的介质。
基于以上实施例，本发明实施例还提供了一种计算机，所述计算机用于实现图5所述的实施例描述的方法，其中，具体实施方式可以参照图5所示的方法实施例，重复之处不再赘述，参阅如图11所示，所述设备包括处理器1101、NVDIMM1102和存储器1103。
本申请实施例中不限定上述处理器1101、NVDIMM1102和存储器1103之间的具体连接介质。本申请实施例在图11中以存储器1103、处理器1101以及NVDIMM1102之间通过总线1104连接，总线在图11中以粗线表示，其它部件之间的连接方式，仅是进行示意性说明，并不引以为限。所述总线可以分为地址总线、数据总线、控制总线等。为便于表示，图10中仅用一条粗线表示，但并不表示仅有一根总线或一种类型的总线。
存储器1103可以是易失性存储器，例如随机存取存储器；存储器1103也可以是非易失性存储器，例如只读存储器，快闪存储器，硬盘或固态硬盘、或者存储器1103是能够用于携带或存储具有指令或数据结构形式的期望的程序代码并能够由计算机存取的任何其他介质，但不限于此。存储器1103可以是上述存储器的组合。
处理器1101和NVDIMM1102用于实现如图5所示的图像处理的方法，其中：
处理器1101，用于在确定需要将待写入数据写入到NVDIMM1102且需要对所述待写入数据进行加密时，发送数据加密指令和待写入数据至NVDIMM1102，所述数据加密指令用于指示对所述待写入数据进行加密；
NVDIMM1102，用于接收所述处理器1101发送的数据加密指令和待写入数据；根据所述数据加密指令，对所述待写入数据进行加密，并将加密后的所述待写入数据写入所述NVDIMM1102中。
所述NVDIMM1102对所述待写入数据进行加密处理时，具体用于：
获取加密密钥，其中，所述加密密钥由所述处理器1101生成并预先保存；
利用所述加密密钥对所述待写入数据进行加密处理。
所述NVDIMM1102在对所述待写入数据进行加密时，可先获取加密密钥，其中，所述加密密钥由所述处理器1101生成并预先保存；再利用所述加密密钥对所述待写入数据进行加密处理。
基于与方法实施例的同一发明构思，本发明实施例提供一种存储装置1200，具体用于实现图6所述的实施例描述的方法，其中，具体实施方式可以参照图6所示的方法实施例，重复之处不再赘述，该装置的结构如图12所示，包括接收单元1201、存储单元1202和处理单元1203，其中：
接收单元1201，用于接收处理器发送的数据读出指令，所述数据读出指令中包含有指示位，所述指示位用于指示对读取的数据是否进行解密；
存储单元1202，用于存储数据；
处理单元1203，用于接收所述接收单元1201发来的数据读出指令，在根据所述数据读出指令中的指示位确定需要对所述读取数据进行解密处理后，根据所述数据读出指令从所述存储单元1202中读取数据，对读取的所述数据进行解密处理，并将解密后的所述数据发送至处理器。
当所述处理器需要读出数据、所述待读取数据需要进行解密时，所述处理器发送数据读出指令，所述数据读出指令中包含有指示位，所述指示位指示对待读取数据进行解密；接收单元1201在接收到所述处理器发送的数据读出指令后，处理单元1203根据数据读出指令读取数据，并对所述读取的数据进行解密，将解密后的所述数据发送至处理器。
其中，所述指示位可以为第三设定值，所述第三设定值可以用于指示所述处理单元1203对所述待读取数据进行解密。
当所述计算机中的处理器需要读取数据、且所述待读取数据不需要进行解密时，所述处理器发送数据读出指令，所述数据读出指令中包含有指示位，所述指示位指示对待读取数据不进行解密；接收单元1201接收到所述处理器发送的数据读出指令，处理单元1203根据数据读出指令读取数据，直接读取数据并将读取的所述数据发送至处理器。
其中，所述指示位可以为第四设定值，所述第四设定值可以用于指示对所述待读取数据不进行解密。
接收单元1201接收所述计算机的处理器发送的数据读出XREAD指令，所述XREAD指令中包含有安全SEC指示位，所述SEC指示位用于指示对待读取数据是否进行解密；
处理单元1203根据所述SEC指示位确定需要对所述待读取数据进行解密处理后，根据XREAD指令从所述存储单元1202中读取数据，对所述读取数据进行解密，并将解密后的所述读取发送至处理器；
处理单元1203根据所述SEC指示位确定不需要对所述待读取数据进行解密处理后，根据所述数据读出指令从所述存储单元1202中读取数据，将所述读取发送至处理器。
接收单元1201接收所述计算机的处理器发送的数据读出SREAD指令，所述SREAD指令中包含有安全SEC指示位，所述SEC指示位用于指示对待读取数据是否进行解密；
处理单元1203根据所述SEC指示位确定需要对所述待读取数据进行解密处理后，根据XREAD指令从所述存储单元1202中读取数据，对所述读取数据进行解密，并将解密后的所述读取发送至处理器；
处理单元1203根据所述SEC指示位确定不需要对所述待读取数据进行解密处理后，根据所述SREAD指令从所述存储单元1202中读取数据，将所述读取发送至处理器。
本申请实施例中对单元的划分是示意性的，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，另外，在本申请各个实施例中的各功能单元可以集成在一个处理器中，也可以是单独物理存在，也可以两个或两个以上单元集成在一个模块中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能模块的形式实现。
所述集成的单元如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的全部或部分可以以软件产品的形式体现 出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台终端设备(可以是个人计算机，手机，或者网络设备等)或处理器执行本申请各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器、随机存取存储器、磁碟或者光盘等各种可以存储程序代码的介质。
基于以上实施例，本发明实施例还提供了一种计算机，所述计算机用于实现图6所述的实施例描述的方法，其中，具体实施方式可以参照图6所示的方法实施例，重复之处不再赘述，参阅如图13所示，所述设备包括处理器1301、NVDIMM1302和存储器1303。
本申请实施例中不限定上述处理器1301、NVDIMM1302和存储器1303之间的具体连接介质。本申请实施例在图13中以存储器1303、处理器1301以及NVDIMM1302之间通过总线1304连接，总线在图13中以粗线表示，其它部件之间的连接方式，仅是进行示意性说明，并不引以为限。所述总线可以分为地址总线、数据总线、控制总线等。为便于表示，图13中仅用一条粗线表示，但并不表示仅有一根总线或一种类型的总线。
存储器1303可以是易失性存储器，例如随机存取存储器；存储器1303也可以是非易失性存储器，例如只读存储器，快闪存储器，硬盘或固态硬盘、或者存储器1303是能够用于携带或存储具有指令或数据结构形式的期望的程序代码并能够由计算机存取的任何其他介质，但不限于此。存储器1303可以是上述存储器的组合。
处理器1301和NVDIMM1302用于实现如图6所示的图像处理的方法，其中：
处理器1301，用于在确定需要从NVDIMM1302中读取数据时，发送数据读取指令至NVDIMM1302，所述数据读出指令中包含有指示位，所述指示位用于指示对读取的数据是否进行解密；
NVDIMM1302，用于接收所述处理器1301发送的数据读出指令，在根据所述指示位确定需要对所述读取数据进行解密处理后，根据所述数据读出指令从所述NVDIMM1302中读取数据，对读取的所述数据进行解密，并将解密后的所述数据发送至处理器1301。
所述NVDIMM1302对读取的所述数据进行解密时，先获取解密密钥，其中，所述解密密钥由所述处理器1301生成并预先保存；之后再利用所述解密密钥对读出的所述数据进行解密处理。
基于与方法实施例的同一发明构思，本发明实施例提供一种存储装置1400，具体用于实现图7所述的实施例描述的方法，其中，具体实施方式可以参照图7所示的方法实施例，重复之处不再赘述，该装置的结构如图14所示，包括接收单元1401、存储单元1402和处理单元1403，其中：
接收单元1401，用于接收处理器发送的数据解密指令，所述数据解密指令用于指示对读取的数据进行解密；
存储单元1402，用于存储数据；
处理单元1403，用于接收所述接收单元1401发来的数据解密指令，根据所述数据解密指令在所述存储单元1402中读取数据；对读取的所述数据进行解密处理，并将解密后的所述数据发送至处理器。
较佳的，所述存储装置可以为NVDIMM，也可以为其他具有数据存储功能的存储装置。
当所述处理器需要读出数据、且需要对所述待读取数据进行解密时，所述处理器发送数据解密指令，所述数据解密指令用于指示对所述待读取数据进行解密后发送至处理器。 接收单元1401接收所述处理器发送的数据解密指令后，处理单元1403根据数据解密指令中的读取地址信息读取所述读取地址信息在存储单元1402中存储的数据，并对所述读取的数据进行解密，将解密后的所述数据发送至处理器。
当所述处理器需要读取数据、且不需要对所述待读取数据进行解密时，所述处理器可以发送现有的数据读出指令，可根据具体场景和NVDIMM接入处理接口选择相应的数据读出指令；接收单元1401接收到所述处理器发送的数据读出指令后，处理单元1403根据所述数据读出指令在存储单元1402中读出数据，并将所述读出的数据直接发送至处理器，而无需对读出的数据执行解密处理。
接收单元1401接收所述处理器发送的数据读出S-SREAD指令，所述S-SREAD指令用于指示对待读取数据进行解密；
处理单元1403根据S-SREAD指令从所述存储单元1402中读取数据，对所述读取数据进行解密，并将解密后的所述读取发送至处理器。
本申请实施例中对单元的划分是示意性的，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，另外，在本申请各个实施例中的各功能单元可以集成在一个处理器中，也可以是单独物理存在，也可以两个或两个以上单元集成在一个模块中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能模块的形式实现。
所述集成的单元如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的全部或部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台终端设备(可以是个人计算机，手机，或者网络设备等)或处理器执行本申请各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器、随机存取存储器、磁碟或者光盘等各种可以存储程序代码的介质。
基于以上实施例，本发明实施例还提供了一种计算机，所述计算机用于实现图7所述的实施例描述的方法，其中，具体实施方式可以参照图7所示的方法实施例，重复之处不再赘述，参阅如图15所示，所述设备包括处理器1501、NVDIMM1502和存储器1503。
本申请实施例中不限定上述处理器1501、NVDIMM1502和存储器1503之间的具体连接介质。本申请实施例在图15中以存储器1503、处理器1501以及NVDIMM1502之间通过总线1504连接，总线在图15中以粗线表示，其它部件之间的连接方式，仅是进行示意性说明，并不引以为限。所述总线可以分为地址总线、数据总线、控制总线等。为便于表示，图15中仅用一条粗线表示，但并不表示仅有一根总线或一种类型的总线。
存储器1503可以是易失性存储器，例如随机存取存储器；存储器1503也可以是非易失性存储器，例如只读存储器，快闪存储器，硬盘或固态硬盘(solid-state drive，SSD)、或者存储器1503是能够用于携带或存储具有指令或数据结构形式的期望的程序代码并能够由计算机存取的任何其他介质，但不限于此。存储器1503可以是上述存储器的组合。
处理器1501和NVDIMM1502用于实现如图7所示的图像处理的方法，其中：
处理器1501，用于在确定需要从NVDIMM1502中读取数据且读取的数据需要解密时，发送数据解密指令至NVDIMM1502，所述数据解密指令用于指示对读取的数据进行解密；
NVDIMM1502，用于接收所述处理器1501发送的数据解密指令；根据所述数据解密指令在所述NVDIMM1502中读取数据，对读取的所述数据进行解密处理，并将解密后的所述数据发送至处理器1501。
所述NVDIMM1502对读取的所述数据进行解密时，先获取解密密钥，其中，所述解密密钥由所述处理器1501生成并预先保存；之后再利用所述解密密钥对读出的所述数据进行解密处理。
本发明实施例还提供了一种计算机可读存储介质，存储有处理器为执行上述方法所需的计算机程序指令和数据，比如该存储介质可以为上述的存储器等类似的存储介质。
综上所述，本发明实施例中，NVDIMM通过确定接收到的数据写入/读出指令中的指示位确定是否需要加解密，NVDIMM在接收到的数据加/解出指令后，执行对应的加解密操作，使得处理器无需进行加解密的操作，而由NVDIMM自行进行加解密操作，减少了占用的处理器带宽，进而减少读写数据时处理器的时延，同时不需要对所有的写入或读出的数据进行加解密，不需进行额外的加解密操作，可以提供加解密操作的灵活性。
本领域内的技术人员应明白，本申请的实施例可提供为方法、系统、或计算机程序产品。因此，本申请可采用完全硬件实施例、完全软件实施例、或结合软件和硬件方面的实施例的形式。而且，本申请可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器、CD-ROM、光学存储器等)上实施的计算机程序产品的形式。
本申请是参照根据本申请的方法、设备(系统)、和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能。
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
显然，本领域的技术人员可以对本申请进行各种改动和变型而不脱离本申请的精神和范围。这样，倘若本申请的这些修改和变型属于本申请权利要求及其等同技术的范围之内，则本申请也意图包含这些改动和变型在内。

Claims (30)

  1. 一种计算机内存数据加密的方法，其特征在于，所述方法包括：
    非易失性双列直插内存模块NVDIMM接收处理器发送的数据写入指令和待写入数据，所述数据写入指令中包含有指示位，所述指示位用于指示对所述待写入数据是否进行加密；
    所述NVDIMM根据所述指示位确定需要对所述待写入数据进行加密处理后，对所述待写入数据进行加密，并将加密后的所述待写入数据写入所述NVDIMM中。
  2. 如权利要求1所述的方法，其特征在于，所述NVDIMM对所述待写入数据进行加密处理，包括：
    所述NVDIMM获取加密密钥，其中，所述加密密钥由所述处理器生成并预先保存；
    所述NVDIMM利用所述加密密钥对所述待写入数据进行加密处理。
  3. 一种计算机内存数据加密的方法，其特征在于，所述方法包括：
    非易失性双列直插内存模块NVDIMM接收处理器发送的数据加密指令和待写入数据，所述数据加密指令用于指示对所述待写入数据进行加密；
    所述NVDIMM根据所述数据加密指令，对所述待写入数据进行加密，并将加密后的所述待写入数据写入所述NVDIMM中。
  4. 如权利要求3所述的方法，其特征在于，所述NVDIMM对所述待写入数据进行加密处理，包括：
    所述NVDIMM获取加密密钥，其中，所述加密密钥由所述处理器生成并预先保存；
    所述NVDIMM利用所述加密密钥对所述待写入数据进行加密处理。
  5. 一种计算机内存数据解密的方法，其特征在于，所述方法包括：
    非易失性双列直插内存模块NVDIMM接收处理器发送的数据读出指令，所述数据读出指令中包含有指示位，所述指示位用于指示对读取的数据是否进行解密；
    所述NVDIMM根据所述指示位确定需要对所述读取数据进行解密处理后，根据所述数据读出指令从所述NVDIMM中读取数据，对读取的所述数据进行解密，并将解密后的所述数据发送至处理器。
  6. 如权利要求5所述的方法，其特征在于，所述NVDIMM对读出的所述数据进行解密处理，包括：
    所述NVDIMM获取解密密钥，其中，所述解密密钥由所述处理器生成并预先保存；
    所述NVDIMM利用所述解密密钥对读出的所述数据进行解密处理。
  7. 一种计算机内存数据解密的方法，其特征在于，所述方法包括：
    非易失性双列直插内存模块NVDIMM接收处理器发送的数据解密指令，所述数据解密指令用于指示对读取的数据进行解密；
    所述NVDIMM根据所述数据解密指令，在所述NVDIMM中读取数据，并对所述读取的所述数据进行解密处理，将解密后的所述数据发送至处理器。
  8. 如权利要求7所述的方法，其特征在于，所述NVDIMM对读出的所述数据进行解密处理，包括：
    所述NVDIMM获取解密密钥，其中，所述解密密钥由所述处理器生成并预先保存；
    所述NVDIMM利用所述解密密钥对读取的所述数据进行解密处理。
  9. 一种存储装置，其特征在于，所述存储装置包括：
    接收单元，用于接收处理器发送的数据写入指令和待写入数据，所述数据写入指令中包含有指示位，其中，所述指示位用于指示对所述待写入数据是否进行加密；
    存储单元，用于存储数据；
    处理单元，用于接收所述接收单元发来的所述数据写入指令和所述待写入数据，并根据所述数据写入指令中的所述指示位，确定需要对所述待写入数据进行加密处理后，对所述待写入数据进行加密，并将加密后的所述待写入所述存储单元中。
  10. 如权利要求9所述的存储装置，其特征在于，所述处理单元在对所述待写入数据进行加密时，具体用于：
    获取加密密钥，其中，所述加密密钥由所述处理器生成并预先保存；
    利用所述加密密钥对所述待写入数据进行加密处理。
  11. 如权利要求9或10所述的存储装置，其特征在于，所述存储装置为非易失性双列直插内存模块NVDIMM。
  12. 一种存储装置，其特征在于，所述存储装置包括：
    接收单元，用于接收处理器发送的数据加密指令和待写入数据，所述数据加密指令用于指示对所述待写入数据进行加密；
    存储单元，用于存储数据；
    处理单元，用于接收所述接收单元发来所述数据加密指令和待写入数据，对所述待写入数据进行加密，并根据所述数据加密指令将加密后的所述待写入数据写入所述存储单元中。
  13. 如权利要求12所述的存储装置，其特征在于，所述处理单元在对所述待写入数据进行加密时，具体用于：
    获取加密密钥，其中，所述加密密钥由所述处理器生成并预先保存；
    利用所述加密密钥对所述待写入数据进行加密处理。
  14. 如权利要求12或13所述的存储装置，其特征在于，所述存储装置为非易失性双列直插内存模块NVDIMM。
  15. 一种存储装置，其特征在于，所述存储装置包括：
    接收单元，用于接收处理器发送的数据读出指令，所述数据读出指令中包含有指示位，所述指示位用于指示对读取的数据是否进行解密；
    存储单元，用于存储数据；
    处理单元，用于接收所述接收单元发来的数据读出指令，在根据所述数据读出指令中的指示位确定需要对所述读取数据进行解密处理后，根据所述数据读出指令从所述存储单元中读取数据，对读取的所述数据进行解密处理，并将解密后的所述数据发送至处理器。
  16. 如权利要求15所述的存储装置，其特征在于，所述处理单元对读取的所述数据进行解密处理时，具体用于
    获取解密密钥，其中，所述解密密钥由所述处理器生成并预先保存；
    利用所述解密密钥对读出的所述数据进行解密处理。
  17. 如权利要求15或16所述的存储装置，其特征在于，所述存储装置为非易失性双列直插内存模块NVDIMM。
  18. 一种存储装置，其特征在于，所述存储装置包括：
    接收单元，用于接收处理器发送的数据解密指令，所述数据解密指令用于指示对读取的数据进行解密；
    存储单元，用于存储数据；
    处理单元，用于接收所述接收单元发来的数据解密指令，根据所述数据解密指令在所述存储单元中读取数据；对读取的所述数据进行解密处理，并将解密后的所述数据发送至处理器。
  19. 如权利要求18所述的存储装置，其特征在于，所述处理单元对读取的所述数据进行解密处理时，具体用于：
    获取解密密钥，其中，所述解密密钥由所述处理器生成并预先保存；
    利用所述解密密钥对读取的所述数据进行解密处理。
  20. 如权利要求18或19所述的存储装置，其特征在于，所述存储装置为非易失性双列直插内存模块NVDIMM。
  21. 一种计算机，其特征在于，所述计算机包括处理器和非易失性双列直插内存模块NVDIMM；
    处理器，用于在确定需要将待写入数据写入到NVDIMM时，发送数据写入指令和待写入数据至NVDIMM，所述数据写入指令中包含有指示位，所述指示位用于指示对所述待写入数据是否进行加密；
    NVDIMM，用于接收所述处理器发送的数据写入指令和待写入数据，在根据所述指示位确定需要对所述待写入数据进行加密处理后，对所述待写入数据进行加密，并将加密后的所述待写入数据写入所述NVDIMM中。
  22. 如权利要求21所述的计算机，其特征在于，所述NVDIMM在对所述待写入数据进行加密时，具体用于：
    获取加密密钥，其中，所述加密密钥由所述处理器生成并预先保存；
    利用所述加密密钥对所述待写入数据进行加密处理。
  23. 一种计算机，其特征在于，所述计算机包括处理器和非易失性双列直插内存模块NVDIMM；
    处理器，用于在确定需要将待写入数据写入到NVDIMM且需要对所述待写入数据进行加密时，发送数据加密指令和待写入数据至NVDIMM，所述数据加密指令用于指示对所述待写入数据进行加密；
    NVDIMM，用于接收所述处理器发送的数据加密指令和待写入数据；根据所述数据加密指令，对所述待写入数据进行加密，并将加密后的所述待写入数据写入所述NVDIMM中。
  24. 如权利要求23所述的计算机，其特征在于，所述NVDIMM对所述待写入数据进行加密处理时，具体用于：
    获取加密密钥，其中，所述加密密钥由所述处理器生成并预先保存；
    利用所述加密密钥对所述待写入数据进行加密处理。
  25. 一种计算机，其特征在于，所述计算机包括处理器和非易失性双列直插内存模块NVDIMM；
    处理器，用于在确定需要从NVDIMM中读取数据时，发送数据读取指令至NVDIMM，所述数据读出指令中包含有指示位，所述指示位用于指示对读取的数据是否进行解密；
    NVDIMM，用于接收所述处理器发送的数据读出指令，在根据所述指示位确定需要对所述读取数据进行解密处理后，根据所述数据读出指令从所述NVDIMM中读取数据，对读取的所述数据进行解密，并将解密后的所述数据发送至处理器。
  26. 如权利要求25所述的计算机，其特征在于，所述NVDIMM对读取的所述数据进行解密时，具体用于：
    获取解密密钥，其中，所述解密密钥由所述处理器生成并预先保存；
    利用所述解密密钥对读出的所述数据进行解密处理。
  27. 一种计算机，其特征在于，所述计算机包括处理器和非易失性双列直插内存模块NVDIMM；
    处理器，用于在确定需要从NVDIMM中读取数据且读取的数据需要解密时，发送数据解密指令至NVDIMM，所述数据解密指令用于指示对读取的数据进行解密；
    NVDIMM，用于接收所述处理器发送的数据解密指令；根据所述数据解密指令在所述NVDIMM中读取数据，对读取的所述数据进行解密处理，并将解密后的所述数据发送至处理器。
  28. 如权利要求27所述的计算机，其特征在于，所述NVDIMM对读取的所述数据进行解密时，具体用于：
    获取解密密钥，其中，所述解密密钥由所述处理器生成并预先保存；
    利用所述解密密钥对读出的所述数据进行解密处理。
  29. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质中存储有软件程序，所述软件程序在被一个或多个处理器读取并执行时可实现如权利要求1～8任一项所述的方法。
  30. 一种计算机芯片，其特征在于，所述芯片与存储器相连，所述芯片用于读取并执行所述存储器中存储的软件程序，以执行如权利要求1～8任一项所述的方法。
PCT/CN2017/100067 2017-08-31 2017-08-31 一种计算机内存数据加解密的方法及装置 WO2019041272A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
CN201780059409.2A CN109791589B (zh) 2017-08-31 2017-08-31 一种计算机内存数据加解密的方法及装置
PCT/CN2017/100067 WO2019041272A1 (zh) 2017-08-31 2017-08-31 一种计算机内存数据加解密的方法及装置

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2017/100067 WO2019041272A1 (zh) 2017-08-31 2017-08-31 一种计算机内存数据加解密的方法及装置

Publications (1)

Publication Number Publication Date
WO2019041272A1 true WO2019041272A1 (zh) 2019-03-07

Family

ID=65524668

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/100067 WO2019041272A1 (zh) 2017-08-31 2017-08-31 一种计算机内存数据加解密的方法及装置

Country Status (2)

Country Link
CN (1) CN109791589B (zh)
WO (1) WO2019041272A1 (zh)

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2019156887A1 (en) 2018-02-08 2019-08-15 Micron Technology, Inc. Key encryption handling
US20190342093A1 (en) * 2019-06-28 2019-11-07 Siddhartha Chhabra Converged cryptographic engine
CN114025347A (zh) * 2021-11-03 2022-02-08 苏州欧清电子有限公司 一种蓝牙设备的加密方法、装置、设备及存储介质
CN116095186A (zh) * 2023-04-11 2023-05-09 中勍科技股份有限公司 一种基于aes128的数据加解密方法

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103946824A (zh) * 2011-11-22 2014-07-23 英特尔公司 用于跨平台代理的非易失性随机访问存储器的访问控制
CN105528548A (zh) * 2015-12-09 2016-04-27 乐鑫信息科技（上海）有限公司 对芯片OutNvMem中代码批量加密并自动解密的方法
US20160246964A1 (en) * 2015-02-24 2016-08-25 Dell Products, Lp Method to Protect BIOS NVRAM from Malicious Code Injection by Encrypting NVRAM Variables and System Therefor
CN106919865A (zh) * 2017-03-02 2017-07-04 上海东软载波微电子有限公司 非易失性存储器数据加密系统

Family Cites Families (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US9887008B2 (en) * 2014-03-10 2018-02-06 Futurewei Technologies, Inc. DDR4-SSD dual-port DIMM device
US9753793B2 (en) * 2014-06-30 2017-09-05 Intel Corporation Techniques for handling errors in persistent memory
US9880754B2 (en) * 2014-07-09 2018-01-30 Dell Products, Lp System and method for enabling transportability of a non volatile dual inline memory module
US9886194B2 (en) * 2015-07-13 2018-02-06 Samsung Electronics Co., Ltd. NVDIMM adaptive access mode and smart partition mechanism
CN105373738B (zh) * 2015-10-16 2018-09-28 深圳国微技术有限公司 一种数据加/解密的处理方法和数据加/解密的处理装置
CN106254061B (zh) * 2016-08-14 2019-08-23 北京数盾信息科技有限公司 一种高速网络存贮加解密方法

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103946824A (zh) * 2011-11-22 2014-07-23 英特尔公司 用于跨平台代理的非易失性随机访问存储器的访问控制
US20160246964A1 (en) * 2015-02-24 2016-08-25 Dell Products, Lp Method to Protect BIOS NVRAM from Malicious Code Injection by Encrypting NVRAM Variables and System Therefor
CN105528548A (zh) * 2015-12-09 2016-04-27 乐鑫信息科技（上海）有限公司 对芯片OutNvMem中代码批量加密并自动解密的方法
CN106919865A (zh) * 2017-03-02 2017-07-04 上海东软载波微电子有限公司 非易失性存储器数据加密系统

Cited By (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2019156887A1 (en) 2018-02-08 2019-08-15 Micron Technology, Inc. Key encryption handling
EP3750099A4 (en) * 2018-02-08 2021-11-03 Micron Technology, Inc. KEY ENCRYPTION HANDLING
US20190342093A1 (en) * 2019-06-28 2019-11-07 Siddhartha Chhabra Converged cryptographic engine
CN114025347A (zh) * 2021-11-03 2022-02-08 苏州欧清电子有限公司 一种蓝牙设备的加密方法、装置、设备及存储介质
CN114025347B (zh) * 2021-11-03 2023-12-01 苏州欧清电子有限公司 一种蓝牙设备的加密方法、装置、设备及存储介质
CN116095186A (zh) * 2023-04-11 2023-05-09 中勍科技股份有限公司 一种基于aes128的数据加解密方法
CN116095186B (zh) * 2023-04-11 2023-06-20 中勍科技股份有限公司 一种基于aes128的数据加解密方法

Also Published As

Publication number Publication date
CN109791589B (zh) 2021-07-16
CN109791589A (zh) 2019-05-21

Similar Documents

Publication Publication Date Title
TWI545436B (zh) 用於安全記憶體管理之積體電路及方法
US8516271B2 (en) Securing non-volatile memory regions
WO2019041272A1 (zh) 一种计算机内存数据加解密的方法及装置
US11194920B2 (en) File system metadata protection
JP2020528608A5 (zh)
US20130205139A1 (en) Scrambling An Address And Encrypting Write Data For Storing In A Storage Device
JP2010231778A (ja) 不揮発性メモリに対してデータの読み出しおよび書き込みを行うためのデータホワイトニング
JP2015070608A (ja) 永続的メモリへのデータ格納
US20180095812A1 (en) Memory integrity violation analysis method and apparatus
US10929251B2 (en) Data loss prevention for integrated memory buffer of a self encrypting drive
US20210157745A1 (en) Secure data communication with memory sub-system
US11789874B2 (en) Method, apparatus, and system for storing memory encryption realm key IDs
CN112115076A (zh) 使用者数据的加解密装置及方法
US10983711B2 (en) Memory controller, method for performing access control to memory module
CN107861892B (zh) 一种实现数据处理的方法及终端
US20130198528A1 (en) Modifying a Length of an Element to Form an Encryption Key
CN111512308A (zh) 一种存储控制器、文件处理方法、装置及系统
US20210006391A1 (en) Data processing method, circuit, terminal device and storage medium
US9058295B2 (en) Encrypt data of storage device
US10496838B1 (en) Security protection for virtual machine backups
US20170322891A1 (en) Device and method for secure data storage
EP4075285A1 (en) Systems and methods for transforming data in-line with reads and writes to coherent host-managed device memory
CN113342278B (zh) 处理器及其保持缓存数据一致性的方法
US20240078322A1 (en) Memory system, memory controller and operation method thereof
US20230289071A1 (en) Electronic device and method of operating the same

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17923538

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 17923538

Country of ref document: EP

Kind code of ref document: A1