WO2023185764A1 - 内存访问方法及相关设备 - Google Patents

内存访问方法及相关设备 Download PDF

Info

Publication number
WO2023185764A1
WO2023185764A1 PCT/CN2023/084173 CN2023084173W WO2023185764A1 WO 2023185764 A1 WO2023185764 A1 WO 2023185764A1 CN 2023084173 W CN2023084173 W CN 2023084173W WO 2023185764 A1 WO2023185764 A1 WO 2023185764A1
Authority
WO
WIPO (PCT)
Prior art keywords
physical address
security check
check value
address space
access
Prior art date
Application number
PCT/CN2023/084173
Other languages
English (en)
French (fr)
Inventor
刘君龙
程传宁
郑子勇
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Priority claimed from CN202310303459.8A external-priority patent/CN116893979A/zh
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2023185764A1 publication Critical patent/WO2023185764A1/zh

Links

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F12/00—Accessing, addressing or allocating within memory systems or architectures
    • G06F12/02—Addressing or allocation; Relocation

Definitions

  • the present application relates to the field of storage technology, and in particular, to a memory access method and related equipment.
  • devices share virtual address spaces, and devices use virtual addresses to access each other's memory spaces.
  • devices can also directly use physical addresses (Physical Address, PA) to access each other's memory space; however, devices can directly use physical addresses to access each other's memory space. Accessing each other's memory space will bring security risks.
  • Physical Address PA
  • the embodiment of the present application discloses a memory access method and related equipment, which can avoid the security risks caused by using physical addresses to access memory space.
  • embodiments of the present application provide a memory access method, applied to a first device.
  • the method includes: receiving a first access request from a second device, where the first access request includes an identity number, a first A security check value and first information, where the first information includes a first physical address; a second security check value is calculated based on the identity number and the first information; and a second security check value is calculated based on the first security check value and The second security check value determines the access permission of the second device to the first physical address.
  • the first device includes a memory, and the physical address space of the memory includes a first physical address, and the first physical address corresponds to the first security check value; wherein the first security check value is also determined by the first device based on and The second security check value is calculated using the same method and is sent by the first device to the second device in advance. It should be noted that the first device and the second device are connected through an interconnection bus.
  • the first device or the second device may be one of the following: a host or a host-side CPU, a host-side accelerator, or a node device connected to the host or the host-side CPU through an IO interface; the node device may be: a GPU, a certain processor Unit (XPU), solid state drive (SSD), accelerator with specific computing functions, smart network card, network switch, etc.
  • the channel between the first device and the second device is secure.
  • the second device when the second device needs to access the first physical address in the first device, the second device will send a first access request to the first device.
  • the first access request carries an identity number, a first security The check value and the first information, the first information including the first physical address to be accessed; after receiving the first access request, the first device obtains the identity number, the first security check value and the first information from the first access request. first information, and then calculate a second security check value based on the identity number and the first information, and then determine whether the second device has access rights to the first physical address based on the first security check value and the second security check value. .
  • determining the access permission of the second device to the first physical address based on the first security check value and the second security check value can be understood as a verification process; in the case of passing the verification, the second device is allowed to access the first physical address. The device accesses the first physical address; if the verification fails, the second device is prevented from accessing the first physical address.
  • a verification process which can protect the security of the physical address space of the accessed end (such as the first device), including at least the following aspects: (1) protecting the physical address space.
  • Confidentiality that is, it can ensure that the physical address space of the accessed end cannot be read by the accessing end (such as a second device) without read permission; (2) Protect the correctness of the physical address space, that is, it can ensure that the physical address of the accessed end The space cannot be written by the access terminal without write permission; (3) Protect the robustness of the system, that is, it can ensure that the physical address space of the accessed terminal cannot be accessed by the access terminal without execution permission; (4) Protect the isolation of the system , that is, the physical address space of the accessed end cannot be accessed by an access end without access rights pretending to be an access end with access rights.
  • this application can implement "calculation on behalf of the inquiry", saving the accessed end from implementing complex data structures (such as page pages) due to security verification.
  • resources required for data structures such as tables such as tables
  • verification only requires (hardware-based) mathematical calculations, and there is no hardware action such as table lookup. Therefore, it can reduce the delay of security verification, achieve fast verification, and greatly improve Security verification efficiency.
  • the identity number is used to identify the first device.
  • the identity number is also used to identify the identity of the accessed end.
  • the identity number is the globally unique identity (ID) number (hereinafter referred to as the ID number) of the accessed destination resource (that is, corresponding to the first device). global identity ID).
  • ID number the globally unique identity
  • each device on the accessed end (including the first device) can store its own relevant context information.
  • the first device When the first device receives the access request, it can use the identity number as an input index to find the Context information corresponding to itself (such as the subsequent first key), and based on the context information, further determine the check value for verifying the access permission of the second device (i.e., the first security check value and the second security check value) .
  • the identity number is used to identify the second device.
  • the identity number is also used to identify the identity of the access end.
  • the identity number is a globally unique identity (ID) based on the access transaction issued by the IO device/accelerator (that is, corresponding to the second device). number (hereinafter referred to as global identity ID).
  • ID globally unique identity
  • the first device (accessed end) can store context information of multiple second devices (ie, accessing end).
  • the identity number can be used as input.
  • the first device can also determine which second device (access terminal) is currently initiating access based on the identity number, so as to perform targeted management and control.
  • the method before receiving the first access request from the second device, the method further includes: receiving a physical address application request from the second device, where the physical address application request includes The identity number; generate a first key for the identity number; send a first response of the physical address application request to the second device, where the first response includes the first security check value and the As for the first information, the first security check value is calculated based on the first key.
  • the second device needs to obtain the first security check value and the first information before accessing the first physical address.
  • the second device obtains the first security by sending a physical address application request to the first device.
  • the check value and the first information, the physical address application request carries an identity number used to identify the first device or the second device; after receiving the physical address application request, the first device obtains the identification number in the physical address application request.
  • the identity number of the first device or the second device and generates a first key for the identity number, and a first security check value calculated based on the first key, and then passes the first security check value and the first information through The first response is sent to the second device.
  • access permission of the second device to the first physical address through the first access request is granted by the first device to the second device, that is, the access permission is obtained through legal channels.
  • accessing the first physical address through the first access request is an expected access, ensuring the security of the physical address space of the first device. It should be understood that the key generated by the accessed end for the identity number of the accessing end or the accessed end is not disclosed to the outside world, that is, the accessing end cannot obtain the key generated for it, for example, the first device will not disclose the first secret to the outside world.
  • the first key cannot be obtained by the second device; and the security check value is calculated based on the key generated for the identity number of the accessing end or the accessed end.
  • the first security check value is calculated based on the identity number of the accessing end or the accessed end.
  • the first key generated by the identity number of one device is calculated, or the first security check value is calculated based on the first key generated by the identity number of the second device, and the password security for calculating the security check value is
  • the mathematical calculation algorithm is an algorithm proven to be sufficiently secure by the industry and theory; therefore, for any access end, it cannot be counterfeited or guessed to obtain the security check value (including the inability to counterfeit or guess to obtain the security value corresponding to the physical address space it wants to attack).
  • the second device cannot counterfeit or guess to obtain the first security check value.
  • the second device can only request the first device to obtain the first security check value; the second device cannot obtain the first security check value that is not open to the second device.
  • the security check value corresponding to other physical addresses accessed by the device, so the second device cannot access the other physical addresses, thus ensuring the security of the physical address space of the first device.
  • key_x fun1_RotKey (identity number, monotonically increasing parameter);
  • key_x represents the key, such as the first key
  • fun1 represents the derivation calculation function, such as standard key derivation functions such as Halting Key Derivation Functions (HKDF);
  • RotKey is the root key of the derivation calculation
  • the monotonically increasing parameter can be a counter value or system time.
  • calculating the second security check value based on the identity number and the first information includes: indexing a first key based on the identity number, and indexing a first key based on the first key and the first information.
  • the first information calculates the second security check value.
  • the security check value in this application is Message Authentication Code (MAC).
  • MAC Message Authentication Code
  • fun2 represents a digest calculation function, such as a standard digest calculation function such as Secure Hash Algorithm (SHA) 2; key_x is the key, and the key is required as an operator when calculating fun2; PA_x represents the physical address. It should be understood that if PA_x is the first physical address and key_x is the first key, then the MAC calculated by the above formula is the first security check value or the second security check value.
  • SHA Secure Hash Algorithm
  • the first information further includes a first permission value
  • the first permission value is used to represent the first access permission of the second device to the first physical address.
  • the first access right includes at least one of the following: read-only, write-only, both read and write, and neither read nor write.
  • the first permission value is represented by 3 bits.
  • RWX the first permission value
  • RWX means read operation
  • W means write operation
  • X execution operation
  • the first device can notify the second device of its first access permission to the first physical address through the first response, so that the second device can obtain its first access permission to the first physical address; further , when the second device accesses the first physical address, the first information carried in the first access request also includes the first permission value; because the greater the amount of information included in the first information, the less likely the first information is to be counterfeited , guess; and the first security check value and the second security check value are calculated based on the first information. The more information included in the first information, the more the first security check value and the second security check value are determined.
  • the first authority value may be the input parameter of the cryptographic security mathematical calculation algorithm; specifically, first based on the third A physical address is inferred to obtain the first authority value, and then it is used as an input parameter of the cryptographic security mathematical calculation algorithm; or various possible values of the first authority value are used as input parameters of the cryptographic security mathematical calculation algorithm, that is, for the first
  • Each possibility of the first access authority represented by the permission value calculates a first security check value or a second security check; since the first information includes the first permission value, when calculating the second security check value, There is no need to guess the first permission value, or there is no need to calculate a second security check value for the first access permission for verification with the first security check value; in this way, the delay of the security check can be reduced, which is beneficial to Realize fast verification and greatly improve the efficiency of security verification.
  • the security check value in this application is MAC
  • fun2 represents the digest calculation function; key_x is the key; PA_x represents the physical address; pert_x represents the permission value A corresponding to the physical address.
  • the permission value A corresponding to the physical address is used to represent the first access permission of the access end to the physical address. It should be understood that if PA_x is the first physical address, pert_x is the first permission value, and key_x is the first key, then the MAC calculated by the above formula is the first security check value or the second security check value.
  • the first information also includes the granularity of the physical address space.
  • the granularity of the physical address space is used to characterize the range size of the physical address space.
  • the physical address space includes the First physical address.
  • the physical address space includes a first physical address space segment, and the first physical address space segment includes the first physical address.
  • the granularity of the physical address space is used to characterize the range of the physical address space; that is, the total number of bits in the physical address space, minus the granularity, is how many bits higher, and the granularity refers to how many bits lower, how many lower. Bits are used to represent physical address space ranges.
  • the physical address interval range is 2 ⁇ n; further, the physical address space range starts from the aligned address, that is, the physical address space range represents the low n bits from all 0 to 2 ⁇ n , a physical address range in which the high bits of the physical address remain unchanged.
  • the physical address is represented by 48 bits and the granularity is 8
  • the physical address range is 256
  • the corresponding physical address space range is that the high 40 bits remain unchanged and the low 8 bits range from all 0 to 256.
  • Address range that is, only the lower 8 bits of the 48-bit physical address space are used, that is, the address space is 0000000 to 11111111, and the first 40 bits are not used.
  • calculating the second security check value based on the identity number and the first information includes: indexing the first key according to the identity number; if the first information includes the first authority value, then determine the high bits of the first physical address based on the first physical address and the granularity of the physical address space; if the first information does not include the first permission value, determine the high bits of the first physical address based on the first physical address and the granularity of the physical address space.
  • the granularity of the physical address space determines the high bits of the first physical address and the first permission value; according to the granularity of the physical address space, the high bits of the first physical address, and the first permission value and the first key to obtain the second security check value.
  • the security check value in this application is MAC
  • fun2 represents the digest calculation function
  • key_x is the key
  • range_x represents the granularity of the physical address space
  • pa_align represents the high bit of the physical address aligned based on the granularity of the physical address space
  • pert_x represents the permission value A corresponding to the physical address space segment.
  • the permission value A corresponding to the physical address space segment is used to indicate the first access permission of the access end to the physical address space segment. It should be noted that if a physical address space segment corresponds to a permission value A, then any physical address in the physical address space segment also corresponds to the permission value A.
  • range_x is the granularity of the physical address space in the first information
  • pa_align is the high bit of the first physical address aligned based on the granularity of the physical address space
  • pert_x is the first permission value
  • key_x is the first key
  • the first device includes a memory, and the physical address space of the memory includes N physical address space segments, where N is a positive integer; for example, the first device allows the second device to access the physical address space according to a certain ( programmable) granularity is divided into N physical address space segments; after receiving the physical address application request from the second device, the first device can calculate a security address for each of the N physical address space segments. Check values to obtain N security check values, the N security check values correspond to N physical address space segments, and the N security check values are calculated based on the first key; the first device sends the The first response sent by the second device includes the granularity of the physical address space, N physical address space segments, and N security check values.
  • the security check value corresponding to the first physical address space segment is the first security check value, that is, the N security check values include the first security check value; in this case, the first information includes the first response The granularity of the physical address space in and the first physical address in the first physical address space segment.
  • the first information carried in the first access request also includes the granularity of the physical address space; because the greater the amount of information included in the first information, the less likely it is that the first information is Counterfeiting and guessing; and the first security check value and the second security check value are calculated based on the first information.
  • the more information included in the first information the more the first security check value and the second security check value are determined.
  • the more factors there are in the check value the less likely the first security check value is to be counterfeited and guessed, and the more stringent the possibility of successful verification of the first security check value and the second security check value; in this way, It is beneficial to ensure the security of the physical address space of the first device.
  • the security check value carried in the corresponding access request is also the first security check value; thus, for any physical address Space segment, for which a security check value is calculated so that all physical addresses in the physical address space segment correspond to the same security check value.
  • the access end accesses each physical address in the physical address segment, it carries The same security check value does not need to carry different security check values for each physical address in the physical address space segment, thereby reducing overhead.
  • the first permission value is also used to represent the first access permission of the second device to the first physical address space segment.
  • the first device includes a memory, and the physical address space of the memory includes N physical address space segments, and N is a positive integer; after receiving the physical address application request from the second device, the first device can apply for N physical addresses Each physical address space segment in the space segment determines a permission value A to obtain N permission values A.
  • the N permission values A correspond to the N physical address space segments. Any one of the N permission values A is A.
  • the first response sent by the first device to the second device includes the granularity of the physical address space, N physical addresses Space segment, N security check values and N authority values A. Since the first physical address space segment is one of the N physical address space segments, and the first physical address is one of the physical addresses in the first physical address space segment, the N permission values A and The permission value A corresponding to the first physical address space segment is the first permission value, that is, the N permission values A include the first permission value; in this implementation, the first information includes the physical address space in the first response. Granularity, the first physical address in the first physical address space segment and the first permission value among the N permission values A.
  • the permission value A carried in the corresponding access request is also the first permission value; thus, for any physical address space segment, Determine a permission value A for it, so that all physical addresses in the physical address space segment correspond to the same permission value A, and the access end carries the same permission value A when accessing each physical address in the physical address segment. , instead of carrying a different permission value A for each physical address in the physical address space segment, thereby reducing overhead.
  • the first information carried in the first access request when the second device accesses the first physical address, also includes the first permission value; because the greater the amount of information included in the first information, the more the first information The less likely it is to be counterfeited and guessed; and the first security check value and the second security check value are calculated based on the first information. The greater the amount of information included in the first information, the first security check value is determined. The more factors there are with the second security check value, the less likely the first security check value is to be counterfeited and guessed, and the more likely it is that the first security check value and the second security check value can be successfully verified. strict; in this way, it is helpful to ensure the security of the physical address space of the first device.
  • the first authority value may be the input parameter of the cryptographic security mathematical calculation algorithm; specifically, first based on the third The first permission value is obtained by inferring the granularity of a physical address and the physical address space, and then using it as an input parameter for a cryptographic security mathematical calculation algorithm; or using various possible values of the first permission value as an input for a cryptographic security mathematical calculation algorithm. Parameters, that is, a first security check value or a second security check is calculated for each possibility of the first access authority represented by the first authority value; since the first information includes the first authority value, the first security check value is calculated when calculating the first access authority value.
  • the security check value can be reduced.
  • the delay of verification is conducive to rapid verification and greatly improves the efficiency of security verification.
  • determining the access permission of the second device to the first physical address based on the first security check value and the second security check value includes: The first security check value and the second security check value are verified; if the first security check value and the second security check value are verified successfully, it is determined that the second device is The access permission of the first physical address is allowed access.
  • the access rights include at least one of the following: only reading is allowed, only writing is allowed, and both reading and writing are allowed.
  • the second device can be allowed to access the first physical address, that is, the second device can access the first physical address. Access permission is Allowed.
  • the successful verification of the first security check value and the second security check value may mean that the first security check value and the second security check value are the same.
  • the first security check value and the second security check value are In the case of Message Authentication Code (MAC); but it is not limited to this, depending on the specific password security mathematical calculation algorithm.
  • MAC Message Authentication Code
  • the first security check value and the second security check value are calculated based on the first key; the method further includes: generating a second security check value for the identity number. Key; sending an invalidation command to the second device, the invalidation command being used to invalidate the first physical address or first physical address space segment; after receiving a response to the invalidation command from the second device , or after the invalid command times out, the second key is used to replace the first key.
  • the second key can be regenerated for the identity number used to identify the first device or the second device, using the regenerated third key.
  • the second key replaces the original first key for security verification.
  • the security check value carried in the access request is still the first security check value, and the first security check value is based on the first key.
  • the first device calculates the security check value based on the second key, so the security check value calculated by the first device and the first security check value carried in the access request will be If the verification is unsuccessful, the second device is prevented from accessing the first physical address or the first physical address space segment, that is, the second device does not have access rights to the first physical address or the first physical address space segment. In this way, if the accessed end needs to change the access rights of the accessing end to a certain physical address or physical address space segment, the accessed end can regenerate a new key based on the identity number of the accessing end or the accessed end to replace the old key.
  • the access end can flexibly manage the physical address space, including dynamically allocating physical address space segments and dynamically modifying the access rights of the allocated physical address space segments, Dynamically recycle the allocated physical address space segment; and when the identity number is used to identify the second device, that is, the access end, the access end can manage the physical address space down to the identity number of each second device to ensure different The ID numbers do not affect each other.
  • the method further includes: receiving a response from the invalid command.
  • the security check value acquisition request includes the identity number, a third security check value and second information.
  • the third security check value is based on the first security check value.
  • the second information includes a second physical address; a fourth security check value is calculated based on the identity number, the second information and the first key; and the third security check value is calculated according to the key.
  • the verification value is verified with the fourth security verification value; if the verification of the third security verification value and the fourth security verification value is successful, the security verification value is sent to the second device.
  • a second response to the verification value acquisition request including a fifth security verification value, the fifth security verification value being calculated based on the second key.
  • the first device includes a memory
  • the physical address space of the memory includes a second physical address.
  • the second physical address is different from the first physical address, that is, the second physical address is not to be invalidated; wherein, the second physical address is not to be invalidated.
  • the address corresponds to the third security check value, and the third security check value is also calculated by the first device based on the same method as calculating the fourth security check value, and is sent by the first device to the second device in advance.
  • the first device regenerates the second key for the identity number of the first device or the second device to replace the first key. key; for the second physical address that has not been invalidated, its corresponding third security check value is calculated based on the first key.
  • the second device It is necessary to obtain the fifth security check value calculated based on the second key corresponding to the second physical address.
  • the fifth security check value can be used to replace the third security check value; therefore, the second device sends the In the security check value acquisition request, the first device sends the fifth security check value to the second device through the second response, thereby ensuring that the second device still has access rights to the second physical address.
  • the accessing end when the accessing end re-obtains the security check value from the accessed end, it also needs to perform security verification, thereby further protecting the security of the accessed end's physical address space. It should be understood that for the first physical address or the first physical address space segment to be invalidated, even if the second device requests to re-obtain the new security calculated based on the second key for the first physical address or the first physical address space segment.
  • the first device will not send a new security check value; so for the physical address or physical address space segment to be invalidated, no new security check value will be given to the accessing end, and the access segment cannot be guessed To the new security check value, the accessing end must not pass the verification of the accessed end, that is, it no longer has access rights to the invalid physical address or physical address space segment, thereby protecting the security of the accessed end's physical address space.
  • the second information further includes a second permission value, and the second permission value is used to represent the first access permission of the second device to the second physical address.
  • the second information also includes the granularity of the physical address space.
  • the granularity of the physical address space is used to characterize the range size of the physical address space.
  • the physical address space includes the Second physical address.
  • the physical address space includes a second physical address space segment, and the second physical address space segment includes the second physical address.
  • the second permission value is also used to represent the first access permission of the second device to the second physical address space segment.
  • the method further includes: receiving a response from the invalid command.
  • a second access request of the second device the second access request includes the identity number, a sixth security check value and third information, the third information includes a third physical address; according to the identity number, the The third information and the first key are calculated to obtain a seventh security check value, and the eighth security check value is calculated according to the identity number, the third information and the second key;
  • the sixth security check value is verified with the seventh security check value and the eighth security check value respectively; if the sixth security check value is verified with the seventh security check value, If successful, or the sixth security check value and the eighth security check value are successfully verified, it is determined that the access permission of the second device to the third physical address is allowed access.
  • the first device includes a memory
  • the physical address space of the memory includes a third physical address.
  • the third physical address is different from the first physical address, that is, the third physical address is not to be invalidated; wherein, the third physical address is not to be invalidated;
  • the address corresponds to the sixth security check value, and the sixth security check value is also calculated by the first device based on the same method as calculating the seventh security check value or the eighth security check value, and is advanced by the first device sent to the second device.
  • the security check value carried in the access request received by the first device may be calculated based on the old key, or may be It is calculated based on the new key; for example, the sixth security check value may be calculated based on the first key or the second key.
  • the first device has regenerated the second key for the second device before sending the invalid command, after the first device sends the invalid command and before receiving the response to the invalid command, or Before the invalid command times out, the first key and the second key coexist briefly; therefore, within this time period, if the first device receives the second access request from the second device, as long as the sixth security check value is the same as If any one of the seventh security check value and the eighth security check value is successfully verified, the second device is allowed to access the third physical address, thereby ensuring that the invalid first physical address or first physical address space segment During the process, the second device can normally access the third physical address that has not been invalidated.
  • this application utilizes the mechanism of temporary coexistence of the old key and the new key within a certain period of time; among which, the old key is only used to calculate the calibration.
  • the security check value used for verification is no longer used to calculate the new security check value that needs to be sent to the access terminal; the new key can be used to calculate both the security check value for verification and the need to calculate the security check value.
  • the third information further includes a third permission value, and the third permission value is used to represent the first access permission of the second device to the third physical address.
  • the third information also includes the granularity of the physical address space.
  • the granularity of the physical address space is used to characterize the range size of the physical address space.
  • the physical address space includes the Third physical address.
  • the physical address space includes a third physical address space segment, and the third physical address space segment includes the third physical address.
  • the third permission value is also used to represent the first access permission of the second device to the third physical address space segment.
  • the first device includes a region table, the region table includes a first index number and a fourth authority value, the first index number and the fourth authority value
  • the fourth permission value is used to represent the second access permission of the first physical address or the first physical address space segment; the first information also includes the first index number.
  • the identity number is used to identify the second device
  • the accessed end can establish an area table for each accessing end to store the physical address space access rights based on the identity number of the accessing end, or it can also be based on the identity number of the accessing end.
  • the accessed terminal can establish an area table that stores physical address space access permissions based on the identity number of the accessed terminal. .
  • each entry in the area table only requires a few bits to store the physical address or the access permission of the physical address space segment.
  • the area table can be a continuous lightweight table with a controllable span; and, if the area The entries in the table are used to store the access rights of the physical address space segment, so each entry in the area table can be continuously allocated and used, and is not bound to a specific physical address. This will not cause the entry in the area table that you may want to use but cannot be used due to physical issues.
  • the first device includes a memory, and the physical address space of the memory includes N physical address space segments, and N is a positive integer; after receiving the physical address application request from the second device, the first device can apply for N physical addresses
  • Each physical address space segment in the space segment creates an entry in the area table, so that the area table includes N entries, and the N entries correspond to N physical address space segments; and, in each of the N entries, Used to store the access rights of the corresponding physical address space segment.
  • Each entry includes an area number, an index number and a permission value B. The area number is used to represent the physical address space segment corresponding to the entry, and the index number is used to index the entry.
  • the index number corresponding to the first physical address space segment among the N index numbers is the first index number, and the first information may include the first index number.
  • the second device accesses other physical addresses in the first physical address space segment, the index number carried in the corresponding access request is also the first index number; in this way, for any physical address space segment, its corresponding index number in the area table An index number, so all physical addresses in the physical address space segment correspond to the same index number.
  • the access end accesses each physical address in the physical address segment, it carries the same index number, rather than targeting the physical address.
  • Each physical address in an address space segment carries a different index number, which reduces overhead.
  • the second access right includes at least one of the following: read-only, write-only, both read and write, and neither read nor write.
  • the first device includes an area table, and the first information also includes a first index number. Based on the first index number, a fourth authority value can be indexed in the area table.
  • the fourth authority value is used to represent the first physical address or the second access right of the first physical address space segment, the first physical address space segment includes the first physical address, the first device can send the first index number to the second device through the first response; the second device is accessing
  • the first physical address is the first physical address
  • the first information carried in the first access request also includes the first index number; since the greater the amount of information included in the first information, the first information is less likely to be counterfeited and guessed; and the first The security check value and the second security check value are calculated based on the first information.
  • the more information included in the first information the more factors determine the first security check value and the second security check value. , the less likely the first security check value is to be counterfeited and guessed, the more stringent the possibility of successful verification of the first security check value and the second security check value; in this way, it is conducive to ensuring the safety of the first device Physical address space security.
  • calculating the second security check value based on the identity number and the first information includes: indexing the first key according to the identity number; if the first information includes the first authority value, then determine the high bits of the first physical address based on the first physical address and the granularity of the physical address space; if the first information does not include the first permission value, determine the high bits of the first physical address based on the first physical address and the granularity of the physical address space.
  • the granularity of the physical address space determines the high bits of the first physical address and the first permission value; according to the granularity of the physical address space, the high bits of the first physical address, and the first permission value , the first index number and the first key are calculated to obtain the second security check value.
  • the security check value in this application is MAC
  • fun2 represents the digest calculation function
  • key_x is the key
  • range_x represents the granularity of the physical address space
  • pa_align represents the high bit of the physical address aligned based on the granularity of the physical address space
  • pert_x represents the permission value A corresponding to the physical address space segment.
  • the permission value A corresponding to the physical address space segment is used to indicate the first access permission of the access end to the physical address space segment
  • range index indicates the index number of the area table.
  • range_x is the granularity of the physical address space in the first information
  • pa_align is the high bit of the first physical address aligned based on the granularity of the physical address space
  • pert_x is the first permission value
  • range index is the first index number.
  • key_x is the first key
  • the MAC calculated by the above formula is the first security check value or the second security check value.
  • determining the access permission of the second device to the first physical address based on the first security check value and the second security check value includes: The first security check value and the second security check value are verified; if the first security check value and the second security check value are verified successfully, and the fourth authorization value If the indicated second access right is allowed access, then it is determined that the access right of the second device to the first physical address is allowed access. It should be understood that when the area table exists, after the security check value verification is successful, the area table is also checked; if the second access permission represented by the fourth permission value obtained by looking up the area table is allowed access, access is allowed.
  • the fourth permission index is indexed in the area table.
  • the second device can be allowed to access the first physical address only when the second access permission represented by the value is allowed access, that is, the access permission of the second device to the first physical address is allowed access.
  • the access request issued by the accessing end also needs to carry the index number of the area table; and based on the index number of the area table carried by the access request, the accessed end indexes this access in the local area table Request the entry of the physical address or physical address space segment to be accessed to obtain the corresponding permission value; for this access request, only the security check value verification is successful and the second access permission represented by the permission value indexed in the area table Only when access is allowed can the access request be allowed to continue; otherwise, the access request will be blocked from continuing to access.
  • the method further includes: modifying the fourth permission value in the area table to a fifth permission value.
  • the first device when it is necessary to change the access rights of the second device to the first physical address or the first physical address space segment, for example, when it is necessary to make the second device have no access rights to the first physical address or the first physical address space segment.
  • accessing permissions that is, when the first physical address or the first physical address space segment is invalid, the first device only needs to modify the fourth permission value in the area table to the fifth permission value.
  • the fifth permission value uses Indicates that the second access permission of the first physical address or the first physical address space segment is not allowed to access; later, when the second device accesses the first physical address or the first physical address space segment again, the first device based on the access request
  • the first index number carried indexes the fifth permission value in the area table, and the second access permission represented by the fifth permission is not allowed to access, thus preventing the second device from accessing the first physical address or the first physical address.
  • the space segment is used to change the access permission of the second device to the first physical address or the first physical address space segment.
  • the accessed end does not need to Regenerate the key based on the identity number of the client or the accessed client, and directly modify the permission value of the corresponding entry in the area table. For example, you can directly modify the permission value of the corresponding entry to the expected value, while maintaining the identity number of the accessing client or the visited client.
  • the key remains unchanged, which can reduce the frequency and additional overhead of updating the key because the accessed end needs to change the physical address or the access rights of the physical address space segment, and improve the efficiency of physical address space recycling (such as increasing invalid physical addresses or physical address space segment efficiency).
  • embodiments of the present application provide a memory access method, applied to a second device.
  • the method includes: sending a first access request to the first device, where the first access request includes an identity number, a first security The check value and the first information, the first information including the first physical address; the identity number and the first information are used to calculate the second security check value; the first security check value and the The second security check value is used to determine the access permission of the second device to the first physical address.
  • the identity number is used to identify the first device, or the identity number is used to identify the second device.
  • the method before sending the first access request to the first device, the method further includes: sending a physical address application request to the first device, where the physical address application request includes the Identity number; receiving the first response of the physical address application request from the first device, the first response including the first security check value and the first information, the first security check The value is calculated based on the first key generated for the identity number.
  • the first information further includes a first permission value, and the first permission value is used to represent the first access permission of the second device to the first physical address.
  • the first information also includes the granularity of the physical address space.
  • the granularity of the physical address space is used to characterize the range size of the physical address space.
  • the physical address space includes the First physical address.
  • the physical address space includes a first physical address space segment, and the first physical address space segment includes the first physical address.
  • the first permission value is also used to represent the first access permission of the second device to the first physical address space segment.
  • the method further includes: receiving an invalidation command from the first device, the invalidation command being used to invalidate the first physical address or the first physical address space segment; and sending the invalidation command to the first device.
  • the first device sends a response to the invalid command.
  • the method further includes: sending a security check value acquisition request to the first device.
  • the check value acquisition request includes the identity number, a third security check value and second information.
  • the third security check value is calculated based on the first key.
  • the second information includes a second physical address. ; Receive a second response to the security check value acquisition request from the first device, the second response including a fifth security check value, the fifth security check value is calculated based on the second key Obtained, the second key is generated for the identity number.
  • the identity number, the second information and the first key are used to calculate a fourth security check value; the third security check value and the fourth security check value are used to calculate Verification; In addition, the verification results of the third security check value and the fourth security check value can be used to determine the information content carried by the second response.
  • the second information further includes a second permission value, and the second permission value is used to represent the first access permission of the second device to the second physical address.
  • the second information also includes the granularity of the physical address space.
  • the granularity of the physical address space is used to characterize the range size of the physical address space.
  • the physical address space includes the Second physical address.
  • the physical address space includes a second physical address space segment, and the second physical address space segment includes the second physical address.
  • the second permission value is also used to represent the first access permission of the second device to the second physical address space segment.
  • the method further includes: sending a second access request to the first device.
  • the request includes the identity number, a sixth security check value and third information, where the third information includes a third physical address.
  • the identity number and the third information are used to calculate the seventh security check value and the eighth security check value; the sixth security check value, the seventh security check value and the The eighth security check value is used to determine the access permission of the second device to the third physical address.
  • the third information further includes a third permission value, and the third permission value is used to represent the first access permission of the second device to the third physical address.
  • the third information also includes the granularity of the physical address space.
  • the granularity of the physical address space is used to characterize the range size of the physical address space.
  • the physical address space includes the Third physical address.
  • the physical address space includes a third physical address space segment, and the third physical address space segment includes the third physical address.
  • the third permission value is also used to represent the first access permission of the second device to the third physical address space segment.
  • the first device includes an area table, the area table includes a first index number and a fourth authority value, the first index number corresponds to the fourth authority value, and the The fourth permission value is used to represent the second access permission of the first physical address or the first physical address space segment; the first information also includes the first index number.
  • inventions of the present application provide a memory access device, which is applied to a first device.
  • the device includes: a communication unit configured to receive a first access request from a second device, where the first access request includes: An identity number, a first security check value and first information, the first information including a first physical address; a processing unit configured to calculate a second security check value based on the identity number and the first information; and according to The first security check value and the second security check value determine the access permission of the second device to the first physical address.
  • the identity number is used to identify the first device, or the identity number is used to identify the second device.
  • the communication unit before receiving the first access request from the second device, the communication unit is further configured to: receive a physical address application request from the second device, and the physical address application The request includes the identity number; the processing unit is further configured to: generate a first key for the identity number; the communication unit is further configured to: send the first key of the physical address application request to the second device. Response, the first response includes the first security check value and the first information, where the first security check value is calculated based on the first key.
  • the processing unit is specifically configured to: index a first key according to the identity number, and calculate the second security check value according to the first key and the first information.
  • the first information further includes a first permission value, and the first permission value is used to represent the first access permission of the second device to the first physical address.
  • the first information also includes the granularity of the physical address space.
  • the granularity of the physical address space is used to characterize the range size of the physical address space.
  • the physical address space includes the First physical address.
  • the physical address space includes a first physical address space segment, and the first physical address space segment includes the first physical address.
  • the first permission value is also used to represent the first access permission of the second device to the first physical address space segment.
  • the processing unit is specifically configured to: index the first key according to the identity number; if the first information includes a first permission value, index the first key according to the first physical address and the physical address space.
  • the granularity of the high bits of the first physical address is determined; if the first information does not include the first permission value, the granularity of the first physical address and the physical address space is determined.
  • the high bits and the first permission value; the second security check is calculated based on the granularity of the physical address space, the high bits of the first physical address, the first permission value and the first key. value.
  • the processing unit is specifically configured to: verify the first security check value and the second security check value; if the first security check value is consistent with the If the second security check value is verified successfully, it is determined that the access permission of the second device to the first physical address is allowed access.
  • the first security check value and the second security check value are calculated based on the first key; the processing unit is also configured to: generate the second key; the communication unit is also used to: send an invalid command to the second device, the invalid command is used to invalidate the first physical address or the first physical address space segment; the processing unit is also used to: In: after receiving a response to the invalid command from the second device, or after the invalid command times out, using the second key to replace the first key.
  • the communication unit is further configured to: receive from The security check value acquisition request of the second device includes the identity number, a third security check value and second information, and the third security check value is based on the The first key is calculated, and the second information includes a second physical address; the processing unit is also configured to: calculate a fourth security key based on the identity number, the second information, and the first key.
  • the communication unit is also used to: if the third security check value and the fourth security check value If the check value verification is successful, a second response of the security check value acquisition request is sent to the second device, where the second response includes a fifth security check value, and the fifth security check value is Calculated based on the second key.
  • the second information further includes a second permission value, and the second permission value is used to represent the first access permission of the second device to the second physical address.
  • the second information also includes the granularity of the physical address space.
  • the granularity of the physical address space is used to characterize the range size of the physical address space.
  • the third physical address space is 2. Physical address.
  • the physical address space includes a second physical address space segment, and the second physical address space segment includes the second physical address.
  • the second permission value is also used to represent the first access permission of the second device to the second physical address space segment.
  • the communication unit is further configured to: receive from A second access request of the second device, the second access request includes the identity number, a sixth security check value and third information, the third information includes a third physical address; the processing unit also Used to: calculate a seventh security check value based on the identity number, the third information and the first key, and calculate a seventh security check value based on the identity number, the third information and the second key Obtain an eighth security check value; and verify the sixth security check value with the seventh security check value and the eighth security check value respectively; and if the sixth security check value If the verification of the value and the seventh security check value is successful, or the verification of the sixth security check value and the eighth security check value is successful, then it is determined that the second device has the third physical address The access permission is Allowed.
  • the third information further includes a third permission value, and the third permission value is used to represent the first access permission of the second device to the third physical address.
  • the third information also includes the granularity of the physical address space.
  • the granularity of the physical address space is used to characterize the range size of the physical address space.
  • the physical address space includes the Third physical address.
  • the physical address space includes a third physical address space segment, and the third physical address space segment includes the third physical address.
  • the third permission value is also used to represent the first access permission of the second device to the third physical address space segment.
  • the first device includes an area table, the area table includes a first index number and a fourth authority value, the first index number corresponds to the fourth authority value, and the The fourth permission value is used to represent the second access permission of the first physical address or the first physical address space segment; the first information also includes the first index number.
  • the processing unit is specifically configured to: index the first key according to the identity number; if the first information includes a first permission value, index the first key according to the first physical address and the physical address space.
  • the granularity of the high bits of the first physical address is determined; if the first information does not include the first permission value, the granularity of the first physical address and the physical address space is determined.
  • the high bits and the first permission value calculated based on the granularity of the physical address space, the high bits of the first physical address, the first permission value, the first index number and the first key The second security check value.
  • the processing unit is specifically configured to: verify the first security check value and the second security check value; if the first security check value is consistent with the If the second security check value is verified successfully, and the second access permission represented by the fourth permission value is allowed access, it is determined that the access permission of the second device to the first physical address is allowed access.
  • the processing unit is further configured to modify the fourth permission value in the area table to a fifth permission value.
  • inventions of the present application provide a memory access device applied to a second device.
  • the device includes: a communication unit configured to send a first access request to the first device, where the first access request includes an identity. number, a first security check value and first information, the first information includes a first physical address; the identity number and the first information are used to calculate a second security check value; the first security check value and the second security check value are used to determine the access permission of the second device to the first physical address.
  • the identity number is used to identify the first device, or the identity number is used to identify the second device.
  • the communication unit before sending the first access request to the first device, is further configured to: send a physical address application request to the first device, where the physical address application request includes the identity number; and receiving a first response to the physical address application request from the first device, the first response including the first security check value and the first information, the first The security check value is calculated based on the first key generated for the identity number.
  • the first information further includes a first permission value, and the first permission value is used to represent the first access permission of the second device to the first physical address.
  • the first information also includes the granularity of the physical address space.
  • the granularity of the physical address space is used to characterize the range size of the physical address space.
  • the physical address space includes the First physical address.
  • the physical address space includes a first physical address space segment, and the first physical address space segment includes the first physical address.
  • the first permission value is also used to represent the first access permission of the second device to the first physical address space segment.
  • the communication unit is further configured to: receive an invalidation command from the first device, the invalidation command being used to invalidate the first physical address or the first physical address space segment; and A response to the invalid command is sent to the first device.
  • the communication unit after receiving the invalid command and before sending a response to the invalid command, is further configured to: send a security check value acquisition request to the first device, so The security check value acquisition request includes the identity number, a third security check value and second information, the third security check value is calculated based on the first key, and the second information includes a second a physical address; and receiving a second response to the security check value acquisition request from the first device, the second response including a fifth security check value, the fifth security check value being based on the second
  • the second key is calculated for the identity number.
  • the second permission value is also used to represent the first access permission of the second device to the second physical address.
  • the second information also includes the granularity of the physical address space.
  • the granularity of the physical address space is used to characterize the range size of the physical address space.
  • the physical address space includes the Second physical address.
  • the physical address space includes a second physical address space segment, and the second physical address space segment includes the second physical address.
  • the second permission value is also used to represent the first access permission of the second device to the second physical address space segment.
  • the communication unit after receiving the invalid command and before sending a response to the invalid command, is further configured to: send a second access request to the first device.
  • the second access request includes the identity number, the sixth security check value and third information, and the third information includes a third physical address.
  • the third information further includes a third permission value, and the third permission value is used to represent the first access permission of the second device to the third physical address.
  • the third information also includes the granularity of the physical address space.
  • the granularity of the physical address space is used to characterize the range size of the physical address space.
  • the physical address space includes the Third physical address.
  • the physical address space includes a third physical address space segment, and the third physical address space segment includes the third physical address.
  • the third permission value is also used to represent the first access permission of the second device to the third physical address space segment.
  • the first device includes an area table, the area table includes a first index number and a fourth authority value, the first index number corresponds to the fourth authority value, and the The fourth permission value is used to represent the second access permission of the first physical address or the first physical address space segment; the first information also includes the first index number.
  • embodiments of the present application provide a memory access device, including a processor and a transmission interface.
  • the processor is configured to call a program stored in the memory, so that the memory access device implements the first step described above.
  • inventions of the present application provide a computer-readable storage medium.
  • the computer-readable storage medium includes a computer program.
  • the computer or the processor causes the computer or the processor to cause The processor performs the method described in any possible implementation manner of the first aspect or the second aspect.
  • embodiments of the present application provide a chip, including: a processor configured to call and run a computer program from a memory, so that a device installed with the chip executes any of the above first or second aspects.
  • a processor configured to call and run a computer program from a memory, so that a device installed with the chip executes any of the above first or second aspects.
  • One possible implementation is the method described.
  • inventions of the present application provide a computer program product.
  • the computer program product includes a computer program.
  • the computer or processor causes the computer or processor to perform the following tasks: The method described in any possible implementation of the first aspect or the second aspect.
  • embodiments of the present application provide an electronic device, where the electronic device is the above-mentioned first device or the second device, or the electronic device includes the above-mentioned first device and/or the second device.
  • Figure 1 is a schematic diagram of a scenario in which calculation is delegated to a specific IO device/accelerator provided by an embodiment of the present application.
  • Figure 2 is a schematic diagram of physical address access based on a physical address space segment access permission table provided by an embodiment of the present application.
  • Figure 3 is a schematic diagram of physical address access based on a blacklist and whitelist mechanism provided by an embodiment of the present application.
  • Figure 4 is a schematic diagram of an exemplary application scenario provided by the embodiment of the present application.
  • Figure 5 is a schematic flowchart of a memory access method provided by an embodiment of the present application.
  • FIG. 6 is a flow chart of a possible implementation example of the memory access method shown in FIG. 5 .
  • FIG. 7 is a schematic flowchart of a possible implementation example of an invalid physical address space segment in the embodiment shown in FIG. 5 .
  • FIG. 8 is a schematic flowchart of another possible implementation example of an invalid physical address space segment in the embodiment shown in FIG. 5 .
  • Figure 9 is a schematic structural diagram of a memory access device provided by an embodiment of the present application.
  • Figure 10 is a schematic structural diagram of another memory access device provided by an embodiment of the present application.
  • Figure 1 is a schematic diagram of a scenario in which calculation is delegated to a specific IO device/accelerator according to an embodiment of the present application.
  • the CPU on the host side needs to execute a program Read_image.
  • the program Read_image includes three important functions, namely step1, step2 and step3.
  • the CPU delegates it to its IO device (including GPU, TPU) and accelerator (Accelerator 1).
  • the GPU executes step1
  • the TPU executes step2
  • the accelerator executes step3; the GPU, TPU and accelerator have completed the calculations.
  • the respective calculated results are returned to the CPU, and then the CPU outputs the result of Read_image.
  • IO devices/accelerators can cache (cache) the CPU's page table locally, thereby alleviating the CPU's input/output Memory Management Unit (IOMMU)/System Memory Management Unit (SMMU) ), this is also the Address Translation Service (ATS) mechanism under the PCIe bus protocol in today's industry.
  • IOMMU input/output Memory Management Unit
  • SMMU System Memory Management Unit
  • ATS Address Translation Service
  • the IO device can directly access the CPU's memory space (that is, the memory space on the host side) based on the physical address.
  • direct P2P computing scenarios between accelerators one can also directly access each other's physical address space using physical addresses. In this way, the address translation delay caused by using virtual address access will be greatly reduced.
  • IO devices/accelerators directly access the CPU's memory space through physical addresses, or accelerators directly access each other's address spaces using physical addresses, which will bring security risks, especially when IO devices/accelerators are produced by third parties. hour.
  • the main security risks include:
  • IO devices/accelerators impersonate the identities of other IO devices/accelerators that have access permissions to access physical address spaces that they do not have permissions but that other IO devices/accelerators have permissions to access.
  • Figure 2 is a schematic diagram of physical address access based on a physical address space segment access permission table provided by an embodiment of the present application.
  • a physical address space segment access permission table is established based on the physical address, such as the Protection Table in Figure 2. Each entry of this physical address space segment access permission table only requires 2 bits. Indication: Whether there is only read (Read, referred to as R) permission, or only write (Write, referred to as W) permission, or whether there is read and write permission, or neither read permission nor write permission; and, this physical address space segment
  • the access rights table is indexed based on physical address.
  • Step 1 After aligning the physical address accessed by the IO device/accelerator based on the physical address according to the granularity (GS) of the physical address space, obtain the physical address number (Physical Address number) used for indexing, for example, this physical address The high bits of the physical address are then used to index the physical address space segment access rights table.
  • GS granularity
  • Step 2 If the corresponding entry can be indexed in the access permission table of the physical address space segment through the high bits of the physical address, proceed to step 3; otherwise, directly block access to the physical address.
  • Step 3 Determine whether the permission information of the entry indexed in the physical address space segment access permission table allows access to this physical address; if access to this physical address is allowed, access is normal; otherwise, access to this physical address is directly blocked. access.
  • a physical address space segment access permission table indexed based on physical address must be established.
  • this physical address space segment access permission table may span Relatively large, and each entry of this physical address space segment access rights table cannot be continuously allocated and used, because the entries of the actually used table do not need to be so many, so the utilization rate of this physical address space segment access rights table is low.
  • the management granularity of the physical address space is relatively fine, it may eventually overflow into the system memory, thus consuming resources such as memory space.
  • Figure 3 is a schematic diagram of physical address access based on a blacklist and whitelist mechanism provided by an embodiment of the present application.
  • the host Host
  • the endpoint device Endpoint, referred to as EP
  • the RC Root Complex
  • RP Root Port
  • the RC processor is connected to the chip bus inside the processor and can interact with the CPU and memory on the host side; one RC can support one or more ports, and each port has an independent topology.
  • the second related technology has the following shortcomings:
  • the granularity of protection is very coarse: access requests to a specific access end are either allowed to use physical addresses for access, or are not allowed to use physical addresses for access;
  • the accessing end uses a physical address to access the memory space of the accessed end, for example, when an IO device/accelerator uses a physical address to access the memory space of the host or CPU, or when an accelerator and an accelerator use a physical address to access each other.
  • the physical address-based access can be quickly verified to protect the security of the memory space at the accessed end, including:
  • the access terminal cannot impersonate the identity of other access terminals that have access rights to access the physical address space that it does not have permission but other access terminals have permission to access.
  • the protection of physical address space can be accurately subdivided into different users (such as processes/virtual machines/containers, etc.) to achieve safe isolation of physical address-based access to different physical address space segments.
  • Figure 4 is a schematic diagram of an exemplary application scenario provided by an embodiment of the present application. Actual application scenarios may be more complex and diverse.
  • the system shown in Figure 4 includes a host, IO interfaces, multiple node devices, switch devices, etc.
  • the host has one or more CPUs, main memory, cache memory (such as cache), IOMMU/SMMU module, internal interconnection bus, IO interconnection interface, and the physical address access protection control (Physical Address) implemented by this application. Computing system for Accession Protection Control, PAAPC) module, etc. It should be understood that the implementation architecture location of the physical address access protection control module is more than the one shown in this embodiment; for example, the physical address access protection control module can also be implemented in the IOMMU/SMMU, and all transaction access coming from the IO interface must be After judgment and processing by IOMMU/SMMU module.
  • the plurality of node devices include node device 1, node device 2, node device 3 and node device 4.
  • Node device 1, node device 2, node device 3 and node device 4 can all be: GPU, a certain processor unit (XPU ), solid-state drives (SSD), accelerators with specific computing functions, smart network cards, network switches, etc.
  • XPU processor unit
  • SSD solid-state drives
  • the switch device can realize bus interconnection and routing functions, and can even have congestion control and quality of service (QoS) functions; for some of its ports, it can also have the function of directly connecting with the network, such as something like function of the network card.
  • QoS quality of service
  • the host, node device and switch device can all communicate with each other through the interconnection bus; for example, the host and the node device or the switch device communicate with each other through the interconnection bus, the node device and the switch device communicate with each other through the interconnection bus, and the node device communicates with each other through the interconnection bus. Communication with node devices is achieved through the interconnection bus.
  • the interconnection bus between the host, the node device and the switch device can be any interconnection bus, not limited to the PCIe bus, and can also be other interconnection buses such as the NVLink interconnection bus.
  • the system shown in Figure 4 may also include an accelerator (not shown in Figure 4).
  • the accelerator may be connected to the host-side CPU through an interconnect bus, and may be directly or indirectly connected to multiple node devices through the interconnect bus.
  • this application refers to the device that issues the access request based on the physical address as the access end (such as the second device side in this application), and the device that receives the access request based on the physical address is called The accessed end (such as the first device side in this application).
  • the accessed end such as the first device side in this application.
  • a node device sends an access request based on a physical address to the host, and the host receives an access request based on the physical address, then the node device is called the access end and the host is called the accessed end; one node device sends a request based on the physical address to another node device.
  • the access request based on the physical address is received by another node device, then the node device is called the access end, and the other node device is called the accessed end; the accelerator sends the access request based on the physical address to the host side CPU, and the host side When the CPU receives an access request based on the physical address, the accelerator is called the access end, and the host-side CPU is called the accessed end; the accelerator sends an access request based on the physical address to the node device, and the node device receives the access request based on the physical address, then the accelerator is called is the access end, and the node device is called the accessed end; the node device sends an access request based on the physical address to the accelerator, and the accelerator receives the access request based on the physical address, then the node device is called the access end, and the accelerator is called the accessed end; etc. .
  • Figure 5 is a schematic flowchart of a memory access method provided by an embodiment of the present application.
  • the second device shown in Figure 5 is the access terminal, and the first device is the accessed terminal.
  • the memory access method shown in Figure 5 can be applied to the application scenario shown in Figure 4.
  • the first device and the second device are connected via an interconnection bus.
  • the first device or the second device may be one of the following: a host or a host-side CPU, a host-side accelerator, or a node device connected to the host or the host-side CPU through an IO interface;
  • the node device may be: a GPU, a certain processor Unit (XPU), solid state drive (SSD), accelerator with specific computing functions, smart network card, network switch, etc.
  • XPU processor Unit
  • SSD solid state drive
  • the first device or the second device may also refer to a virtual resource in any of the above devices, such as a virtual machine in the host, a virtual function entity of the device, an operating system, a container, etc.
  • the channel between the first device and the second device is secure.
  • the data will not be tampered with during the interaction.
  • the identity number, first security check value, first information, etc. carried in the first access request will not be tampered with.
  • the memory access method shown in Figure 5 includes but is not limited to the following steps or operations:
  • the second device sends a first access request to the first device, where the first access request includes an identity number, a first security check value and first information, where the first information includes a first physical address.
  • the identity number in the embodiment of this application is a globally unique identity number (hereinafter referred to as the global identity number).
  • the identity number can be used to identify the identity of the access end (second device).
  • the identity number It is the globally unique identity (ID) of the access transaction issued by the IO device/accelerator (ie, the second device side).
  • ID globally unique identity
  • GUID Globally Unique Identifier
  • the identity number can be used to identify the identity of the accessed end (the first device). For example, it can be based on the globally unique identity (ID) number of the accessed destination resource (ie, the second device side). (Hereinafter referred to as global identity ID).
  • the global identity number may be a node identity number in an interconnected system, or may be a global identity number of a corresponding transaction under system software management (for example, an access request transaction or an accessed destination resource).
  • the global identity number in this application is the bus number, device number, and function number (Bus number, Device number, Function number, BDF); if necessary, the process address can also be added Space identity (Process Address Space ID, PASID).
  • the global identity number is the stream identity (Stream ID); if there is a sub-stream identity (Sub-stream ID), the global identity number is the stream identity and sub-stream identity; there are similar ones in other systems The ID of the logical function.
  • the identity number is used to identify the first device or the second device, the role of the identity number in the verification process of the memory access request permission is the same, that is, it is used for the first device.
  • the device derives different keys based on the identity number. Subsequent cryptographic security mathematical calculations can be calculated based on this derived key. For example, a subsequent first key is derived based on the identity number, and a subsequent first key is generated based on the first key.
  • the first security check value and the second security check value are used to verify the permissions of the memory access request, etc. in,
  • the first device can identify the specific identity of the second device based on the identity number in the access request sent by the second device.
  • the first device needs to advance Maintain and store related information of multiple second devices.
  • the accessed end can establish an area table for each accessing end to store physical address space access permissions based on the accessing end's identity number, or the accessed end can also create an area table for all accessing ends to store physical addresses based on the accessing end's identity number. Zone table of space access rights. Since the number of access terminals (second devices) may be larger, the number of area tables that may need to be maintained and stored in this case is relatively larger, and accordingly, more storage resources are required. However, since the first device can know which second device is accessing based on the identity number, more precise control can be carried out.
  • the first device When the identity number is used to identify the first device, the first device cannot identify the specific identity of the second device based on the identity number in the access request sent by the second device. At this time, it can be understood that the first device needs Maintain and store your own relevant information in advance. For example, the accessed end can establish an area table that stores physical address space access permissions based on the accessed end's identity number. In this case, since the accessed end only needs to maintain and store its own control table, accordingly, the required storage resources will be reduced. Therefore, very few storage resources and control resources are required, that is, a large amount of storage and maintenance costs for area tables can be saved. Of course, the first device can still determine the corresponding first key based on the identity number, and determine the first security check value and the second security check value based on the first key.
  • the above-mentioned area table that needs to be maintained and stored in advance can be implemented by the first device itself, or can be implemented by the operating system, virtualization software, or independent management software on the first device. According to the embodiment of the present application There is no specific limit on this.
  • the identity number in the embodiment of the present application specifically identifies depends on what is specifically stored and maintained on the first device side. For example, if the identity number identifies the first device, then correspondingly, what is stored and maintained on the first device side is the mapping relationship between the identity number of the first device and the first key.
  • the identity of the first device can be used. The number is indexed to the first key; if the identity number identifies the second device, then correspondingly, what is stored and maintained on the first device side is the mapping relationship between the identity number of the second device and the first key.
  • you can The first key is indexed by the second device's identity number.
  • the first device receives the first access request from the second device.
  • the first device calculates a second security check value based on the identity number and the first information.
  • the security check value in this application can be a Message Authentication Code (MAC).
  • MAC Message Authentication Code
  • the first security check value and the second security check value are both MAC; but the security check value
  • the possible implementation is not limited to this, depending on the specific cryptographic security mathematical calculation algorithm.
  • the first device determines the access permission of the second device to the first physical address based on the first security check value and the second security check value.
  • the first device includes a memory
  • the physical address space of the memory includes a first physical address
  • the first physical address corresponds to the first security check value
  • the first security check value is also determined by the first device based on and
  • the second security check value is calculated using the same method and is sent by the first device to the second device in advance.
  • the access rights of the second device to the first physical address include allowed access and disallowed access. Specifically, they may include: only reading is allowed, only writing is allowed, both reading and writing are allowed, and neither reading nor writing is allowed.
  • the second device when the second device needs to access the first physical address in the first device, the second device will send a first access request to the first device, and the first access request carries information identifying the first device. Or the identity number of the second device, the first security check value and the first information.
  • the first information includes the first physical address that needs to be accessed; after receiving the first access request, the first device obtains it from the first access request.
  • the identity number, the first security check value and the first information are obtained, and then the second security check value is calculated based on the identity number and the first information, and then the third security check value is determined based on the first security check value and the second security check value. Does the second device have access rights to the first physical address.
  • determining the access permission of the second device to the first physical address based on the first security check value and the second security check value can be understood as a verification process; in the case of passing the verification, the second device is allowed to access the first physical address. The device accesses the first physical address; if the verification fails, the second device is prevented from accessing the first physical address.
  • this application can implement "calculation on behalf of the inquiry", saving the accessed end from implementing complex data structures (such as page pages) due to security verification.
  • resources required for data structures such as tables such as tables
  • verification only requires (hardware-based) mathematical calculations, and there is no hardware action such as table lookup. Therefore, it can reduce the delay of security verification, achieve fast verification, and greatly improve Security verification efficiency.
  • the method before receiving the first access request from the second device, the method further includes: the first device receives a physical address application request from the second device, the physical address The application request includes the identity number; the first device generates a first key for the identity number; the first device sends a first response to the physical address application request to the second device, where the first response includes the The first security check value and the first information, the first security check value is calculated based on the first key; the second device receives the first response from the first device .
  • a key derivation strategy can be implemented using the following algorithm:
  • key_x fun1_RotKey (identity number, monotonically increasing parameter);
  • fun1 represents the derivation calculation function, which can be a standard key derivation function such as Halting Key Derivation Functions (HKDF); RotKey is the root key of the derivation calculation; the monotonically increasing parameter can be Is the counter value or system time.
  • HKDF Halting Key Derivation Functions
  • RotKey is the root key of the derivation calculation
  • the monotonically increasing parameter can be Is the counter value or system time.
  • the first key fun1_RotKey (identity number of the first device or the second device, monotonically increasing parameter).
  • calculating the second security check value based on the identity number and the first information includes: indexing a first key based on the identity number, and indexing a first key based on the first key and the first information.
  • the first information calculates the second security check value.
  • the security check value is MAC
  • fun2 represents the digest calculation function, which can be a standard digest calculation function such as Secure Hash Algorithm (SHA) 2; key_x is the key, and the key is required as an operator when calculating fun2; PA_x represents physical address. It should be understood that if PA_x is the first physical address and key_x is the first key, then the MAC calculated by the above formula is the first security check value or the second security check value. It should be noted that when the above-mentioned MAC calculation method is used to calculate the second security check value, the first key needs to be indexed based on the identity number of the first device or the second device.
  • SHA Secure Hash Algorithm
  • the second device needs to obtain the first security check value and the first information before accessing the first physical address.
  • the second device obtains the first security by sending a physical address application request to the first device.
  • the check value and the first information, the physical address application request carries the identity number of the first device or the second device; after receiving the physical address application request, the first device obtains the first device or the second device in the physical address application request.
  • the identity number of the device and generate a first key for the identity number of the first device or the second device, and a first security check value calculated based on the first key, and then combine the first security check value and the first
  • the information is sent to the second device via the first response.
  • access permission of the second device to the first physical address through the first access request is granted by the first device to the second device, that is, the access permission is obtained through legal channels.
  • accessing the first physical address through the first access request is an expected access, ensuring the security of the physical address space of the first device. It should be understood that the key generated by the accessed end for the identity number of the accessing end or the accessed end is not disclosed to the outside world, that is, the accessing end cannot obtain the key generated for it, for example, the first device will not disclose the first secret to the outside world.
  • the first key cannot be obtained by the second device; and the security check value is calculated based on the key generated for the identity number of the accessing end or the accessed end. For example, the first security check value is calculated based on the identity number of the accessing end or the accessed end.
  • the first key generated by the identity number of one device or the second device is calculated, and the cryptographic security mathematical calculation algorithm for calculating the security check value is an algorithm proven to be sufficiently secure by the industry and theory; therefore, for any access terminal , cannot counterfeit or guess to obtain the security check value (including not counterfeiting or guessing to obtain the security check value corresponding to the physical address space it wants to attack), nor can it counterfeit or guess to obtain the security check value for other access terminals, so it is The security of the accessing end's physical address space can be guaranteed.
  • the second device cannot counterfeit or guess to obtain the first security check value.
  • the second device can only request the first device to obtain the first security check value; the second device cannot obtain the first security check value that is not open to the second device.
  • the security check value corresponding to other physical addresses accessed by the device so the second device cannot access the other physical addresses, thus ensuring the security of the physical address space of the first device.
  • the first information further includes a first permission value
  • the first permission value is used to represent the first access permission of the second device to the first physical address. It should be understood that the first access right includes at least one of the following: read-only, write-only, both read and write, and neither read nor write.
  • the first permission value is represented by 3 bits.
  • RWX execution operation
  • the security check value is MAC
  • fun2 represents the digest calculation function, which can be a standard digest calculation function such as SHA2; key_x is the key, and the key is required as an operator when calculating fun2; PA_x represents the physical address; pert_x represents the address corresponding to a certain physical address.
  • the permission value A and pert_x can be coded values; the permission value A corresponding to a certain physical address is used to represent the first access permission of the access end to the physical address.
  • the first information includes the first physical address and the first permission value
  • PA_x is the first physical address
  • key_x is The first key
  • pert_x is the first permission value
  • the first key needs to be indexed based on the identity number of the first device or the second device.
  • the first device can notify the second device of its first access permission to the first physical address through the first response, so that the second device can obtain its first access permission to the first physical address; further , when the second device accesses the first physical address, the first information carried in the first access request also includes the first permission value; because the greater the amount of information included in the first information, the less likely the first information is to be counterfeited , guess; and the first security check value and the second security check value are calculated based on the first information. The more information included in the first information, the more the first security check value and the second security check value are determined.
  • the first authority value may be the input parameter of the cryptographic security mathematical calculation algorithm; specifically, first based on the third A physical address is inferred to obtain the first authority value, and then it is used as an input parameter of the cryptographic security mathematical calculation algorithm; or various possible values of the first authority value are used as input parameters of the cryptographic security mathematical calculation algorithm, that is, for the first
  • Each possibility of the first access authority represented by the permission value calculates a first security check value or a second security check; since the first information includes the first permission value, when calculating the second security check value, There is no need to guess the first permission value, or there is no need to calculate a second security check value for the first access permission for verification with the first security check value; in this way, the delay of the security check can be reduced, which is beneficial to Realize fast verification and greatly improve the efficiency of security verification.
  • the first information also includes the granularity of the physical address space.
  • the granularity of the physical address space is used to characterize the range size of the physical address space.
  • the physical address space includes the First physical address.
  • the physical address space includes a first physical address space segment, and the first physical address space segment includes the first physical address.
  • the granularity of the physical address space is used to characterize the range of the physical address space; that is, the total number of bits in the physical address space, minus the granularity, is how many bits higher, and the granularity refers to how many bits lower, how many lower. Bits are used to represent physical address space ranges.
  • the physical address interval range is 2 ⁇ n; further, the physical address space range starts from the aligned address, that is, the physical address space range represents the low n bits from all 0 to 2 ⁇ n , a physical address range in which the high bits of the physical address remain unchanged.
  • the physical address is represented by 48 bits and the granularity is 8
  • the physical address range is 256
  • the corresponding physical address space range is that the high 40 bits remain unchanged and the low 8 bits range from all 0 to 256.
  • Address range that is, only the lower 8 bits of the 48-bit physical address space are used, that is, the address space is 0000000 to 11111111, and the first 40 bits are not used.
  • calculating the second security check value based on the identity number and the first information includes: indexing the first key according to the identity number; if the first information includes the first authority value, then determine the high bits of the first physical address based on the first physical address and the granularity of the physical address space; if the first information does not include the first permission value, determine the high bits of the first physical address based on the first physical address and the granularity of the physical address space.
  • the granularity of the physical address space determines the high bits of the first physical address and the first permission value; according to the granularity of the physical address space, the high bits of the first physical address, and the first permission value and the first key to obtain the second security check value.
  • the security check value is MAC
  • fun2 represents the digest calculation function, which can be a standard digest calculation function such as SHA2; key_x is the key, and the key is required as an operator when calculating fun2; range_x represents the granularity of the physical address space, and range_x can be the encoding value; pa_align represents the high bit of the physical address aligned based on the granularity of the physical address space; pert_x represents the permission value A corresponding to a certain physical address space segment, and pert_x can be an encoded value. It should be noted that if a physical address space segment corresponds to a permission value A, then any physical address in the physical address space segment also corresponds to the permission value A.
  • the first information includes the first physical address and the granularity of the physical address space
  • key_x is the first key
  • range_x is the granularity of the physical address space corresponding to the identity number of the first device or the second device
  • pa_align is the high bit of the first physical address aligned based on the granularity of the physical address space, that is, the high bit of the first physical address, and the The high bits of a physical address can be determined based on the first physical address and the granularity of the physical address space
  • pert_x is the first permission value.
  • the first permission value is used to represent the second device's first access to the first physical address space segment.
  • the access permission, and the first permission value can be determined (speculated) based on the first physical address and the granularity of the physical address space.
  • the first key needs to be indexed based on the identity number of the first device or the second device.
  • the first device includes a memory, and the physical address space of the memory includes N physical address space segments, where N is a positive integer; for example, the first device allows the second device to access the physical address space according to a certain ( programmable) granularity is divided into N physical address space segments; after receiving the physical address application request from the second device, the first device can calculate a security address for each of the N physical address space segments. Check values to obtain N security check values, the N security check values correspond to N physical address space segments, and the N security check values are calculated based on the first key; the first device sends the The first response sent by the second device includes the granularity of the physical address space, N physical address space segments, and N security check values.
  • the security check value corresponding to the first physical address space segment is the first security check value, that is, the N security check values include the first security check value; in this case, the first information includes the first response The granularity of the physical address space in and the first physical address in the first physical address space segment.
  • the first information carried in the first access request also includes the granularity of the physical address space; because the greater the amount of information included in the first information, the less likely it is that the first information is Counterfeiting and guessing; and the first security check value and the second security check value are calculated based on the first information.
  • the more information included in the first information the more the first security check value and the second security check value are determined.
  • the more factors there are in the check value the less likely the first security check value is to be counterfeited and guessed, and the more stringent the possibility of successful verification of the first security check value and the second security check value; in this way, It is beneficial to ensure the security of the physical address space of the first device.
  • the security check value carried in the corresponding access request is also the first security check value; thus, for any physical address Space segment, for which a security check value is calculated so that all physical addresses in the physical address space segment correspond to the same security check value.
  • the access end accesses each physical address in the physical address segment, it carries The same security check value does not need to carry different security check values for each physical address in the physical address space segment, thereby reducing overhead.
  • the first permission value is also used to represent the first access permission of the second device to the first physical address space segment.
  • the first device includes a memory, and the physical address space of the memory includes N physical address space segments, and N is a positive integer; after receiving the physical address application request from the second device, the first device can apply for N physical addresses Each physical address space segment in the space segment determines a permission value A to obtain N permission values A.
  • the N permission values A correspond to the N physical address space segments. Any one of the N permission values A is A.
  • the first response sent by the first device to the second device includes the granularity of the physical address space, N physical addresses Space segment, N security check values and N authority values A. Since the first physical address space segment is one of the N physical address space segments, and the first physical address is one of the physical addresses in the first physical address space segment, the N permission values A and The permission value A corresponding to the first physical address space segment is the first permission value, that is, the N permission values A include the first permission value; in this implementation, the first information includes the physical address space in the first response. Granularity, the first physical address in the first physical address space segment and the first permission value among the N permission values A.
  • the permission value A carried in the corresponding access request is also the first permission value; thus, for any physical address space segment, Determine a permission value A for it, so that all physical addresses in the physical address space segment correspond to the same permission value A, and the access end carries the same permission value A when accessing each physical address in the physical address segment. , instead of carrying a different permission value A for each physical address in the physical address space segment, thereby reducing overhead.
  • the security check value is MAC
  • fun2 represents the digest calculation function, which can be a standard digest calculation function such as SHA2; key_x is the key, and the key is required as an operator when calculating fun2; range_x represents the granularity of the physical address space, and range_x can be the encoding value; pa_align represents the high bit of the physical address aligned based on the granularity of the physical address space; pert_x represents the permission value A corresponding to a certain physical address space segment, and pert_x can be an encoded value.
  • digest calculation function can be a standard digest calculation function such as SHA2
  • key_x is the key, and the key is required as an operator when calculating fun2
  • range_x represents the granularity of the physical address space, and range_x can be the encoding value
  • pa_align represents the high bit of the physical address aligned based on the granularity of the physical address space
  • pert_x represents the permission value A corresponding to a certain physical address space segment, and per
  • the first information includes the first physical address, the granularity of the physical address space and the first permission value
  • key_x is The first key
  • range_x is the granularity of the physical address space corresponding to the identity number of the first device or the second device
  • pa_align is the high bit of the first physical address aligned based on the granularity of the physical address space, that is, the first physical address
  • the high bits of the first physical address can be determined according to the first physical address and the granularity of the physical address space
  • pert_x is the first permission value.
  • the first permission value is used to indicate that the second device has a right to the first physical address.
  • the first information carried in the first access request when the second device accesses the first physical address, also includes the first permission value; because the greater the amount of information included in the first information, the more the first information The less likely it is to be counterfeited and guessed; and the first security check value and the second security check value are calculated based on the first information. The greater the amount of information included in the first information, the first security check value is determined. The more factors there are with the second security check value, the less likely the first security check value is to be counterfeited and guessed, and the more likely it is that the first security check value and the second security check value can be successfully verified. strict; in this way, it is helpful to ensure the security of the physical address space of the first device.
  • the first authority value may be the input parameter of the cryptographic security mathematical calculation algorithm; specifically, first based on the third The first permission value is obtained by inferring the granularity of a physical address and the physical address space, and then using it as an input parameter for a cryptographic security mathematical calculation algorithm; or using various possible values of the first permission value as an input for a cryptographic security mathematical calculation algorithm. Parameters, that is, a first security check value or a second security check is calculated for each possibility of the first access authority represented by the first authority value; since the first information includes the first authority value, the first security check value is calculated when calculating the first access authority value.
  • the security check value can be reduced.
  • the delay of verification is conducive to rapid verification and greatly improves the efficiency of security verification.
  • determining the access permission of the second device to the first physical address based on the first security check value and the second security check value includes: The first security check value and the second security check value are verified; if the first security check value and the second security check value are verified successfully, it is determined that the second device is The access permission of the first physical address is allowed access.
  • the access rights include at least one of the following: only reading is allowed, only writing is allowed, and both reading and writing are allowed.
  • the second device can be allowed to access the first physical address, that is, the second device can access the first physical address. Access permission is Allowed.
  • the successful verification of the first security check value and the second security check value may mean that the first security check value and the second security check value are the same.
  • the first security check value and the second security check value are In the case of MAC; but it is not limited to this, it depends on the specific password security mathematical calculation algorithm.
  • the first security check value and the second security check value are calculated based on the first key; the method further includes: the first device Generate a second key; the first device sends an invalidation command to the second device, the invalidation command is used to invalidate the first physical address or the first physical address space segment; the second device receives an invalid command from the first device. the invalid command; the second device sends a response to the invalid command to the first device; the first device receives the response to the invalid command from the second device; after receiving the invalid command from the second device After the response to the invalid command, or after the invalid command times out, the first device replaces the first key with the second key.
  • the process of the first device generating the second key based on the identity number of the first device or the second device may be referred to the process of generating the first key, which will not be described again here.
  • using the second key to replace the first key may mean that the first key is no longer used to calculate the security check value, and only the second key is used to calculate the security check value.
  • the second device after receiving the invalid command, the second device no longer sends an access request to the first device to access the first physical address or the first physical address space segment.
  • the second key can be regenerated for the identity number of the first device or the second device, and the regenerated second key can be used. Replace the original first key for security verification.
  • the security check value carried in the access request is still the first security check value, and the first security check value is based on the first key.
  • the first device calculates the security check value based on the second key, so the security check value calculated by the first device and the first security check value carried in the access request will be If the verification is unsuccessful, the second device is prevented from accessing the first physical address or the first physical address space segment, that is, the second device does not have access rights to the first physical address or the first physical address space segment. In this way, if the accessed end needs to change the access permission of the accessing end to a certain physical address or physical address space segment, the accessed end can regenerate a new key based on the identity number of the accessing end or the identity number of the accessed end to replace the old key.
  • the access end can flexibly manage the physical address space, including dynamically allocating physical address space segments and dynamically modifying the access of the allocated physical address space segments. permissions, and dynamically reclaim the allocated physical address space segment; and when the identity number is used to identify the second device, that is, the access end, the access end can be as granular as the identity number of each second device when managing the physical address space. Ensure that different identity numbers do not affect each other.
  • the method further includes: receiving a response from the invalid command.
  • the security check value acquisition request includes the identity number, a third security check value and second information.
  • the third security check value is based on the first security check value.
  • the second information includes a second physical address; a fourth security check value is calculated based on the identity number, the second information and the first key; and the third security check value is calculated according to the key.
  • the verification value is verified with the fourth security verification value; if the verification of the third security verification value and the fourth security verification value is successful, the security verification value is sent to the second device.
  • a second response to the verification value acquisition request including a fifth security verification value, the fifth security verification value being calculated based on the second key.
  • the first device includes a memory
  • the physical address space of the memory includes a second physical address.
  • the second physical address is different from the first physical address, that is, the second physical address is not to be invalidated; wherein, the second physical address is not to be invalidated.
  • the address corresponds to the third security check value, and the third security check value is also calculated by the first device based on the same method as calculating the fourth security check value, and is sent by the first device to the second device in advance.
  • the calculation process of the third security check value and the fourth security check value may correspond to the calculation process of the first security check value and the second security check value, which will not be described again here.
  • the calculation process of the fifth security check value can also refer to the calculation process of the first security check value, but the first key needs to be replaced with the second key.
  • the verification process of the third security check value and the fourth security check value may correspond to the verification process of the first security check value and the second security check value, which will not be described again here.
  • the first device regenerates the second key for the identity number of the first device or the second device to replace the first key. key; for the second physical address that has not been invalidated, its corresponding third security check value is calculated based on the first key.
  • the second device It is necessary to obtain the fifth security check value calculated based on the second key corresponding to the second physical address.
  • the fifth security check value can be used to replace the third security check value; therefore, the second device sends the In the security check value acquisition request, the first device sends the fifth security check value to the second device through the second response, thereby ensuring that the second device still has access rights to the second physical address.
  • the accessing end when the accessing end re-obtains the security check value from the accessed end, it also needs to perform security verification, thereby further protecting the security of the accessed end's physical address space. It should be understood that for the first physical address or the first physical address space segment to be invalidated, even if the second device requests to re-obtain the new security calculated based on the second key for the first physical address or the first physical address space segment.
  • the first device will not send a new security check value; so for the physical address or physical address space segment to be invalidated, no new security check value will be given to the accessing end, and the access segment cannot be guessed To the new security check value, the accessing end must not pass the verification of the accessed end, that is, it no longer has access rights to the invalid physical address or physical address space segment, thereby protecting the security of the accessed end's physical address space.
  • the second information further includes a second permission value
  • the second permission value is used to represent the first access permission of the second device to the second physical address.
  • the second information also includes the granularity of the physical address space.
  • the granularity of the physical address space is used to characterize the range size of the physical address space.
  • the physical address space includes the Second physical address.
  • the physical address space includes a second physical address space segment, and the second physical address space segment includes the second physical address.
  • the second physical address space segment can be any one of the N physical address space segments except the first physical address space segment, that is, the second physical address space segment is a physical address space segment that does not need to be invalidated, and it can Continue to be accessed by the second device. Further, for the physical address space segment that does not need to be invalidated, the security check value needs to be reassigned to ensure that it can continue to be accessed, so the first device sends the fifth security check value to the second device, and the fifth The security check value is not only used for verification when accessing the second physical address, but also for verification when accessing all physical addresses in the second physical address space segment.
  • the second permission value is also used to represent the first access permission of the second device to the second physical address space segment. It should be noted that for the specific process and beneficial effects of this implementation, reference can be made to the description of the above related implementation, and the description will not be repeated here.
  • the method further includes: receiving a response from the invalid command.
  • a second access request of the second device the second access request includes the identity number, a sixth security check value and third information, the third information includes a third physical address; according to the identity number, the The third information and the first key are calculated to obtain a seventh security check value, and the eighth security check value is calculated according to the identity number, the third information and the second key;
  • the sixth security check value is verified with the seventh security check value and the eighth security check value respectively; if the sixth security check value is verified with the seventh security check value, If successful, or the sixth security check value and the eighth security check value are successfully verified, it is determined that the access permission of the second device to the third physical address is allowed access.
  • the first device includes a memory
  • the physical address space of the memory includes a third physical address.
  • the third physical address is different from the first physical address, that is, the third physical address is not to be invalidated; wherein, the third physical address is not to be invalidated;
  • the address corresponds to the sixth security check value, and the sixth security check value is also calculated by the first device based on the same method as calculating the seventh security check value or the eighth security check value, and is advanced by the first device sent to the second device.
  • the security check value carried in the access request received by the first device may be calculated based on the old key, or may be It is calculated based on the new key; for example, the sixth security check value may be calculated based on the first key or the second key.
  • the calculation process of the sixth security check value may correspond to the calculation process of referring to the first security check value or the fifth security check value
  • the calculation process of the seventh security check value may correspond to the calculation process of referring to the second security check value.
  • the calculation process, the calculation process of the eighth security check value can also refer to the calculation process of the fifth security check value, and will not be described again here.
  • the verification process of the sixth security check value and the seventh security check value, and the verification process of the sixth security check value and the eighth security check value can be correspondingly referred to the first security check value and the third security check value. 2.
  • the verification process of the security check value will not be described in detail here.
  • the first device has regenerated the second key for the second device before sending the invalid command, after the first device sends the invalid command and before receiving the response to the invalid command, or Before the invalid command times out, the first key and the second key coexist briefly; therefore, within this time period, if the first device receives the second access request from the second device, as long as the sixth security check value is the same as If any one of the seventh security check value and the eighth security check value is successfully verified, the second device is allowed to access the third physical address, thereby ensuring that the invalid first physical address or first physical address space segment During the process, the second device can normally access the third physical address that has not been invalidated.
  • this application utilizes the mechanism of temporary coexistence of the old key and the new key within a certain period of time; among which, the old key is only used to calculate the calibration.
  • the security check value used for verification is no longer used to calculate the new security check value that needs to be sent to the access terminal; the new key can be used to calculate both the security check value for verification and the need to calculate the security check value.
  • the third information further includes a third permission value, and the third permission value is used to represent the first access permission of the second device to the third physical address.
  • the third information also includes the granularity of the physical address space.
  • the granularity of the physical address space is used to characterize the range size of the physical address space.
  • the physical address space includes the Third physical address.
  • the physical address space includes a third physical address space segment, and the third physical address space segment includes the third physical address.
  • the third permission value is also used to represent the first access permission of the second device to the third physical address space segment. It should be noted that for the specific process and beneficial effects of this implementation, reference can be made to the description of the above related implementation, and the description will not be repeated here.
  • the first device includes an area table, the area table includes a first index number and a fourth authority value, the first index number corresponds to the fourth authority value, and the The fourth permission value is used to represent the second access permission of the first physical address or the first physical address space segment; the first information also includes the first index number.
  • the identity number is used to identify the second device
  • the accessed end can establish an area table for each accessing end to store the physical address space access rights based on the identity number of the accessing end, or it can also be based on the identity number of the accessing end. Establish an area table that stores physical address space access permissions for all accessing terminals.
  • the accessed terminal can establish an area table that stores physical address space access permissions based on the identity number of the accessed terminal. .
  • each entry in the area table only requires a few bits to store the physical address or the access permission of the physical address space segment.
  • the area table can be a continuous lightweight table with a controllable span; and, if the area The entries in the table are used to store the access rights of the physical address space segment, so each entry in the area table can be continuously allocated and used, and is not bound to a specific physical address. This will not cause the entry in the area table that you may want to use but cannot be used due to physical issues.
  • the address space is very discrete and cannot be used.
  • the first device includes a memory, and the physical address space of the memory includes N physical address space segments, and N is a positive integer; after receiving the physical address application request from the second device, the first device can apply for N physical addresses
  • Each physical address space segment in the space segment creates an entry in the area table, so that the area table includes N entries, and the N entries correspond to N physical address space segments; and, in each of the N entries, Used to store the access rights of the corresponding physical address space segment.
  • Each entry includes an area number, an index number and a permission value B. The area number is used to represent the physical address space segment corresponding to the entry, and the index number is used to index the entry.
  • the index number corresponding to the first physical address space segment among the N index numbers is the first index number, and the first information may include the first index number.
  • the second device accesses other physical addresses in the first physical address space segment, the index number carried in the corresponding access request is also the first index number; in this way, for any physical address space segment, its corresponding index number in the area table An index number, so all physical addresses in the physical address space segment correspond to the same index number.
  • the access end accesses each physical address in the physical address segment, it carries the same index number, rather than targeting the physical address.
  • Each physical address in an address space segment carries a different index number, which reduces overhead.
  • the second access right includes at least one of the following: read-only, write-only, both read and write, neither read nor write.
  • Table 1 is an example of a region table.
  • Table 1 there are a total of 4 entries of physical address space segments, namely entries of physical address space segment PA0, physical address space segment PA1, physical address space segment PA2 and physical address space segment PA3; R represents read permission, W Indicates write permission. It should be understood that when there is a certain permission for a certain physical address space segment, then all physical addresses in this physical address space segment have this permission; for example, physical address space segment PA0 allows writing, then the physical address space segment PA0 All physical addresses are allowed to be written.
  • calculating the second security check value based on the identity number and the first information includes: indexing the first key according to the identity number; if the first information includes the first authority value, then determine the high bits of the first physical address based on the first physical address and the granularity of the physical address space; if the first information does not include the first permission value, determine the high bits of the first physical address based on the first physical address and the granularity of the physical address space.
  • the granularity of the physical address space determines the high bits of the first physical address and the first permission value; according to the granularity of the physical address space, the high bits of the first physical address, and the first permission value , the first index number and the first key are calculated to obtain the second security check value.
  • the security check value in this application is MAC
  • fun2 represents the digest calculation function
  • key_x is the key
  • range_x represents the granularity of the physical address space
  • pa_align represents the high bit of the physical address aligned based on the granularity of the physical address space
  • pert_x represents the permission value A corresponding to the physical address space segment.
  • the permission value A corresponding to the physical address space segment is used to indicate the first access permission of the access end to the physical address space segment
  • range index indicates the index number of the area table.
  • range_x is the granularity of the physical address space in the first information
  • pa_align is the high bit of the first physical address aligned based on the granularity of the physical address space
  • pert_x is the first permission value
  • range index is the first index number.
  • key_x is the first key
  • the MAC calculated by the above formula is the first security check value or the second security check value.
  • the first device includes an area table, and the first information also includes a first index number. Based on the first index number, a fourth authority value can be indexed in the area table.
  • the fourth authority value is used to represent the first physical address or the second access right of the first physical address space segment, the first physical address space segment includes the first physical address, the first device can send the first index number to the second device through the first response; the second device is accessing
  • the first physical address is the first physical address
  • the first information carried in the first access request also includes the first index number; since the greater the amount of information included in the first information, the first information is less likely to be counterfeited and guessed; and the first The security check value and the second security check value are calculated based on the first information.
  • the more information included in the first information the more factors determine the first security check value and the second security check value. , the less likely the first security check value is to be counterfeited and guessed, the more stringent the possibility of successful verification of the first security check value and the second security check value; in this way, it is conducive to ensuring the safety of the first device Physical address space security. It should be understood that if the fourth permission value is used to represent the second access permission of the first physical address space segment, the second device carries the second access permission in the corresponding access request when accessing other physical addresses in the first physical address space segment.
  • the index number in the area table is also the first index number; thus, for any physical address space segment, an index number is determined for it when establishing the area table, so that all physical addresses in the physical address space segment correspond to the same Index number, the access end carries the same index number when accessing each physical address in the physical address segment, instead of carrying a different index number for each physical address in the physical address space segment, which can reduce overhead.
  • determining the access permission of the second device to the first physical address based on the first security check value and the second security check value includes: The first security check value and the second security check value are verified; if the first security check value and the second security check value are verified successfully, and the fourth authorization value If the indicated second access right is allowed access, then it is determined that the access right of the second device to the first physical address is allowed access. It should be understood that when the area table exists, after the security check value verification is successful, the area table is also checked; if the second access permission represented by the fourth permission value obtained by looking up the area table is allowed access, access is allowed.
  • the verification process of the first security check value and the second security check value is the same as in the case where the area table does not exist.
  • the fourth permission index is indexed in the area table.
  • the second device can be allowed to access the first physical address only when the second access permission represented by the value is allowed access, that is, the access permission of the second device to the first physical address is allowed access.
  • the access request issued by the accessing end also needs to carry the index number of the area table; and based on the index number of the area table carried by the access request, the accessed end indexes this access in the local area table Request the entry of the physical address or physical address space segment to be accessed to obtain the corresponding permission value; for this access request, only the security check value verification is successful and the second access permission represented by the permission value indexed in the area table Only when access is allowed can the access request be allowed to continue; otherwise, the access request will be blocked from continuing to access.
  • the method further includes: modifying the fourth permission value in the area table to a fifth permission value.
  • the fifth permission value can be any desired value; for example, the second access permission represented by the fourth permission value is only allowed to write, then the second access permission represented by the fifth permission value can include: only allowed to read, that is, allowed Reading and writing are allowed, neither reading nor writing is allowed.
  • the first device when it is necessary to change the access rights of the second device to the first physical address or the first physical address space segment, for example, when it is necessary to make the second device have no access rights to the first physical address or the first physical address space segment.
  • accessing permissions that is, when the first physical address or the first physical address space segment is invalid, the first device only needs to modify the fourth permission value in the area table to the fifth permission value.
  • the fifth permission value uses Indicates that the second access permission of the first physical address or the first physical address space segment is not allowed to access; later, when the second device accesses the first physical address or the first physical address space segment again, the first device based on the access request
  • the first index number carried indexes the fifth permission value in the area table, and the second access permission represented by the fifth permission is not allowed to access, thus preventing the second device from accessing the first physical address or the first physical address.
  • the space segment is used to change the access permission of the second device to the first physical address or the first physical address space segment.
  • the accessed end does not need to Regenerate the key based on the identity number of the client or the accessed client, and directly modify the permission value of the corresponding entry in the area table. For example, you can directly modify the permission value of the corresponding entry to the expected value, while maintaining the identity number of the accessing client or the visited client.
  • the key remains unchanged, which can reduce the frequency and additional overhead of updating the key because the accessed end needs to change the physical address or the access rights of the physical address space segment, and improve the efficiency of physical address space recycling (such as increasing invalid physical addresses or physical address space segment efficiency).
  • Figure 6 is a flow diagram of a possible implementation example of the memory access method shown in Figure 5.
  • the process of this possible implementation example includes but is not limited to the following steps or operations:
  • the accessing end sends a translation request (Translation Request) to the accessed end.
  • Translation Request a translation request
  • the accessing end Before the accessing end initiates a physical address-based access request to the accessed end, it needs to obtain the accessed physical address through a certain mechanism; that is, the accessing end needs to send a physical address application request to the accessed end in order to obtain the access request from the accessed end. Get the accessed physical address. For example, if the interconnection bus between the accessing end and the accessed end is a PCIe bus, it can obtain the physical address corresponding to the physical address space to be accessed through the PCIe Address Translation Service (ATS) mechanism, or Other mechanisms similar to the ATS mechanism obtain the physical address corresponding to the physical address space to be accessed.
  • ATS PCIe Address Translation Service
  • the translation request sent by the accessing end to the accessed end carries the global identity number of the accessed end, and the global identity number of the accessed end is used to identify the identity of the accessing end.
  • the identity number is used to identify the second device
  • the translation request sent by the accessing end to the accessed end carries the global identity number of the accessing end
  • the global identity number of the accessing end is used to identify the identity of the accessing end.
  • Figure 6 takes the ATS mechanism under the PCIe bus as an example.
  • the translation request sent by the accessing end to the accessed end is a specific example of a physical address application request.
  • the accessed end generates a key (key_x) for the accessing end and calculates the Message Authentication Code (MAC).
  • key_x a key for the accessing end
  • MAC Message Authentication Code
  • the accessed end needs to provide a key for this access after receiving the translation request from the accessing end.
  • end-derived key the accessed end derives the key based on the global identity number of the accessing end or the accessed end carried in the translation request; for example, the accessed end locally stores the root key (RotKey), and when the accessing end applies for a physical address, the accessed end The end generates a first key based on the root key for the global identity number of the access end or the accessed end.
  • the key derivation strategy can be implemented using the following algorithm:
  • key_x fun1_RotKey (global identity number, monotonically increasing parameter);
  • fun1 represents the derivation calculation function, which can be a standard key derivation function such as Halting Key Derivation Functions (HKDF); RotKey is the root key of the derivation calculation; the monotonically increasing parameter can be Is the counter value or system time.
  • HKDF Halting Key Derivation Functions
  • RotKey is the root key of the derivation calculation
  • the monotonically increasing parameter can be Is the counter value or system time.
  • the visited end also performs cryptographic security mathematical calculations at a certain granularity on the physical address space that the accessing end is allowed to access, such as a sufficiently secure symmetric block encryption (AES-CMAC) algorithm.
  • AES-CMAC symmetric block encryption
  • the accessed end will determine the granularity of its physical address space for the accessing end, the high bits of the physical address aligned based on the granularity of the physical address space (that is, the high bits of the physical address), and each physical address in the physical address space.
  • the permission value A corresponding to the space segment, where the granularity of the physical address space can be the encoding value of this granularity.
  • Any permission value A is used to represent the first access of the access end to the physical address space segment corresponding to the permission value A.
  • any permission value A can be the coded value of the first access permission corresponding to the physical address space segment; and cryptographic security mathematical calculations are also performed based on the first key to obtain the corresponding security check value.
  • fun2 represents the digest calculation function, which can be a standard digest calculation function such as Secure Hash Algorithm (SHA) 2; key_x is the key, such as the first key, and the key is required for the calculation of fun2 As an operator; range_x represents the granularity of the physical address space, range_x can be a coded value; pa_align represents the high bits of the physical address aligned based on the granularity of the physical address space; pert_x represents the permission value A corresponding to a certain physical address space segment, pert_x Can be an encoded value.
  • SHA Secure Hash Algorithm
  • the accessed end can also establish a lightweight area table of the physical address space based on the global identity number of the accessing end or the accessed end.
  • Each entry in the area table only requires a few bits, and each entry uses To store the second access permission of the physical address space segment represented by the corresponding area number.
  • This area table is a continuous and span-controllable lightweight table, and each entry in the area table can be continuously allocated and used. Specific physical address binding, so as not to cause the situation where the entries in the area table may be wanted to be used, but cannot be used because the physical address space is very discrete. In this application, you can choose to create or not create this area table.
  • the physical address space opened by the accessed end to the accessing end includes N physical address space segments: physical address space segment PA0, physical address space segment PA1, physical address space segment PA2 and physical address space segment PA3, and
  • the area table includes: physical address space segment PA0, physical address space segment PA1, physical address space segment PA2 and physical address space segment PA3; physical address space segment PA0, physical address space segment PA1, physical address space segment PA2 and physical address space
  • the index number (range index) corresponding to segment PA3 is 0-3 in order; the permission value B corresponding to physical address space segment PA0, physical address space segment PA1, physical address space segment PA2 and physical address space segment PA3, among which any one Permission value B is used to indicate the second access permission of the corresponding physical address space segment.
  • range index represents the corresponding index number of the physical address space segment in the area table established by the accessed end; the meanings of other parameters are as described above.
  • the accessed end can use the same method to calculate the corresponding MAC respectively.
  • the area table in Figure 6 is optionally implemented in this application, and the entries of the corresponding table optionally store or do not store the permission value B of a certain physical address space segment.
  • the security check value calculated in Figure 6 is MAC; those skilled in the art should understand that the security check value in this application can be not only MAC, but also other values.
  • the visited end sends a translation response (Translation Response) to the accessing end.
  • Figure 6 takes the ATS mechanism under the PCIe bus as an example.
  • the translation response sent by the accessed end to the accessing end is a specific example of the first response to the physical address application request.
  • the translation response includes: the granularity of the physical address space opened by the accessed end to the accessing end, the physical address space segments opened by the accessed end to the accessing end (for example, physical address space segment PA0, physical address space segment PA1, physical address space segment PA2 and the physical address space segment PA3), the MAC corresponding to each physical address space segment opened by the accessed end to the accessing end (for example, the physical address space segment PA0, the physical address space segment PA1, the physical address space segment PA2, and the physical address space segment PA3.
  • the translation response also includes the index number corresponding to the physical address space segment (for example, the physical address space segment The index numbers corresponding to PA0, physical address space segment PA1, physical address space segment PA2 and physical address space segment PA3: 0-3).
  • the accessing end actively initiates a physical address application request to the accessed end.
  • the accessed end can also actively synchronize the translation response in Figure 6 to the accessing end. end (such as the traditional address translation mode under NVLink), the access end does not need to actively issue a translation request, and this is not limited to this.
  • the accessing end sends an access request (Access Request) to the accessed end.
  • the accessing end sends a first access request to the accessed end.
  • the first physical address space segment used by the first access request to request access is the physical address space segment PA0;
  • the first access request includes: the global identity of the accessing end or the accessed end. number, the first security check value (the MAC corresponding to the physical address space segment PA0), the first physical address (a physical address in the physical address space segment PA0), and the granularity of the physical address space opened by the accessed end to the accessing end;
  • the first access request also includes a first index number (index number 0 corresponding to the physical address space segment PA0 in the area table established by the accessed end).
  • the visited end performs security verification.
  • the security verification process is different depending on whether the access request carries the index number of the area table. The details are as follows:
  • Type 1 The access request does not carry the index number of the area table.
  • Index to the key based on the global identity number carried in the access request; obtain the high bits of the aligned physical address (pa_align) based on the granularity (range_x) and physical address of the physical address space carried in the access request, and obtain the access request
  • the permission value A (pert_x) corresponding to the physical address space segment to be accessed; then use ⁇ range_x, pa_align, pert_x ⁇ as input parameters to perform password security mathematical calculations based on key_x, and obtain MAC_x1 and MAC_x2.
  • pert_x includes pert_x1 and pert_x2.
  • pert_x1 and pert_x2 are the two cases of the permission value A corresponding to the access request obtained according to the type of the access request.
  • the second permission represented by pert_x1 is read-only and read-write.
  • the second permissions represented by pert_x2 are write-only and read-write.
  • the access request can also carry pert_x1 and pert_x2, so that the accessed end does not need to calculate pert_x1 and pert_x2.
  • the corresponding security check values such as pert_x1 and pert_x2, are calculated, which brings benefits
  • the effects include: access requests do not need to carry permissions, reducing the message overhead of access requests; the accessed end does not need to check permissions before starting calculations, reducing verification delays. It should be understood that the specific implementation can be implemented flexibly and is not limited to the situation described here.
  • MAC_x1 and MAC_x2 there are two values obtained by the accessed end through password security mathematical calculations, namely MAC_x1 and MAC_x2, and MAC_x1 and MAC_x2 respectively correspond to the two possible values of pert_x.
  • the accessed end uses the locally calculated MAC_x1 and MAC_x2.
  • MAC_x2 is verified with the MAC carried in the access request. If any one of them is verified successfully with the MAC carried in the access request, the verification passes and access is allowed; otherwise, the verification fails and access is blocked. It should be understood that verifying two MACs means comparing two MACs. If the two MACs are equal, it means that the comparison is successful, that is, the verification is successful.
  • the first key is indexed according to the global identity number of the accessing end or the global identity number of the accessed end; according to a physical address in the physical address space segment PA0 and the accessed end open to the accessing end.
  • the granularity of the physical address space determines the high bit of the physical address in the physical address space segment PA0, and the permission value A of the physical address space segment PA0; according to the granularity of the physical address space opened by the accessed end to the accessing end, the physical address space segment
  • the high bits of the physical address in PA0 and the permission value A of the physical address space segment PA0 are calculated based on the first key to obtain the second security check value.
  • write MAC_x1, and MAC_x2 corresponding to write-only and read-write; verify the MAC corresponding to the physical address space segment PA0 carried in the first access request with MAC_x1 and MAC_x2 respectively, as long as one of MAC_x1 and MAC_x2 is consistent with the first If the MAC corresponding to the physical address space segment PA0 carried in the access request is successfully verified, the verification is considered successful and the accessing end is allowed to access the physical address space segment PA0.
  • the access request carries the index number of the area table.
  • index to the key based on the global identity number carried in the access request; obtain the high bits of the aligned physical address (pa_align) based on the granularity (range_x) and physical address of the physical address space carried in the access request, and Obtain the permission value A (pert_x) corresponding to the physical address space segment to be accessed by the access request; then perform password security mathematical calculation based on key_x with ⁇ range_x, pa_align, pert_x, range index ⁇ as input parameters, and obtain MAC_x1 and MAC_x2.
  • MAC_x1 and MAC_x2 are calculated as follows:
  • MAC_x1 fun2_key_x(range_x,pa_align,pert_x1,range index);
  • MAC_x2 fun2_key_x(range_x,pa_align,pert_x2,range index);
  • the range index in the input parameter is the index number carried by the access request; the description of other input parameters is the same as the case where the access request does not carry the index number of the region table.
  • the visited end uses the locally calculated MAC_x1 and MAC_x2 to verify with the MAC carried in the access request. If any of them fails to verify with the MAC carried in the access request, the verification fails and the access is blocked; otherwise, proceed to the next step of verification. test.
  • Access to the local memory space is only allowed if and only if the MAC carried in the access request and the MAC calculated locally by the accessed end are successfully verified, and the permission value B indexed based on the index number carried in the access request is allowed to access; otherwise, it is not allowed. Access local memory space.
  • the first key is indexed according to the global identity number of the accessing end; it is determined based on a physical address in the physical address space segment PA0 and the granularity of the physical address space opened by the accessed end to the accessing end.
  • the high bits, the permission value A of the physical address space segment PA0, and the index number 0 carried in the first access request are calculated based on the first key to obtain the second security check value.
  • second security check values corresponding to Read-only and read-write MAC_x1, and corresponding write-only and read-write MAC_x2; verify the MAC corresponding to the physical address space segment PA0 carried in the first access request with MAC_x1 and MAC_x2 respectively; in addition, based on the first access request
  • the index number 0 carried is indexed in the area table; when one of MAC_x1 and MAC_x2 is successfully verified with the MAC corresponding to the physical address space segment PA0 carried in the first access request, and the permission value B indexed by index number 0 is When access is allowed, the verification is considered successful and the access end is allowed to access the physical address space segment PA0.
  • the first type no area table.
  • Figure 7 is a flow diagram of a possible implementation example of an invalid physical address space segment in the embodiment shown in Figure 5; it should be understood that the process of the invalid physical address space segment shown in Figure 7 can also be It is executed based on the embodiment shown in Figure 6; the process of invalid physical address space segments shown in Figure 7 includes but is not limited to the following steps or operations:
  • the system software has an invalid physical address space segment based on a certain global identity number, and the accessed end sends an invalid command to the accessing end.
  • the system software on the accessed end needs to invalidate one or more page tables under a certain global identity number so that the corresponding physical address space segment can be reclaimed and other subsequent actions can be taken.
  • the physical address segment opened by the accessed end to the accessing end corresponding to a certain global identity number includes physical address space segment PA0, physical address space segment PA1 and physical address space segment PA2.
  • the system software needs to recycle the global identity number.
  • the first key derived by the key management module for the global identity number is the key _0(key_0). If the physical address space segment PA0 is to be invalidated, the system software will use the key management module to re-derive a new key for the global identity number, that is, the second key.
  • the second key is key_1 (key_1) ;At the same time, key_0 can only be used for verification.
  • the local PAAPC module of the visited end marks that the old key_0 can only be used for verification and is no longer used to calculate MAC.
  • the system software will use the PAAPC module to send an invalidation command to the access terminal corresponding to the global identity number. This invalidation command will inform the access terminal to invalidate the address mapping of its locally cached physical address space segment PA0.
  • the access terminal may stop sending access requests to the invalidated physical address segment.
  • the access end After the access end receives the invalid command, it will parse the invalid command to learn the corresponding address mapping relationship of the invalid local storage, and will no longer send access requests to the invalid physical address segment; for example, the access end informs the access end Invalid physical address space segment PA0, the accessing end will no longer send access requests to the physical address space segment PA0 to the accessed end.
  • the invalid command response returned by the accessing end to the accessed end must be in order with all previous access requests to the invalidated physical address space segment (such as physical address space segment PA0), so that the returned invalidation can be achieved
  • the command response can drain all access requests to this invalidated physical address space segment (for example, physical address space segment PA0) on the interconnection bus between the accessing end and the accessed end.
  • the accessing end sends a MAC acquisition request to the accessed end.
  • the accessing end obtains a new MAC corresponding to the physical address space segment PA1 by sending a MAC acquisition request to the accessed end; where the MAC acquisition request includes: a global identity number, one of the physical addresses of the physical address space segment PA1 (such as base address), the granularity of the physical address space (range_x), and the old MAC corresponding to the physical address space segment PA1.
  • the MAC acquisition request includes: a global identity number, one of the physical addresses of the physical address space segment PA1 (such as base address), the granularity of the physical address space (range_x), and the old MAC corresponding to the physical address space segment PA1.
  • the accessing end sends a MAC acquisition request to the accessed end to acquire a new MAC corresponding to the physical address space segment PA2; where the MAC acquisition request includes: a global identity number, one of the physical addresses of the physical address space segment PA2 ( For example, base address), the granularity of the physical address space (range_x), and the old MAC corresponding to the physical address space segment PA2.
  • the MAC acquisition request includes: a global identity number, one of the physical addresses of the physical address space segment PA2 ( For example, base address), the granularity of the physical address space (range_x), and the old MAC corresponding to the physical address space segment PA2.
  • the accessing end sends an access request carrying the old MAC to the accessed end.
  • the accessing end can continue to initiate access requests; however, at this time, the accessing end can optionally pause or appropriately reduce the amount of access to the corresponding data stream to reduce the traffic on the accessed end. calculated pressure.
  • the accessing end For example, for access to the physical address space segment PA1, the accessing end sends an access request carrying the old MAC corresponding to the physical address space segment PA1 to the accessed end; for physical address space segment PA2, the accessing end can also send an access request carrying the old MAC corresponding to the physical address space segment PA2 to the accessed end. The access request of the old MAC corresponding to the physical address space segment PA2.
  • the access request carrying the old MAC also carries: the global identity number, the physical address that needs to be accessed, the granularity of the physical address space, and the old MAC corresponding to the physical address space segment where the physical address that needs to be accessed is located.
  • an access request for accessing physical address space segment PA1 carries: a global identity number, one of the physical addresses of physical address space segment PA1, the granularity of the physical address space, and the old MAC corresponding to physical address space segment PA1.
  • the access request for accessing the physical address space segment PA2 carries: the global identity number, one of the physical addresses of the physical address space segment PA2, the granularity of the physical address space, and the old MAC corresponding to the physical address space segment PA2.
  • the accessed end may receive requests from the accessing end, including: (1) MAC acquisition request; (2) Access request carrying old MAC.
  • requests including: (1) MAC acquisition request; (2) Access request carrying old MAC.
  • the accessed end may receive a message from the accessing end. Requests also include access requests carrying the old MAC. Therefore, before the accessing end returns a response to an invalid command, or before the local invalid command of the accessed end has timed out, the accessed end must at least be able to perform the following steps or operations:
  • the visited end returns the new MAC to the accessing end.
  • the accessed end after receiving the MAC acquisition request from the accessing end, for any physical address space segment that needs to reacquire the corresponding MAC: the accessed end first targets the physical address based on the old key based on the information carried in the MAC acquisition request. The space segment is calculated to obtain MAC_0, and then the MAC_0 calculated for the physical address space segment is verified with the MAC corresponding to the physical address space segment carried in the MAC acquisition request; and, the visited end determines whether the physical address space segment is required Invalidated; only if the aforementioned check passes and the physical address space segment is not to be invalidated, the visited end will calculate a new MAC for the physical address space segment based on the new key and return the new MAC to access side.
  • the MAC acquisition request includes: the global identity number, one of the physical addresses of the physical address space segment PA1, the granularity of the physical address space, the old MAC corresponding to the physical address space segment PA1; the visited end First, index to key_0 based on the global identity number carried in the MAC acquisition request, and then calculate it based on one of the physical addresses of the physical address space segment PA1 and the granularity of the physical address space based on key_0 for the physical address space segment PA1.
  • MAC_0 and then verify the MAC_0 calculated for the physical address space segment PA1 and the old MAC corresponding to the physical address space segment PA1 carried in the MAC acquisition request; if MAC_0 is calculated for the physical address space segment PA1 and the old MAC carried in the MAC acquisition request The old MAC corresponding to the physical address space segment PA1 is equal, and the accessed end determines that the physical address space segment PA1 is not to be invalidated, then the accessed end determines according to one of the physical addresses of the physical address space segment PA1, the particle of the physical address space Calculate the new MAC corresponding to the physical address space segment PA1 based on the key_1, and return the new MAC corresponding to the physical address space segment PA1 to the access end.
  • the MAC acquisition request includes: the global identity number, one of the physical addresses of the physical address space segment PA2, the granularity of the physical address space, and the old MAC corresponding to the physical address space segment PA2; accessed The end first indexes to key_0 based on the global identity number carried in the MAC acquisition request, and then calculates the physical address space segment PA2 based on one of the physical addresses of the physical address space segment PA2 and the granularity of the physical address space based on key_0.
  • MAC_0 Obtain MAC_0, and then verify the MAC_0 calculated for the physical address space segment PA2 and the old MAC corresponding to the physical address space segment PA2 carried in the MAC acquisition request; if the MAC_0 calculated for the physical address space segment PA2 and the MAC acquisition request The old MAC corresponding to the physical address space segment PA2 carried is equal, and the accessed end determines that the physical address space segment PA2 is not to be invalidated, then the accessed end bases one of the physical addresses and physical address spaces of the physical address space segment PA2 on The granularity is based on key_1 to calculate the new MAC corresponding to the physical address space segment PA2, and return the new MAC corresponding to the physical address space segment PA2 to the access end.
  • the accessed end determines the access permission corresponding to the received access request based on the old MAC and new MAC.
  • the access request received (that is, the second access request) is selected based on the old and new ones.
  • the keys perform access permission verification on the access request respectively, that is, the MAC is calculated separately based on the old and new keys. As long as the MAC calculated based on either of the old and new keys passes the verification of the MAC carried in the access request. , then the access request is allowed.
  • an access request for accessing physical address space segment PA1 carries: a global identity number, one of the physical addresses of physical address space segment PA1, the granularity of the physical address space, and the old or new MAC corresponding to physical address space segment PA1.
  • MAC; MAC_0 is calculated for the physical address space segment PA1 based on key_0 based on one of the physical addresses of the physical address space segment PA1 and the granularity of the physical address space, and MAC_0 is calculated based on one of the physical addresses and physical addresses of the physical address space segment PA1.
  • the granularity of space is MAC_1 calculated for physical address space segment PA1 based on key_1; as long as MAC_0 is calculated for physical address space segment PA1 based on key_0 and MAC_0 is calculated for physical address space segment PA1 based on key_1 If any one of MAC_1 and the MAC carried in the access request (the old MAC or the new MAC corresponding to the physical address space segment PA1) pass the verification, access to the physical address space segment PA1 is allowed.
  • the access request for accessing the physical address space segment PA2 carries: the global identity number, one of the physical addresses of the physical address space segment PA2, the granularity of the physical address space, and the old or new MAC corresponding to the physical address space segment PA2.
  • MAC; MAC_0 is calculated for the physical address space segment PA2 based on the key_0 based on one of the physical addresses of the physical address space segment PA2 and the granularity of the physical address space, and MAC_0 is calculated based on one of the physical addresses and physical addresses of the physical address space segment PA2.
  • the granularity of the address space is that MAC_1 is calculated for the physical address space segment PA2 based on key_1; as long as MAC_0 is calculated for the physical address space segment PA2 based on key_0 and MAC_0 is calculated for the physical address space segment PA2 based on key_1 If any one of MAC_1 and the MAC carried in the access request (the old MAC or the new MAC corresponding to the physical address space segment PA2) pass the verification, access to the physical address space segment PA2 is allowed.
  • the accessing end sends an invalid command response to the accessed end.
  • the accessing end Before the accessing end decides to return an invalid command response to the accessed end, it must ensure that it has obtained the corresponding new MAC for the physical address space segments that have not been invalidated and will continue to be accessed in the future. Afterwards, the accessing end can return an invalid command response to the accessed end.
  • the physical address space segment PA1 and the physical address space segment PA2 do not need to be invalid.
  • the subsequent access end will also access the physical address space segment PA1 and the physical address space segment PA2; then, the access end obtains the physical address space segment PA1 and the physical address space segment PA2.
  • the accessing end After the new MAC corresponding to the address space segment PA2 is obtained, the accessing end returns an invalid command response to the accessed end.
  • the accessed end after receiving a response to an invalid command from the accessing end, the accessed end needs to preserve the order: ensure that the response message of the invalid command can drain all the previous response messages of the invalid command that need to preserve the order. .
  • the visited end turns off the verification function of the old key (for example, key_0), and no longer uses the old key to perform cryptographic security mathematical calculation verification for any physical address security protection operations, and reports Response to invalid command to system software.
  • the accessed end can directly turn off the verification of the old key (for example, key_0) Function, the old key is no longer used for password security mathematical calculation verification of any physical address security protection operations.
  • the accessed end may not time out the invalid command, and only wait until it receives a response to the invalid command from the accessing end before turning off the old key verification function and reporting the invalid command response to the system software. Afterwards, the system software can reclaim the corresponding physical address space segment, such as physical address space segment PA0.
  • the accessed end After the invalid command times out and before receiving a response to the invalid command from the accessing end, the accessed end sends a retry request to the accessing end for the received access request carrying the old MAC; for the received access request carrying the new MAC For MAC access requests, the accessed end performs security verification normally.
  • the old key has been closed and only the new key is opened.
  • the access request carries an old MAC
  • the security check calculated based on the new key cannot pass, so the accessed end returns a retry request to the accessing end.
  • the retry request is optional, and the accessed end can also directly block this access without returning a retry request to the accessing end.
  • the access request carries a new MAC
  • the security check calculated based on the new key can pass.
  • key_0 has been turned off, and only key_1 is turned on; for access to any one of the physical address space segment PA0, the physical address space segment PA1, and the physical address space segment PA2, if the access The request carries the old MAC.
  • the accessed end calculates MAC_1 based on key_1. If MAC_1 is not equal to the old MAC carried in the access request, access is not allowed and the accessed end sends a retry request to the accessing end. .
  • the visited end calculates MAC_1 based on key_1, and MAC_1 and the access request carry If the new MAC is equal, access is allowed.
  • the old key is closed. If the access end still issues an access request to access the invalidated physical address space segment (for example, physical address space segment PA0), it will carry the old key. MAC; At this time, the accessed end calculates MAC_1 based on the new key (such as key_1), and then uses this MAC_1 and the old MAC to verify, and the verification will fail, thus preventing this visits. Similarly, even if the accessing end issues an access request to access a physical address space segment that has not been invalidated (such as physical address space segment PA1 or physical address space segment PA2), it carries the old MAC and the verification will not pass, so the access will fail. prohibited.
  • a physical address space segment that has not been invalidated such as physical address space segment PA1 or physical address space segment PA2
  • the access request issued by the accessing end is a physical address space segment that has not been invalidated (such as physical address space segment PA1 or physical address space segment PA2), it carries a new MAC.
  • the accessed end is based on the new key. (for example, key_1) to calculate MAC_1, and then use this MAC_1 and the new MAC carried for verification. After the verification passes, the access request is allowed to access the physical address space segment that has not been invalidated.
  • MAC_0 shown in Figure 7 includes MAC_x1_0 and MAC_x2_0.
  • MAC_x1_0 corresponds to read-only and read-write
  • MAC_x2_0 corresponds to write-only and read-write.
  • MAC_1 shown in Figure 7 includes MAC_x1_1 and MAC_x2_1, MAC_x1_1 corresponds to read-only and read-write, MAC_x2_1 corresponds to write-only and read-write, if any one of them is verified successfully with the MAC sent by the access terminal, It means that the verification passes; for a specific description, please refer to the description of the embodiment shown in FIG. 6 .
  • Second type There is a regional table.
  • Figure 8 is a flow diagram of another possible implementation example of an invalid physical address space segment in the embodiment shown in Figure 5; it should be understood that the process of an invalid physical address space segment shown in Figure 8 can also be It is executed based on the embodiment shown in Figure 6; the process of invalid physical address space segments shown in Figure 8 includes but is not limited to the following steps or operations:
  • the system software has an invalid physical address space segment based on a certain global identity number, and the accessed end sends an invalid command to the accessing end.
  • the system software on the accessed end needs to invalidate one or more page tables under a certain global identity number so that the corresponding physical address space segment can be reclaimed and other subsequent actions can be taken.
  • the accessed end can even choose to first send an invalidation command to notify the accessing end that the physical address space segment is invalid, and then modify the permission value B of the corresponding entry in the local area table after a certain period of time, and then notify the system software that the invalidation has occurred. Complete; further optionally, the system software can control whether the accessed end has time to wait and the size of the waiting time.
  • the accessed end may choose to also issue an invalid command to notify the accessing end, informing it of the invalid address mapping content, and informing it that there is no need to reissue a request to obtain a new security check value (such as MAC).
  • a new security check value such as MAC
  • the accessed end notifies the accessing end of the address mapping of the invalid physical address space segment PA0 by sending an invalidation command to the accessing end.
  • the access terminal may stop sending access requests to the invalidated physical address segment.
  • the access end receives an invalid command of the invalid physical address space segment PA0 and the address mapping of the invalid physical address space segment PA0.
  • the accessed end Before receiving the response to the invalid command, the accessed end receives the access request carrying the MAC from the accessing end.
  • the accessing end after receiving the invalid command, if the accessing end continues to issue an access request to access the invalidated physical address space segment, the access request may still pass the verification because the accessed end has not been modified and invalidated.
  • the permission value B of the corresponding entry of the physical address space segment in the area table needs to wait until the accessing end returns a response to the invalid command or the invalid command times out, then the accessed end will modify the invalid physical address space segment in the area table.
  • the entry's permission value is B.
  • the access to the invalidated physical address space segment issued by the accessing end can still be verified by the accessed end, and the accessing end is allowed to access the invalidated physical address space segment.
  • the access request carries: the global identity number, the physical address that needs to be accessed, the granularity of the physical address space, the MAC corresponding to the physical address space segment where the physical address that needs to be accessed is located, and the corresponding index number of the physical address space segment in the area table. .
  • the accessed end receives an access request from the accessing end to access the physical address space segment PA0.
  • the access request includes: a global identity number, one of the physical addresses in the physical address space segment PA0, the granularity of the physical address space, and the physical address space.
  • the MAC corresponding to the segment PA0, and the corresponding index number of the physical address space segment PA0 in the area table that is, the first index number, where the index number corresponding to the physical address space segment PA0 is 1.
  • the accessed end indexes to key_0 according to the global identity number, according to one of the physical addresses of the physical address space segment PA0, the granularity of the physical address space, and the physical address space segment PA0 in the area table
  • the corresponding index numbers are calculated based on key_0 for the physical address space segment PA1 to obtain MAC_x1_0 and MAC_x2_0.
  • MAC_x1_0 corresponds to read-only and read-write
  • MAC_x2_0 corresponds to write-only and read-write.
  • the visited end also indexes the permission corresponding to the physical address space segment PA0 in the area table according to the index number corresponding to the physical address space segment PA0 carried in the access request. value B, and determine whether the permission value B corresponding to the physical address space segment PA0 matches, that is, determine whether the permission value B corresponding to the physical address space segment PA0 allows access.
  • the accessed end received a response to an invalid command from the accessing end.
  • the accessing end after completing the invalidation of the address mapping of the invalid physical address segment, the accessing end will send a response to the invalid command to the accessed end; after receiving the response to the invalid command, the accessed end modifies the invalid physical address space segment.
  • the physical address space segment PA0 is invalidated.
  • the accessed end modifies the permission value B of the corresponding entry of the physical address space segment PA0 in the area table, or directly deletes the physical address space in the area table.
  • the entry corresponding to segment PA0 is invalidated.
  • the accessed end After receiving the response to the invalid command, the accessed end receives the access request carrying the MAC from the accessing end.
  • the access request for an access request carrying a MAC received after receiving a response to an invalid command, if the access request requests access to an invalid physical address segment, even if the MAC carried in the access request can pass the verification, it has been modified. If the permission value B of the entry corresponding to the invalidated physical address space segment in the area table is deleted, or the entry corresponding to the invalidated physical address space segment in the area table is deleted, the access request is not allowed to access the invalidated physical address segment. , thereby preventing the accessing end from accessing the physical address space segment PA0 and protecting the security of the accessed end's physical address space; if the access request requests access to a physical address segment that has not been invalidated, the access request can proceed normally.
  • the accessed end receives an access request to access the physical address space segment PA0.
  • the access request includes: a global identity number, one of the following in the physical address space segment PA0 A physical address, the granularity of the physical address space, the MAC corresponding to the physical address space segment PA0, and the corresponding index number of the physical address space segment PA0 in the area table.
  • the accessed end indexes to key_0 according to the global identity number, according to one of the physical addresses of the physical address space segment PA0, the granularity of the physical address space, and the physical address space segment PA0 in the area table
  • the corresponding index numbers are calculated based on key_0 for the physical address space segment PA1 to obtain MAC_x1_0 and MAC_x2_0; and the visited end also indexes the physical address in the area table based on the index number corresponding to the physical address space segment PA0 carried in the access request.
  • Permission value B corresponding to space segment PA0.
  • the accessed end may receive an access request to access the physical address space segment PA1.
  • the access request includes: a global identity number, and one of the physical addresses in the physical address space segment PA1. , the granularity of the physical address space, the MAC corresponding to the physical address space segment PA1, the corresponding index number of the physical address space segment PA1 in the area table; after receiving the access request, the accessed end indexes the key according to the global identity number _0, based on one of the physical addresses of the physical address space segment PA1, the granularity of the physical address space, and the corresponding index number of the physical address space segment PA1 in the area table, MAC_x1_0 and MAC_x1_0 are calculated for the physical address space segment PA1 based on the key _0 MAC_x2_0; Moreover, the visited end also indexes the permission value B corresponding to the physical address space segment PA1 in the area table according to the index number corresponding to the physical address space
  • the access terminal shown in Figure 8 and the accessed end are the second device and the first device respectively.
  • Figure 9 is a schematic structural diagram of a memory access device provided by an embodiment of the present application.
  • the memory access device 900 is applied to the first device.
  • the memory access device 900 includes a processing unit 901 and a communication unit 902;
  • the communication unit 902 is configured to receive a first access request from a second device, where the first access request includes an identity number, a first security check value and first information, where the first information includes a first physical address;
  • the processing unit 901 is configured to calculate a second security check value based on the identity number and the first information; and determine the second security check value based on the first security check value and the second security check value.
  • the identity number is used to identify the first device, or the identity number is used to identify the second device.
  • the communication unit 902 before receiving the first access request from the second device, is further configured to: receive a physical address application request from the second device, the physical address The application request includes the identity number; the processing unit 901 is also used to: generate a first key for the identity number; the communication unit 902 is also used to: send the physical address application request to the second device
  • the first response includes the first security check value and the first information, and the first security check value is calculated based on the first key.
  • the processing unit 901 is specifically configured to index a first key according to the identity number, and calculate the second security check value according to the first key and the first information.
  • the first information further includes a first permission value, and the first permission value is used to represent the first access permission of the second device to the first physical address.
  • the first information also includes the granularity of the physical address space.
  • the granularity of the physical address space is used to characterize the range size of the physical address space.
  • the physical address space includes the First physical address.
  • the physical address space includes a first physical address space segment, and the first physical address space segment includes the first physical address.
  • the first permission value is also used to represent the first access permission of the second device to the first physical address space segment.
  • the processing unit 901 is specifically configured to: index the first key according to the identity number; if the first information includes a first permission value, index the first key according to the first physical address and the physical address
  • the granularity of the space determines the high bits of the first physical address; if the first information does not include the first permission value, the first physical address is determined based on the first physical address and the granularity of the physical address space.
  • the high bits of the first permission value and the first permission value; the second security calibration is calculated based on the granularity of the physical address space, the high bits of the first physical address, the first permission value and the first key. test value.
  • the processing unit 901 is specifically configured to: verify the first security check value and the second security check value; if the first security check value and If the second security check value is verified successfully, it is determined that the access permission of the second device to the first physical address is allowed access.
  • the first security check value and the second security check value are calculated based on the first key; the processing unit 901 is also used to: for the identity number Generate a second key; the communication unit 902 is also used to: send an invalidation command to the second device, the invalidation command being used to invalidate the first physical address or the first physical address space segment; the processing unit 901 is also configured to: replace the first key with the second key after receiving a response to the invalid command from the second device or after the invalid command times out.
  • the communication unit 902 is further configured to: receive A request for obtaining a security check value from the second device.
  • the request for obtaining a security check value includes the identity number, a third security check value and second information.
  • the third security check value is based on the
  • the second information is obtained by calculating the first key, and the second information includes a second physical address; the processing unit 901 is also configured to: calculate the second information based on the identity number, the second information and the first key.
  • the communication unit 902 is also used to: if the third security check value and the fourth security check value are If the fourth security check value is verified successfully, a second response of the security check value acquisition request is sent to the second device, where the second response includes a fifth security check value, and the fifth security check value is The verification value is calculated based on the second key.
  • the second information further includes a second permission value, and the second permission value is used to represent the first access permission of the second device to the second physical address.
  • the second information also includes the granularity of the physical address space.
  • the granularity of the physical address space is used to characterize the range size of the physical address space.
  • the physical address space includes the Second physical address.
  • the physical address space includes a second physical address space segment, and the second physical address space segment includes the second physical address.
  • the second permission value is also used to represent the first access permission of the second device to the second physical address space segment.
  • the communication unit 902 is further configured to: receive a second access request from the second device, the second access request including the identity number, a sixth security check value and third information, the third information including a third physical address; the processing unit 901 is also used to: calculate a seventh security check value based on the identity number, the third information and the first key, and calculate a seventh security check value based on the identity number, the third information and the second password.
  • the eighth security check value is obtained by key calculation; and the sixth security check value is verified with the seventh security check value and the eighth security check value respectively; and if the sixth security check value If the check value and the seventh security check value are successfully verified, or if the sixth security check value and the eighth security check value are successfully verified, it is determined that the second device is correct for the third security check value.
  • the access permission of the physical address is allowed.
  • the third information further includes a third permission value, and the third permission value is used to represent the first access permission of the second device to the third physical address.
  • the third information also includes the granularity of the physical address space.
  • the granularity of the physical address space is used to characterize the range size of the physical address space.
  • the physical address space includes the Third physical address.
  • the physical address space includes a third physical address space segment, and the third physical address space segment includes the third physical address.
  • the third permission value is also used to represent the first access permission of the second device to the third physical address space segment.
  • the first device includes an area table, the area table includes a first index number and a fourth authority value, the first index number corresponds to the fourth authority value, and the The fourth permission value is used to represent the second access permission of the first physical address or the first physical address space segment; the first information also includes the first index number.
  • the processing unit 901 is specifically configured to: index the first key according to the identity number; if the first information includes a first permission value, index the first key according to the first physical address and the physical address
  • the granularity of the space determines the high bits of the first physical address; if the first information does not include the first permission value, the first physical address is determined based on the first physical address and the granularity of the physical address space.
  • the high bits of and the first permission value calculated based on the granularity of the physical address space, the high bits of the first physical address, the first permission value, the first index number and the first key Obtain the second security check value.
  • the processing unit 901 is specifically configured to: verify the first security check value and the second security check value; if the first security check value and If the second security check value is verified successfully, and the second access permission represented by the fourth permission value is allowed access, it is determined that the access permission of the second device to the first physical address is allowed access. .
  • the processing unit 901 is further configured to modify the fourth permission value in the area table to a fifth permission value.
  • the memory access device 900 may also include a storage unit 903 for storing program codes and data of the memory access device 900 .
  • the processing unit 901 may be a processor
  • the communication unit 902 may be a transceiver
  • the storage unit 903 may be a memory (eg RAM, ROM).
  • each unit of the memory access device 900 can also refer to the corresponding description of the embodiment shown in FIGS. 1 to 8 , and the beneficial effects brought by the memory access device 900 can also refer to the descriptions in FIGS. 1 to 8 The corresponding descriptions of the embodiments shown are not repeated here.
  • Figure 10 is a schematic structural diagram of a memory access device provided by an embodiment of the present application.
  • the memory access device 1000 is applied to a second device.
  • the memory access device 1000 includes a processing unit 1001 and a communication unit 1002; Communication unit 1002, configured to send a first access request to the first device, the first access request including an identity number, a first security check value and first information, the first information including a first physical address; The identity number and the first information are used to calculate a second security check value; the first security check value and the second security check value are used to determine the second device's access to the first physical address. access permission.
  • the identity number is used to identify the first device, or the identity number is used to identify the second device.
  • the communication unit 1002 before sending the first access request to the first device, is further configured to: send a physical address application request to the first device, where the physical address application request including the identity number; and receiving a first response to the physical address application request from the first device, the first response including the first security check value and the first information, the first A security check value is calculated based on the first key generated for the identity number.
  • the first information further includes a first permission value, and the first permission value is used to represent the first access permission of the second device to the first physical address.
  • the first information also includes the granularity of the physical address space.
  • the granularity of the physical address space is used to characterize the range size of the physical address space.
  • the physical address space includes the First physical address.
  • the physical address space includes a first physical address space segment, and the first physical address space segment includes the first physical address.
  • the first permission value is also used to represent the first access permission of the second device to the first physical address space segment.
  • the communication unit 1002 is further configured to: receive an invalidation command from the first device, the invalidation command being used to invalidate the first physical address or the first physical address space segment; and sending a response to the invalid command to the first device.
  • the communication unit 1002 is further configured to: send a security check value acquisition request to the first device,
  • the security check value acquisition request includes the identity number, a third security check value and second information.
  • the third security check value is calculated based on the first key.
  • the second information includes a third security check value. two physical addresses; and receiving a second response of the security check value acquisition request from the first device, the second response including a fifth security check value, the fifth security check value is based on the Calculated from two keys, the second key is generated for the identity number.
  • the second information further includes a second permission value, and the second permission value is used to represent the first access permission of the second device to the second physical address.
  • the second information also includes the granularity of the physical address space.
  • the granularity of the physical address space is used to characterize the range size of the physical address space.
  • the physical address space includes the Second physical address.
  • the physical address space includes a second physical address space segment, and the second physical address space segment includes the second physical address.
  • the second permission value is also used to represent the first access permission of the second device to the second physical address space segment.
  • the communication unit 1002 is further configured to: send a second access request to the first device, the The second access request includes the identity number, the sixth security check value and third information, and the third information includes a third physical address.
  • the third information further includes a third permission value, and the third permission value is used to represent the first access permission of the second device to the third physical address.
  • the third information also includes the granularity of the physical address space.
  • the granularity of the physical address space is used to characterize the range size of the physical address space.
  • the physical address space includes the Third physical address.
  • the physical address space includes a third physical address space segment, and the third physical address space segment includes the third physical address.
  • the third permission value is also used to represent the first access permission of the second device to the third physical address space segment.
  • the first device includes an area table, the area table includes a first index number and a fourth authority value, the first index number corresponds to the fourth authority value, and the The fourth permission value is used to represent the second access permission of the first physical address or the first physical address space segment; the first information also includes the first index number.
  • the memory access device 1000 may also include a storage unit 1003 for storing program codes and data of the memory access device 1000 .
  • the processing unit 1001 may be a processor
  • the communication unit 1002 may be a transceiver
  • the storage unit 1003 may be a memory (eg RAM, ROM).
  • each unit of the memory access device 1000 can also refer to the corresponding description of the embodiment shown in FIGS. 1 to 8 , and the beneficial effects brought by the memory access device 1000 can also refer to the descriptions of the embodiments shown in FIGS. 1 to 8 The corresponding descriptions of the embodiments shown are not repeated here.
  • An embodiment of the present application also provides a memory access device, including a processor and a transmission interface.
  • the processor is configured to call a program stored in the memory, so that the memory access device implements the method in the above embodiment. .
  • Embodiments of the present application also provide a computer-readable storage medium.
  • the computer-readable storage medium includes a computer program. When the computer program is run on a computer or processor, it causes the computer or processor to perform As in the above embodiment.
  • An embodiment of the present application also provides a chip, including: a processor, configured to call and run a computer program from a memory, so that the device installed with the chip executes the method in the above embodiment.
  • Embodiments of the present application also provide a computer program product.
  • the computer program product includes a computer program. When the computer program is run on a computer or processor, it causes the computer or processor to perform the above embodiments. method in.
  • the size of the sequence numbers of the above-mentioned processes does not mean the order of execution.
  • the execution order of each process should be determined by its functions and internal logic, and should not be used in the embodiments of the present application.
  • the implementation process constitutes any limitation.
  • the disclosed systems, devices and methods can be implemented in other ways.
  • the device embodiments described above are only illustrative.
  • the division of the above units is only a logical function division. In actual implementation, there may be other division methods.
  • multiple units or components may be combined or may be Integrated into another system, or some features can be ignored, or not implemented.
  • the coupling or direct coupling or communication connection between each other shown or discussed may be through some interfaces, and the indirect coupling or communication connection of the devices or units may be in electrical, mechanical or other forms.
  • the units described above as separate components may or may not be physically separated.
  • the components shown as units may or may not be physical units, that is, they may be located in one place, or they may be distributed to multiple network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.
  • each functional unit in each embodiment of the present application can be integrated into one processing unit, each unit can exist physically alone, or two or more units can be integrated into one unit.
  • the above functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium.
  • the technical solution of the present application is essentially or the part that contributes to the existing technology or the part of the technical solution can be embodied in the form of a software product.
  • the computer software product is stored in a storage medium, including Several instructions are used to cause a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the above methods in various embodiments of the present application.
  • Modules in the device of the embodiment of the present application can be merged, divided, and deleted according to actual needs.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Storage Device Security (AREA)

Abstract

本申请提供了一种内存访问方法及相关设备，其中方法包括：第二装置向第一装置发送第一访问请求，所述第一访问请求包括身份号、第一安全校验值和第一信息，所述第一信息包括第一物理地址；第一装置接收来自第二装置的第一访问请求，以及根据所述身份号和所述第一信息计算得到第二安全校验值，以及根据所述第一安全校验值和所述第二安全校验值确定所述第二装置对所述第一物理地址的访问权限。采用本申请实施例，能够避免使用物理地址访问内存空间带来的安全风险。

Description

内存访问方法及相关设备
[根据细则91更正 11.04.2023]
本申请要求于2022年3月30日提交中国专利局、申请号为202210326125.8、申请名称为“内存访问方法及相关设备”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。本申请要求于2023年3月22日提交中国专利局、申请号为202310303459.8、申请名称为“内存访问方法及相关设备”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及存储技术领域，尤其涉及一种内存访问方法及相关设备。
 背景技术
一般情况下，在异构系统中，装置之间共享虚拟地址空间，装置之间使用虚拟地址访问彼此的内存空间。为了减少使用虚拟地址访问带来的地址翻译延时，在异构系统中，装置之间也可以直接使用物理地址(Physical Address，PA)访问彼此的内存空间；然而，装置之间直接使用物理地址访问彼此的内存空间，会带来安全风险。
发明内容
本申请实施例公开了一种内存访问方法及相关设备，能够避免使用物理地址访问内存空间带来的安全风险。
第一方面，本申请实施例提供了一种内存访问方法，应用于第一装置，所述方法包括：接收来自第二装置的第一访问请求，所述第一访问请求包括身份号、第一安全校验值和第一信息，所述第一信息包括第一物理地址；根据所述身份号和所述第一信息计算得到第二安全校验值；根据所述第一安全校验值和所述第二安全校验值确定所述第二装置对所述第一物理地址的访问权限。应理解，第一装置包括存储器，所述存储器的物理地址空间包括第一物理地址，第一物理地址与第一安全校验值对应；其中，第一安全校验值也是由第一装置基于和计算第二安全校验值一样的方法计算得到，并且由第一装置提前发送给第二装置的。需要说明的是，第一装置和第二装置通过互联总线连接。例如，第一装置或第二装置可以为以下其中一种：主机或主机侧CPU，主机侧加速器，通过IO接口与主机或主机侧CPU连接的节点设备；节点设备可以为：GPU、某处理器单元(XPU)、固态硬盘(SSD)、拥有特定计算功能的加速器、智能网卡、网络交换机等。进一步需要说明的是，第一装置和第二装置之间的通路是安全的，第一装置与第二装置在进行数据交互时，数据在交互过程中不会被篡改。例如，第一访问请求中携带的身份号、第一安全校验值和第一信息等不会被篡改。
在本申请实施例中，第二装置在需要访问第一装置中的第一物理地址时，第二装置会向第一装置发送第一访问请求，第一访问请求中携带身份号、第一安全校验值和第一信息，第一信息包括需要访问的第一物理地址；第一装置在接收到第一访问请求之后，从第一访问请求中获取到身份号、第一安全校验值和第一信息，然后根据身份号和第一信息计算得到第二安全校验值，再根据第一安全校验值和第二安全校验值来确定第二装置对第一物理地址有没有访问权限。应理解，根据第一安全校验值和第二安全校验值确定第二装置对第一物理地址的访问权限，可以理解为一种校验过程；在校验通过的情况下，允许第二装置访问第一物理地址；在校验不通过的情况下，阻止第二装置访问第一物理地址。如此，本申请在直接使用物理地址访问内存空间时，存在校验过程，能够保护被访问端(如第一装置)的物理地址空间的安全，至少包括以下方面：(1)保护物理地址空间的保密性，也即能够确保被访问端的物理地址空间不能被没有读权限的访问端(如第二装置)进行读；(2)保护物理地址空间的正确性，也即能够确保被访问端的物理地址空间不能被没有写权限的访问端进行写；(3)保护系统的稳健性，也即能够确保被访问端的物理地址空间不能被没有执行权限的访问端进行访问；(4)保护系统的隔离性，也即能够使得被访问端的物理地址空间不能被没有访问权限的访问端冒充有访问权限的访问端而进行访问。此外，相比于被访问端通过查表的方式来确定访问权限而言，本申请能够实现“以算代查”，节省了被访问端因为要安全校验而实现复杂的数据结构(例如页表那样的数据结构)所需的资源；并且，校验只需要(硬件化的)数学计算，不存在查表等硬件动作，因此能够减低安全校验的延时，实现快速校验，大大提高安全校验的效率。
在一种可能的实现方式中，所述身份号用于标识所述第一装置。当身份号用于标识第一装置时，也即是用于标识被访问端的身份，例如，该身份号为被访问目的资源(即对应第一装置)的全局唯一身份(ID)号(以下简称全局身份ID)。在本申请实施例中，被访问端的各个装置(包含第一装置在内)侧可存储有自身相关的上下文信息，当第一装置接收到访问请求后，可以利用该身份号作为输入索引查找到自身对应的上下文信息(比如后续的第一密钥)，并基于该上下文信息进一步确定用于验证第二装置访问权限的校验值(即第一安全校验值和第二安全校验值)。
在一种可能的实现方式中，所述身份号用于标识所述第二装置。当身份号用于标识第二装置时，也即是用于标识访问端的身份，例如，该身份号为基于IO设备/加速器发出的访问事务(即对应第二装置)的全局唯一身份(ID)号(以下简称全局身份ID)。在本申请实施例中，第一装置(被访问端)侧可存储有多个第二装置(即访问端)的上下文信息，当第一装置接收到访问请求后，可以利用该身份号作为输入索引，查找到该第二装置对应的上下文信息(比如后续的第一密钥)，并基于该上下文信息进一步确定用于验证第二装置访问权限的校验值(即第一安全校验值和第二安全校验值)。进一步地，第一装置还可以根据身该份号确定当前发起访问的第二装置(访问端)具体是哪个第二装置，以进行针对性管控。
在一种可能的实现方式中，在所述接收来自第二装置的第一访问请求之前，所述方法还包括：接收来自所述第二装置的物理地址申请请求，所述物理地址申请请求包括所述身份号；针对所述身份号生成第一密钥；向所述第二装置发送所述物理地址申请请求的第一响应，所述第一响应包括所述第一安全校验值和所述第一信息，所述第一安全校验值是基于所述第一密钥计算得到的。
在本实现方式中，第二装置在访问第一物理地址之前，需要获得第一安全校验值和第一信息，第二装置通过向第一装置发送物理地址申请请求的方式来获得第一安全校验值和第一信息，物理地址申请请求中携带用于标识第一装置或第二装置的身份号；第一装置接收来自物理地址申请请求后，获取到物理地址申请请求中的用于标识第一装置或第二装置的身份号，并针对身份号生成第一密钥，以及基于第一密钥计算得到的第一安全校验值，再将第一安全校验值和第一信息通过第一响应发送给第二装置。如此，可以保证第二装置通过第一访问请求访问第一物理地址的访问权限是第一装置开放给第二装置的，也即是通过合法途径获得访问权限的，对于被访问端(第一装置)而言，通过第一访问请求访问第一物理地址是预期的访问，保证了第一装置的物理地址空间的安全性。应理解，被访问端针对访问端或被访问端的身份号生成的密钥是不对外公开的，也即访问端不能获取到针对其生成的密钥，例如第一装置不会对外公开第一密钥，第一密钥不能被第二装置获取到；并且，安全校验值是基于针对访问端或者被访问端的身份号生成的密钥计算得到的，例如第一安全校验值是基于针对第一装置的身份号生成的第一密钥计算得到的，或者第一安全校验值是基于针对第二装置的身份号生成的第一密钥计算得到的，而计算安全校验值的密码安全数学计算算法是被业界和理论证明足够安全的算法；故对于任意一个访问端而言，不能仿冒、猜测获得安全校验值(包括不能仿冒、猜测获得其想要攻击的物理地址空间对应的安全校验值)，也不能仿冒、猜测获得针对其他访问端的安全校验值，因此被访问端的物理地址空间的安全性是可以保证的。例如第二装置不能仿冒、猜测获得第一安全校验值，第二装置只能向第一装置请求获取第一安全校验值；第二装置也不能获取到第一装置中未开放给第二装置访问的其他物理地址对应的安全校验值，故第二装置就无法访问该其他物理地址，如此保证了第一装置的物理地址空间的安全性。
作为一种示例，通过以下公式生成密钥：
key_x＝fun1_RotKey(身份号，单调递增参数)；
其中，key_x表示密钥，例如第一密钥；fun1表示派生计算函数，例如为终止密钥导出函数(Halting Key Derivation Functions，HKDF)等标准密钥派生函数；RotKey为派生计算的根密钥；单调递增参数可以为计数器值或者系统时间。
作为一种示例，所述根据所述身份号和所述第一信息计算得到第二安全校验值，包括：根据所述身份号索引第一密钥，根据所述第一密钥和所述第一信息计算得到所述第二安全校验值。
作为一种示例，本申请中的安全校验值为消息认证码(Message Authentication Code，MAC)，MAC的计算公式如下：
MAC＝fun2_key_x(PA_x)；
其中，fun2表示摘要计算函数，例如为安全哈希算法(Secure Hash Algorithm，SHA)2等标准摘要计算函数；key_x为密钥，fun2计算时需要密钥作为算子；PA_x表示物理地址。应理解，若PA_x为第一物理地址，key_x为第一密钥，则上述公式计算得到的MAC为第一安全校验值或第二安全校验值。
在一种可能的实现方式中，所述第一信息还包括第一权限值，所述第一权限值用于表示所述第二装置对所述第一物理地址的第一访问权限。应理解，第一访问权限包括以下至少一项：只读，只写，既能读也能写，既不能读也不能写。其中，第一权限值用3个比特位表示。例如，第一权限值表示为RWX，R表示读操作，W表示写操作，X表示执行操作(为便于描述，下文把X省去)；当RW＝10时，第一访问权限为只读；当RW＝01时，第一访问权限为只写；当RW＝11时，第一访问权限为既能读也能写；当RW＝00时，第一访问权限为既不能读也不能写。需要说明的是，本申请下文中描述的其他权限值采用与第一权限值相同的表示方法，例如下文中的权限值A、权限值B、第二权限值、第三权限值和第四权限值等均采用与第一权限值相同的表示方法。
在本实现方式中，第一装置可以通过第一响应告知第二装置其对第一物理地址的第一访问权限，如此第二装置可以获得其对第一物理地址的第一访问权限；进一步地，第二装置在访问第一物理地址时，在第一访问请求中携带的第一信息还包括第一权限值；由于第一信息中包括的信息数量越多，第一信息越不容易被仿冒、猜测；而第一安全校验值和第二安全校验值是基于第一信息计算得到的，第一信息中包括的信息数量越多，则决定第一安全校验值和第二安全校验值的因素越多，第一安全校验值也越不容易被仿冒、猜测，第一安全校验值和第二安全校验值校验成功的可能性也就越严苛；如此，有利于保证第一装置的物理地址空间的安全性。需要说明的是，在通过密码安全数学计算算法计算得到第一安全校验值或第二安全校验值时，第一权限值可能是密码安全数学计算算法的输入参数；具体地，先基于第一物理地址推测得到第一权限值，然后将其作为密码安全数学计算算法的输入参数；或者将第一权限值的各种可能取值作为密码安全数学计算算法的输入参数，也即针对第一权限值表示的第一访问权限的各种可能均计算一个第一安全校验值或第二安全校验；由于第一信息中包括第一权限值，故在计算第二安全校验值时，无需推测得到第一权限值，或者无需针对第一访问权限均计算一个第二安全校验值用于与第一安全校验值进行校验；如此，能够减低安全校验的延时，有利于实现快速校验，大大提高安全校验的效率。
作为一种示例，本申请中的安全校验值为MAC，MAC的计算如下：MAC＝fun2_key_x(PA_x，pert_x)；
其中，fun2表示摘要计算函数；key_x为密钥；PA_x表示物理地址；pert_x表示物理地址对应的权限值A，物理地址对应的权限值A用于表示访问端对该物理地址的第一访问权限。应理解，若PA_x为第一物理地址，pert_x为第一权限值，key_x为第一密钥，则上述公式计算得到的MAC为第一安全校验值或第二安全校验值。
在一种可能的实现方式中，所述第一信息还包括物理地址空间的颗粒度，所述物理地址空间的颗粒度用于表征所述物理地址空间范围大小，所述物理地址空间包括所述第一物理地址。例如，所述物理地址空间包括第一物理地址空间段，所述第一物理地址空间段包括所述第一物理地址。需要说明的是，物理地址空间的颗粒度用于表征物理地址空间范围大小；也即，物理地址空间一共多少位，减去颗粒度，就是高多少位，颗粒度就是指低多少位，低多少位是用于表示物理地址空间范围。当颗粒度为n时，表示物理地址区间范围为2^n；进一步地，该物理地址空间范围起始于对齐地址，即该物理地址空间范围表示低n比特位从全的0到2^n，物理地址高比特位不变的物理地址区间。例如，假设物理地址以48比特位表示，颗粒度为8，则物理地址区间范围为256，所对应的物理地址空间范围为高40比特位不变，低8比特位从全0到256的物理地址区间；也即，只用到48bit的物理地址空间中的低8位的8bit，也就是地址空间为0000000到11111111，前面40位是没有用到的。
作为一种示例，所述根据所述身份号和所述第一信息计算得到第二安全校验值，包括：根据所述身份号索引第一密钥；若所述第一信息包括第一权限值，则根据所述第一物理地址和所述物理地址空间的颗粒度确定所述第一物理地址的高位；若所述第一信息不包括第一权限值，根据所述第一物理地址和所述物理地址空间的颗粒度确定所述第一物理地址的高位和所述第一权限值；根据所述物理地址空间的颗粒度、所述第一物理地址的高位、所述第一权限值和所述第一密钥计算得到所述第二安全校验值。
作为一种示例，本申请中的安全校验值为MAC，MAC的计算如下：MAC＝fun2_key_x(range_x,pa_align,pert_x)；
其中，fun2表示摘要计算函数；key_x为密钥；range_x表示物理地址空间的颗粒度；pa_align表示物理地址基于物理地址空间的颗粒度对齐后的高位；pert_x表示物理地址空间段对应的权限值A，物理地址空间段对应的权限值A用于表示访问端对该物理地址空间段的第一访问权限。需要说明的是，一个物理地址空间段对应一个权限值A，则该物理地址空间段中的任意一个物理地址也对应该权限值A。应理解，若range_x为第一信息中的物理地址空间的颗粒度，pa_align为第一物理地址基于物理地址空间的颗粒度对齐后的高位，pert_x为第一权限值，key_x为第一密钥，则上述公式计算得到的MAC为第一安全校验值或第二安全校验值。
在本实现方式中，第一装置包括存储器，该存储器的物理地址空间包括N个物理地址空间段，N为正整数；例如，第一装置将允许第二装置访问的物理地址空间按照一定的(可编程)颗粒度划分为N个物理地址空间段；第一装置在接收到来自第二装置的物理地址申请请求之后，可以针对N个物理地址空间段中的每个物理地址空间段计算一个安全校验值，以得到N个安全校验值，N个安全校验值与N个物理地址空间段对应，且N个安全校验值是基于第一密钥计算得到的；第一装置向第二装置发送的第一响应包括物理地址空间的颗粒度、N个物理地址空间段和N个安全校验值。由于第一物理地址空间段是N个物理地址空间段中的其中一个物理地址空间段，而第一物理地址是第一物理地址空间段中的其中一个物理地址，故N个安全校验值中与第一物理地址空间段对应的安全校验值即为第一安全校验值，也即N个安全校验值包括第一安全校验值；此种情况下，第一信息包括第一响应中的物理地址空间的颗粒度和第一物理地址空间段中的第一物理地址。第二装置在访问第一物理地址时，在第一访问请求中携带的第一信息还包括物理地址空间的颗粒度；由于第一信息中包括的信息数量越多，第一信息越不容易被仿冒、猜测；而第一安全校验值和第二安全校验值是基于第一信息计算得到的，第一信息中包括的信息数量越多，则决定第一安全校验值和第二安全校验值的因素越多，第一安全校验值也越不容易被仿冒、猜测，第一安全校验值和第二安全校验值校验成功的可能性也就越严苛；如此，有利于保证第一装置的物理地址空间的安全性。应理解的是，第二装置在访问第一物理地址空间段中的其他物理地址时，在对应的访问请求中携带的安全校验值也是第一安全校验值；如此，对于任意一个物理地址空间段，针对其计算一个安全校验值，使得该物理地址空间段中的所有物理地址均对应同一个安全校验值，访问端在访问该物理地址段中的每个物理地址时，均携带同一个安全校验值，而无需针对该物理地址空间段中的每个物理地址均携带不同的安全校验值，从而可以减少开销。
在一种可能的实现方式中，所述第一权限值还用于表示所述第二装置对所述第一物理地址空间段的第一访问权限。其中，第一装置包括存储器，该存储器的物理地址空间包括N个物理地址空间段，N为正整数；第一装置在接收到来自第二装置的物理地址申请请求之后，可以针对N个物理地址空间段中的每个物理地址空间段确定一个权限值A，以得到N个权限值A，N个权限值A与N个物理地址空间段对应，N个权限值A中的任意一个权限值A用于表示第二装置对与该任意一个权限值A对应的物理地址空间段的第一访问权限；第一装置向第二装置发送的第一响应包括物理地址空间的颗粒度、N个物理地址空间段、N个安全校验值和N个权限值A。由于第一物理地址空间段是N个物理地址空间段中的其中一个物理地址空间段，而第一物理地址是第一物理地址空间段中的其中一个物理地址，故N个权限值A中与第一物理地址空间段对应的权限值A即为第一权限值，也即N个权限值A包括第一权限值；此种实现方式中，第一信息包括第一响应中的物理地址空间的颗粒度、第一物理地址空间段中的第一物理地址和N个权限值A中的第一权限值。应理解的是，第二装置在访问第一物理地址空间段中的其他物理地址时，在对应的访问请求中携带的权限值A也是第一权限值；如此，对于任意一个物理地址空间段，针对其确定一个权限值A，使得该物理地址空间段中的所有物理地址均对应同一个权限值A，访问端在访问该物理地址段中的每个物理地址时，均携带同一个权限值A，而无需针对该物理地址空间段中的每个物理地址均携带不同的权限值A，从而可以减少开销。
在本实现方式中，第二装置在访问第一物理地址时，在第一访问请求中携带的第一信息还包括第一权限值；由于第一信息中包括的信息数量越多，第一信息越不容易被仿冒、猜测；而第一安全校验值和第二安全校验值是基于第一信息计算得到的，第一信息中包括的信息数量越多，则决定第一安全校验值和第二安全校验值的因素越多，第一安全校验值也越不容易被仿冒、猜测，第一安全校验值和第二安全校验值校验成功的可能性也就越严苛；如此，有利于保证第一装置的物理地址空间的安全性。需要说明的是，在通过密码安全数学计算算法计算得到第一安全校验值或第二安全校验值时，第一权限值可能是密码安全数学计算算法的输入参数；具体地，先基于第一物理地址和物理地址空间的颗粒度推测得到第一权限值，然后将其作为密码安全数学计算算法的输入参数；或者将第一权限值的各种可能取值作为密码安全数学计算算法的输入参数，也即针对第一权限值表示的第一访问权限的各种可能均计算一个第一安全校验值或第二安全校验；由于第一信息中包括第一权限值，故在计算第二安全校验值时，无需推测得到第一权限值，或者无需针对第一访问权限均计算一个第二安全校验值用于与第一安全校验值进行校验；如此，能够减低安全校验的延时，有利于实现快速校验，大大提高安全校验的效率。
在一种可能的实现方式中，所述根据所述第一安全校验值和所述第二安全校验值确定所述第二装置对所述第一物理地址的访问权限，包括：将所述第一安全校验值与所述第二安全校验值进行校验；若所述第一安全校验值与所述第二安全校验值校验成功，则确定所述第二装置对所述第一物理地址的访问权限为允许访问。其中，访问权限为允许访问包括以下至少一项：只允许读，只允许写，既允许读也允许写。
在本实现方式中，当且仅当第一安全校验值与第二安全校验值校验成功了，才能允许第二装置访问第一物理地址，也即第二装置对第一物理地址的访问权限为允许访问。其中，第一安全校验值与第二安全校验值校验成功可以指第一安全校验值与第二安全校验值相同，例如第一安全校验值与第二安全校验值为消息认证码(Message Authentication Code，MAC)的情况时；但也不限于此，视具体密码安全数学计算算法而定。
在一种可能的实现方式中，所述第一安全校验值和所述第二安全校验值是基于第一密钥计算得到的；所述方法还包括：针对所述身份号生成第二密钥；向所述第二装置发送无效命令，所述无效命令用于无效所述第一物理地址或第一物理地址空间段；在接收来自所述第二装置的所述无效命令的响应之后，或在所述无效命令超时之后，采用所述第二密钥替代所述第一密钥。
在本实现方式中，在需要改变第二装置对第一物理地址或第一物理地址空间段的访问权限的时候，例如在需要使得第二装置对第一物理地址或第一物理地址空间段没有访问权限的时候，也即在无效第一物理地址或第一物理地址空间段的时候，可以针对用于标识第一装置或第二装置的身份号重新生成第二密钥，采用重新生成的第二密钥替代原来的第一密钥进行安全校验。之后，第二装置再次访问第一物理地址或第一物理地址空间段时，在访问请求中携带的安全校验值还是第一安全校验值，第一安全校验值是基于第一密钥计算得到的；第一装置接收到该访问请求后，基于第二密钥计算安全校验值，故第一装置计算得到的安全校验值和该访问请求中携带的第一安全校验值会校验不成功，从而阻止第二装置访问第一物理地址或第一物理地址空间段，也即使得第二装置对第一物理地址或第一物理地址空间段没有访问权限。如此，若被访问端需要改变访问端对某个物理地址或物理地址空间段的访问权限，被访问端可以针对访问端或被访问端的身份号重新生成新的密钥，替代旧的密钥，以实现改变访问端对这个物理地址或物理地址空间段的访问权限；从而被访问端能够灵活管理物理地址空间，包括动态分配物理地址空间段，动态修改分配出去的物理地址空间段的访问权限，动态回收分配出去的物理地址空间段；并且，当身份号用于标识第二装置即访问端时，被访问端在管理物理地址空间时，可以精细到各个第二装置的身份号，以保证不同身份号之间互相不影响。
在一种可能的实现方式中，在向所述第二装置发送无效命令之后，在接收所述无效命令的响应之前，或在所述无效命令超时之前，所述方法还包括：接收来自所述第二装置的安全校验值获取请求，所述安全校验值获取请求包括所述身份号、第三安全校验值和第二信息，所述第三安全校验值是基于所述第一密钥计算得到的，所述第二信息包括第二物理地址；根据所述身份号、所述第二信息和所述第一密钥计算得到第四安全校验值；将所述第三安全校验值与所述第四安全校验值进行校验；若所述第三安全校验值与所述第四安全校验值校验成功，则向所述第二装置发送所述安全校验值获取请求的第二响应，所述第二响应包括第五安全校验值，所述第五安全校验值是基于所述第二密钥计算得到的。应理解，第一装置包括存储器，该存储器的物理地址空间包括第二物理地址，第二物理地址与第一物理地址不同，也即第二物理地址不是要被无效掉的；其中，第二物理地址与第三安全校验值对应，且第三安全校验值也是由第一装置基于和计算第四安全校验值一样的方法计算得到，并且由第一装置提前发送给第二装置的。
在本实现方式中，在无效第一物理地址或第一物理地址空间段的时候，由于第一装置针对第一装置或第二装置的身份号重新生成了第二密钥，以替代第一密钥；而对于没有被无效的第二物理地址，其对应的第三安全校验值是基于第一密钥计算得到的，第二装置为了确保对第二物理地址仍然具备访问权限，第二装置需要获取到第二物理地址对应的基于第二密钥计算得到的第五安全校验值，第五安全校验值可以用于替代第三安全校验值；故第二装置向第一装置发送安全校验值获取请求，第一装置通过第二响应将第五安全校验值发送给第二装置，从而保证第二装置对第二物理地址仍然具备访问权限。需要说明的是，访问端向被访问端重新获取安全校验值时，也是需要进行安全校验的，从而进一步保护了被访问端的物理地址空间的安全。应理解，对于要被无效的第一物理地址或第一物理地址空间段，即使第二装置请求重新获取基于第二密钥针对第一物理地址或第一物理地址空间段计算得到的新的安全校验值，第一装置不会发送新的安全校验值；如此对于要被无效的物理地址或物理地址空间段，则不再给访问端新的安全校验值，而访问段又不能猜测到新的安全校验值，故访问端必然不能通过被访问端的校验，也即没有了被无效的物理地址或物理地址空间段的访问权限，从而保护了被访问端的物理地址空间的安全。
在一种可能的实现方式中，所述第二信息还包括第二权限值，所述第二权限值用于表示所述第二装置对所述第二物理地址的第一访问权限。
在一种可能的实现方式中，所述第二信息还包括物理地址空间的颗粒度，所述物理地址空间的颗粒度用于表征所述物理地址空间范围大小，所述物理地址空间包括所述第二物理地址。例如，所述物理地址空间包括第二物理地址空间段，所述第二物理地址空间段包括所述第二物理地址。
在一种可能的实现方式中，所述第二权限值还用于表示所述第二装置对所述第二物理地址空间段的第一访问权限。
在一种可能的实现方式中，在向所述第二装置发送无效命令之后，在接收所述无效命令的响应之前，或在所述无效命令超时之前，所述方法还包括：接收来自所述第二装置的第二访问请求，所述第二访问请求包括所述身份号、第六安全校验值和第三信息，所述第三信息包括第三物理地址；根据所述身份号、所述第三信息和所述第一密钥计算得到第七安全校验值，以及根据所述身份号、所述第三信息和所述第二密钥计算得到第八安全校验值；将所述第六安全校验值分别与所述第七安全校验值和所述第八安全校验值进行校验；若所述第六安全校验值与所述第七安全校验值校验成功，或所述第六安全校验值与所述第八安全校验值校验成功，则确定所述第二装置对所述第三物理地址的访问权限为允许访问。应理解，第一装置包括存储器，该存储器的物理地址空间包括第三物理地址，第三物理地址与第一物理地址不同，也即第三物理地址不是要被无效掉的；其中，第三物理地址与第六安全校验值对应，且第六安全校验值也是由第一装置基于和计算第七安全校验值或第八安全校验值一样的方法计算得到，并且由第一装置提前发送给第二装置的。其中，在发送无效命令之后，接收无效命令的响应之前，或在无效命令超时之前，第一装置接收到的访问请求携带的安全校验值可能是基于旧的密钥计算得到的，也可能是基于新的密钥计算得到的；例如，第六安全校验值可能是基于第一密钥计算得到的，也可能是基于第二密钥计算得到的。
在本实现方式中，虽然第一装置在发送无效命令之前，已经针对第二装置重新生成了第二密钥，但是，在第一装置发送无效命令之后，以及在接收无效命令的响应之前，或在无效命令超时之前，第一密钥和第二密钥是短暂共存的；故在此时间段内，如果第一装置接收来自第二装置的第二访问请求，只要第六安全校验值与第七安全校验值和第八安全校验值中的任意一个校验成功，都是允许第二装置访问第三物理地址的，从而保证了在无效第一物理地址或第一物理地址空间段的过程中，第二装置可以正常访问未被无效的第三物理地址。需要说明的是，在更新密钥的过程中，本申请在某段时间内利用了旧的密钥和新的密钥双密钥短暂共存的机制；其中，旧的密钥只用于计算校验用的安全校验值，不再用于计算需要发送给访问端的新的安全校验值；而新的密钥则既可以用于计算校验用的安全校验值，也用于计算需要发送给访问端的新的安全校验值；如此，使用双密钥短暂共存的机制，可以避免因更新密钥而对其他物理地址或其他物理地址空间段的访问带来影响。
在一种可能的实现方式中，所述第三信息还包括第三权限值，所述第三权限值用于表示所述第二装置对所述第三物理地址的第一访问权限。
在一种可能的实现方式中，所述第三信息还包括物理地址空间的颗粒度，所述物理地址空间的颗粒度用于表征所述物理地址空间范围大小，所述物理地址空间包括所述第三物理地址。例如，所述物理地址空间包括第三物理地址空间段，所述第三物理地址空间段包括所述第三物理地址。
在一种可能的实现方式中，所述第三权限值还用于表示所述第二装置对所述第三物理地址空间段的第一访问权限。
在一种可能的实现方式中，所述第一装置包括区域表(region table)，所述区域表包括第一索引号和第四权限值，所述第一索引号与所述第四权限值对应，所述第四权限值用于表示所述第一物理地址或第一物理地址空间段的第二访问权限；所述第一信息还包括所述第一索引号。需要说明的是，当身份号用于标识第二装置时，被访问端可以基于访问端的身份号分别为每个访问端建立一个存储物理地址空间访问权限的区域表，也可以基于访问端的身份号为所有访问端建立一个存储物理地址空间访问权限的区域表；或者，当身份号用于标识第一装置时，被访问端可以基于被访问端的身份号建立一个存储物理地址空间访问权限的区域表。例如，区域表的每个条目只需要少量的几比特，用来存储物理地址或物理地址空间段的访问权限，区域表可以是一个连续的并且跨度可控的轻量级表；而且，若区域表的条目用来存储物理地址空间段的访问权限，则区域表的每个条目都可以连续分配使用，不和具体的物理地址绑定，从而不会造成区域表的条目可能想使用但因物理地址空间很离散而使用不到的情况。其中，第一装置包括存储器，该存储器的物理地址空间包括N个物理地址空间段，N为正整数；第一装置在接收到来自第二装置的物理地址申请请求之后，可以针对N个物理地址空间段中的每个物理地址空间段在区域表中建立一个条目，从而区域表中包括N个条目，N个条目与N个物理地址空间段对应；并且，N个条目中的每个条目中用于存储对应的物理地址空间段的访问权限，每个条目包括区域号、索引号和权限值B，其中，区域号用于表示该条目对应的物理地址空间段，索引号用于索引该条目中的权限值B，权限值B用于表示该条目对应的物理地址空间段的第二访问权限，故N个条目有N个索引号和N个权限值B，N个物理地址空间段、N个索引号和N个权限值B是一一对应的；第一装置向第二装置发送的第一响应包括N个索引号。应当理解，N个索引号中与第一物理地址空间段对应的索引号即为第一索引号，第一信息可以包括第一索引号。第二装置在访问第一物理地址空间段中的其他物理地址时，在对应的访问请求中携带的索引号也是第一索引号；如此，对于任意一个物理地址空间段，其在区域表中对应一个索引号，故该物理地址空间段中的所有物理地址均对应同一个索引号，访问端在访问该物理地址段中的每个物理地址时，均携带同一个索引号，而不是针对该物理地址空间段中的每个物理地址均携带不同的索引号，从而可以减少开销。应理解，第二访问权限包括以下至少一项：只读，只写，既能读也能写，既不能读也不能写。
在本实现方式中，第一装置包括区域表，第一信息还包括第一索引号，基于第一索引号可以在区域表中索引到第四权限值，第四权限值用于表示第一物理地址或第一物理地址空间段的第二访问权限，第一物理地址空间段包括第一物理地址，第一装置可以通过第一响应将第一索引号发送给第二装置；第二装置在访问第一物理地址时，在第一访问请求中携带的第一信息还包括第一索引号；由于第一信息中包括的信息数量越多，第一信息越不容易被仿冒、猜测；而第一安全校验值和第二安全校验值是基于第一信息计算得到的，第一信息中包括的信息数量越多，则决定第一安全校验值和第二安全校验值的因素越多，第一安全校验值也越不容易被仿冒、猜测，第一安全校验值和第二安全校验值校验成功的可能性也就越严苛；如此，有利于保证第一装置的物理地址空间的安全性。
作为一种示例，所述根据所述身份号和所述第一信息计算得到第二安全校验值，包括：根据所述身份号索引第一密钥；若所述第一信息包括第一权限值，则根据所述第一物理地址和所述物理地址空间的颗粒度确定所述第一物理地址的高位；若所述第一信息不包括第一权限值，根据所述第一物理地址和所述物理地址空间的颗粒度确定所述第一物理地址的高位和所述第一权限值；根据所述物理地址空间的颗粒度、所述第一物理地址的高位、所述第一权限值、所述第一索引号和所述第一密钥计算得到所述第二安全校验值。
作为一种示例，本申请中的安全校验值为MAC，MAC的计算如下：MAC＝fun2_key_x(range_x,pa_align,pert_x,range index)；
其中，fun2表示摘要计算函数；key_x为密钥；range_x表示物理地址空间的颗粒度；pa_align表示物理地址基于物理地址空间的颗粒度对齐后的高位；pert_x表示物理地址空间段对应的权限值A，物理地址空间段对应的权限值A用于表示访问端对该物理地址空间段的第一访问权限；range index表示区域表的索引号。应理解，若range_x为第一信息中的物理地址空间的颗粒度，pa_align为第一物理地址基于物理地址空间的颗粒度对齐后的高位，pert_x为第一权限值，range index为第一索引号，key_x为第一密钥，则上述公式计算得到的MAC为第一安全校验值或第二安全校验值。
在一种可能的实现方式中，所述根据所述第一安全校验值和所述第二安全校验值确定所述第二装置对所述第一物理地址的访问权限，包括：将所述第一安全校验值与所述第二安全校验值进行校验；若所述第一安全校验值与所述第二安全校验值校验成功，且所述第四标权限值表示的第二访问权限为允许访问，则确定所述第二装置对所述第一物理地址的访问权限为允许访问。应理解，当存在区域表时，安全校验值校验成功以后，还去查区域表；如果查区域表得到的第四权限值表示的第二访问权限为允许访问时，才允许访问。
在本实现方式中，当且仅当第一安全校验值与第二安全校验值校验成功，且基于第一访问请求携带的第一索引号在区域表中索引到的第四标权限值表示的第二访问权限为允许访问时，才能允许第二装置访问第一物理地址，也即第二装置对第一物理地址的访问权限为允许访问。如此，在建立了区域表的基础上，访问端发出的访问请求还需要携带区域表的索引号；并且，被访问端基于访问请求携带的区域表的索引号，在本地区域表中索引此访问请求将要访问的物理地址或物理地址空间段的条目，以获得对应的权限值；针对此访问请求，只有安全校验值校验成功且在区域表中索引到的权限值表示的第二访问权限为允许访问时，才能允许此访问请求继续访问；否则，阻止此访问请求的继续访问。
在一种可能的实现方式中，所述方法还包括：将所述区域表中的所述第四权限值修改为第五权限值。
在本实现方式中，在需要改变第二装置对第一物理地址或第一物理地址空间段的访问权限的时候，例如在需要使得第二装置对第一物理地址或第一物理地址空间段没有访问权限的时候，也即在无效第一物理地址或第一物理地址空间段的时候，第一装置仅需要将区域表中的第四权限值修改为第五权限值，例如第五权限值用于表示第一物理地址或第一物理地址空间段的第二访问权限为不允许访问；之后，第二装置再次访问第一物理地址或第一物理地址空间段时，第一装置基于访问请求中携带的第一索引号在区域表中索引到的是第五权限值，而第五权限表示的第二访问权限为不允许访问，从而阻止了第二装置访问第一物理地址或第一物理地址空间段，实现改变第二装置对第一物理地址或第一物理地址空间段的访问权限。如此，若被访问端需要改变访问端对某个物理地址或物理地址空间段的访问权限，如果该物理地址或物理地址空间段在区域表中有对应的条目存在，则被访问端无需针对访问端或者被访问端的身份号重新生成密钥，直接修改区域表中对应条目的权限值即可，例如可以直接修改对应条目的权限值为期望的值，而保持针对访问端或者被访问端的身份号的密钥不变，从而可以减少被访问端因为需要改变物理地址或物理地址空间段的访问权限而更新密钥的频率和额外开销，以及提高物理地址空间回收的效率(例如提高无效物理地址或物理地址空间段的效率)。
第二方面，本申请实施例提供了一种内存访问方法，应用于第二装置，所述方法包括：向第一装置发送第一访问请求，所述第一访问请求包括身份号、第一安全校验值和第一信息，所述第一信息包括第一物理地址；所述身份号和所述第一信息用于计算得到第二安全校验值；所述第一安全校验值和所述第二安全校验值用于确定所述第二装置对所述第一物理地址的访问权限。
在一种可能的实现方式中，所述身份号用于标识所述第一装置，或者所述身份号用于标识所述第二装置。
在一种可能的实现方式中，在所述向第一装置发送第一访问请求之前，所述方法还包括：向所述第一装置发送物理地址申请请求，所述物理地址申请请求包括所述身份号；接收来自所述第一装置的所述物理地址申请请求的第一响应，所述第一响应包括所述第一安全校验值和所述第一信息，所述第一安全校验值是基于第一密钥计算得到的，所述第一密钥是针对所述身份号生成的。
在一种可能的实现方式中，所述第一信息还包括第一权限值，所述第一权限值用于表示所述第二装置对所述第一物理地址的第一访问权限。
在一种可能的实现方式中，所述第一信息还包括物理地址空间的颗粒度，所述物理地址空间的颗粒度用于表征所述物理地址空间范围大小，所述物理地址空间包括所述第一物理地址。例如，所述物理地址空间包括第一物理地址空间段，所述第一物理地址空间段包括所述第一物理地址。
在一种可能的实现方式中，所述第一权限值还用于表示所述第二装置对所述第一物理地址空间段的第一访问权限。
在一种可能的实现方式中，所述方法还包括：接收来自所述第一装置的无效命令，所述无效命令用于无效所述第一物理地址或第一物理地址空间段；向所述第一装置发送所述无效命令的响应。
在一种可能的实现方式中，在接收所述无效命令之后，在发送所述无效命令的响应之前，所述方法还包括：向所述第一装置发送安全校验值获取请求，所述安全校验值获取请求包括所述身份号、第三安全校验值和第二信息，所述第三安全校验值是基于第一密钥计算得到的，所述第二信息包括第二物理地址；接收来自所述第一装置的所述安全校验值获取请求的第二响应，所述第二响应包括第五安全校验值，所述第五安全校验值是基于第二密钥计算得到的，所述第二密钥是针对所述身份号生成的。其中，所述身份号、所述第二信息和所述第一密钥用于计算得到第四安全校验值；所述第三安全校验值和所述第四安全校验值用于进行校验；此外，所述第三安全校验值和所述第四安全校验值的校验结果可以用于确定第二响应携带的信息内容。
在一种可能的实现方式中，所述第二信息还包括第二权限值，所述第二权限值用于表示所述第二装置对所述第二物理地址的第一访问权限。
在一种可能的实现方式中，所述第二信息还包括物理地址空间的颗粒度，所述物理地址空间的颗粒度用于表征所述物理地址空间范围大小，所述物理地址空间包括所述第二物理地址。例如，所述物理地址空间包括第二物理地址空间段，所述第二物理地址空间段包括所述第二物理地址。
在一种可能的实现方式中，所述第二权限值还用于表示所述第二装置对所述第二物理地址空间段的第一访问权限。
在一种可能的实现方式中，在接收所述无效命令之后，在发送所述无效命令的响应之前，所述方法还包括：向所述第一装置发送第二访问请求，所述第二访问请求包括所述身份号、第六安全校验值和第三信息，所述第三信息包括第三物理地址。其中，所述身份号和所述第三信息用于计算得到第七安全校验值和第八安全校验值；所述第六安全校验值、所述第七安全校验值和所述第八安全校验值用于确定所述第二装置对所述第三物理地址的访问权限。
在一种可能的实现方式中，所述第三信息还包括第三权限值，所述第三权限值用于表示所述第二装置对所述第三物理地址的第一访问权限。
在一种可能的实现方式中，所述第三信息还包括物理地址空间的颗粒度，所述物理地址空间的颗粒度用于表征所述物理地址空间范围大小，所述物理地址空间包括所述第三物理地址。例如，所述物理地址空间包括第三物理地址空间段，所述第三物理地址空间段包括所述第三物理地址。
在一种可能的实现方式中，所述第三权限值还用于表示所述第二装置对所述第三物理地址空间段的第一访问权限。
在一种可能的实现方式中，所述第一装置包括区域表，所述区域表包括第一索引号和第四权限值，所述第一索引号与所述第四权限值对应，所述第四权限值用于表示所述第一物理地址或第一物理地址空间段的第二访问权限；所述第一信息还包括所述第一索引号。
需要说明的是，第二方面的有益效果可以参照第一方面的描述，此处不再重复描述。
第三方面，本申请实施例提供了一种内存访问装置，应用于第一装置，所述装置包括：通信单元，用于接收来自第二装置的第一访问请求，所述第一访问请求包括身份号、第一安全校验值和第一信息，所述第一信息包括第一物理地址；处理单元，用于根据所述身份号和第一信息计算得到第二安全校验值；以及根据所述第一安全校验值和所述第二安全校验值确定所述第二装置对所述第一物理地址的访问权限。
在一种可能的实现方式中，所述身份号用于标识所述第一装置，或者所述身份号用于标识所述第二装置。
在一种可能的实现方式中，在所述接收来自第二装置的第一访问请求之前，所述通信单元还用于：接收来自所述第二装置的物理地址申请请求，所述物理地址申请请求包括所述身份号；所述处理单元还用于：针对所述身份号生成第一密钥；所述通信单元还用于：向所述第二装置发送所述物理地址申请请求的第一响应，所述第一响应包括所述第一安全校验值和所述第一信息，所述第一安全校验值是基于所述第一密钥计算得到的。
作为一种示例，所述处理单元具体用于：根据所述身份号索引第一密钥，根据所述第一密钥和所述第一信息计算得到所述第二安全校验值。
在一种可能的实现方式中，所述第一信息还包括第一权限值，所述第一权限值用于表示所述第二装置对所述第一物理地址的第一访问权限。
在一种可能的实现方式中，所述第一信息还包括物理地址空间的颗粒度，所述物理地址空间的颗粒度用于表征所述物理地址空间范围大小，所述物理地址空间包括所述第一物理地址。例如，所述物理地址空间包括第一物理地址空间段，所述第一物理地址空间段包括所述第一物理地址。
在一种可能的实现方式中，所述第一权限值还用于表示所述第二装置对所述第一物理地址空间段的第一访问权限。
作为一种示例，所述处理单元具体用于：根据所述身份号索引第一密钥；若所述第一信息包括第一权限值，则根据所述第一物理地址和所述物理地址空间的颗粒度确定所述第一物理地址的高位；若所述第一信息不包括第一权限值，根据所述第一物理地址和所述物理地址空间的颗粒度确定所述第一物理地址的高位和所述第一权限值；根据所述物理地址空间的颗粒度、所述第一物理地址的高位、所述第一权限值和所述第一密钥计算得到所述第二安全校验值。
在一种可能的实现方式中，所述处理单元具体用于：将所述第一安全校验值与所述第二安全校验值进行校验；若所述第一安全校验值与所述第二安全校验值校验成功，则确定所述第二装置对所述第一物理地址的访问权限为允许访问。
在一种可能的实现方式中，所述第一安全校验值和所述第二安全校验值是基于第一密钥计算得到的；所述处理单元还用于：针对所述身份号生成第二密钥；所述通信单元还用于：向所述第二装置发送无效命令，所述无效命令用于无效所述第一物理地址或第一物理地址空间段；所述处理单元还用于：在接收来自所述第二装置的所述无效命令的响应之后，或在所述无效命令超时之后，采用所述第二密钥替代所述第一密钥。
在一种可能的实现方式中，在向所述第二装置发送无效命令之后，在接收所述无效命令的响应之前，或在所述无效命令超时之前，所述通信单元还用于：接收来自所述第二装置的安全校验值获取请求，所述安全校验值获取请求包括所述身份号、第三安全校验值和第二信息，所述第三安全校验值是基于所述第一密钥计算得到的，所述第二信息包括第二物理地址；所述处理单元还用于：根据所述身份号、所述第二信息和所述第一密钥计算得到第四安全校验值；以及将所述第三安全校验值与所述第四安全校验值进行校验；所述通信单元还用于：若所述第三安全校验值与所述第四安全校验值校验成功，则向所述第二装置发送所述安全校验值获取请求的第二响应，所述第二响应包括第五安全校验值，所述第五安全校验值是基于所述第二密钥计算得到的。
在一种可能的实现方式中，所述第二信息还包括第二权限值，所述第二权限值用于表示所述第二装置对所述第二物理地址的第一访问权限。
在一种可能的实现方式中，所述第二信息还包括物理地址空间的颗粒度，所述物理地址空间的颗粒度用于表征所述物理地址空间范围大小，所述物理地址空间所述第二物理地址。例如，所述物理地址空间包括第二物理地址空间段，所述第二物理地址空间段包括所述第二物理地址。
在一种可能的实现方式中，所述第二权限值还用于表示所述第二装置对所述第二物理地址空间段的第一访问权限。
在一种可能的实现方式中，在向所述第二装置发送无效命令之后，在接收所述无效命令的响应之前，或在所述无效命令超时之前，所述通信单元还用于：接收来自所述第二装置的第二访问请求，所述第二访问请求包括所述身份号、第六安全校验值和第三信息，所述第三信息包括第三物理地址；所述处理单元还用于：根据所述身份号、所述第三信息和所述第一密钥计算得到第七安全校验值，以及根据所述身份号、所述第三信息和所述第二密钥计算得到第八安全校验值；以及将所述第六安全校验值分别与所述第七安全校验值和所述第八安全校验值进行校验；以及若所述第六安全校验值与所述第七安全校验值校验成功，或所述第六安全校验值与所述第八安全校验值校验成功，则确定所述第二装置对所述第三物理地址的访问权限为允许访问。
在一种可能的实现方式中，所述第三信息还包括第三权限值，所述第三权限值用于表示所述第二装置对所述第三物理地址的第一访问权限。
在一种可能的实现方式中，所述第三信息还包括物理地址空间的颗粒度，所述物理地址空间的颗粒度用于表征所述物理地址空间范围大小，所述物理地址空间包括所述第三物理地址。例如，所述物理地址空间包括第三物理地址空间段，所述第三物理地址空间段包括所述第三物理地址。
在一种可能的实现方式中，所述第三权限值还用于表示所述第二装置对所述第三物理地址空间段的第一访问权限。
在一种可能的实现方式中，所述第一装置包括区域表，所述区域表包括第一索引号和第四权限值，所述第一索引号与所述第四权限值对应，所述第四权限值用于表示所述第一物理地址或第一物理地址空间段的第二访问权限；所述第一信息还包括所述第一索引号。
作为一种示例，所述处理单元具体用于：根据所述身份号索引第一密钥；若所述第一信息包括第一权限值，则根据所述第一物理地址和所述物理地址空间的颗粒度确定所述第一物理地址的高位；若所述第一信息不包括第一权限值，根据所述第一物理地址和所述物理地址空间的颗粒度确定所述第一物理地址的高位和所述第一权限值；根据所述物理地址空间的颗粒度、所述第一物理地址的高位、所述第一权限值、所述第一索引号和所述第一密钥计算得到所述第二安全校验值。
在一种可能的实现方式中，所述处理单元具体用于：将所述第一安全校验值与所述第二安全校验值进行校验；若所述第一安全校验值与所述第二安全校验值校验成功，且所述第四标权限值表示的第二访问权限为允许访问，则确定所述第二装置对所述第一物理地址的访问权限为允许访问。
在一种可能的实现方式中，所述处理单元还用于：将所述区域表中的所述第四权限值修改为第五权限值。
需要说明的是，第三方面的有益效果可以参照第一方面的描述，此处不再重复描述。
第四方面，本申请实施例提供了一种内存访问装置，应用于第二装置，所述装置包括：通信单元，用于向第一装置发送第一访问请求，所述第一访问请求包括身份号、第一安全校验值和第一信息，所述第一信息包括第一物理地址；所述身份号和第一信息用于计算得到第二安全校验值；所述第一安全校验值和所述第二安全校验值用于确定所述第二装置对所述第一物理地址的访问权限。
在一种可能的实现方式中，所述身份号用于标识所述第一装置，或者所述身份号用于标识所述第二装置。
在一种可能的实现方式中，在所述向第一装置发送第一访问请求之前，所述通信单元还用于：向所述第一装置发送物理地址申请请求，所述物理地址申请请求包括所述身份号；以及接收来自所述第一装置的所述物理地址申请请求的第一响应，所述第一响应包括所述第一安全校验值和所述第一信息，所述第一安全校验值是基于第一密钥计算得到的，所述第一密钥是针对所述身份号生成的。
在一种可能的实现方式中，所述第一信息还包括第一权限值，所述第一权限值用于表示所述第二装置对所述第一物理地址的第一访问权限。
在一种可能的实现方式中，所述第一信息还包括物理地址空间的颗粒度，所述物理地址空间的颗粒度用于表征所述物理地址空间范围大小，所述物理地址空间包括所述第一物理地址。例如，所述物理地址空间包括第一物理地址空间段，所述第一物理地址空间段包括所述第一物理地址。
在一种可能的实现方式中，所述第一权限值还用于表示所述第二装置对所述第一物理地址空间段的第一访问权限。
在一种可能的实现方式中，所述通信单元还用于：接收来自所述第一装置的无效命令，所述无效命令用于无效所述第一物理地址或第一物理地址空间段；以及向所述第一装置发送所述无效命令的响应。
在一种可能的实现方式中，在接收所述无效命令之后，在发送所述无效命令的响应之前，所述通信单元还用于：向所述第一装置发送安全校验值获取请求，所述安全校验值获取请求包括所述身份号、第三安全校验值和第二信息，所述第三安全校验值是基于第一密钥计算得到的，所述第二信息包括第二物理地址；以及接收来自所述第一装置的所述安全校验值获取请求的第二响应，所述第二响应包括第五安全校验值，所述第五安全校验值是基于第二密钥计算得到的，所述第二密钥是针对所述身份号生成的。
在一种可能的实现方式中，所述第二权限值还用于表示所述第二装置对所述第二物理地址的第一访问权限。
在一种可能的实现方式中，所述第二信息还包括物理地址空间的颗粒度，所述物理地址空间的颗粒度用于表征所述物理地址空间范围大小，所述物理地址空间包括所述第二物理地址。例如，所述物理地址空间包括第二物理地址空间段，所述第二物理地址空间段包括所述第二物理地址。
在一种可能的实现方式中，所述第二权限值还用于表示所述第二装置对所述第二物理地址空间段的第一访问权限。
在一种可能的实现方式中，在接收所述无效命令之后，在发送所述无效命令的响应之前，所述通信单元还用于：向所述第一装置发送第二访问请求，所述第二访问请求包括所述身份号、第六安全校验值和第三信息，所述第三信息包括第三物理地址。
在一种可能的实现方式中，所述第三信息还包括第三权限值，所述第三权限值用于表示所述第二装置对所述第三物理地址的第一访问权限。
在一种可能的实现方式中，所述第三信息还包括物理地址空间的颗粒度，所述物理地址空间的颗粒度用于表征所述物理地址空间范围大小，所述物理地址空间包括所述第三物理地址。例如，所述物理地址空间包括第三物理地址空间段，所述第三物理地址空间段包括所述第三物理地址。
在一种可能的实现方式中，所述第三权限值还用于表示所述第二装置对所述第三物理地址空间段的第一访问权限。
在一种可能的实现方式中，所述第一装置包括区域表，所述区域表包括第一索引号和第四权限值，所述第一索引号与所述第四权限值对应，所述第四权限值用于表示所述第一物理地址或第一物理地址空间段的第二访问权限；所述第一信息还包括所述第一索引号。
需要说明的是，第四方面的有益效果可以参照第一方面的描述，此处不再重复描述。
第五方面，本申请实施例提供了一种内存访问装置，包括处理器和传输接口，所述处理器被配置为调用存储在存储器中的程序，以使得所述内存访问装置实现如上述第一方面或第二方面中任一可能的实现方式所述的方法。
第六方面，本申请实施例提供了一种计算机可读存储介质，所述计算机可读存储介质包括计算机程序，当所述计算机程序在计算机或处理器上运行时，使得所述计算机或所述处理器进行如上述第一方面或第二方面中任一可能的实现方式所述的方法。
第七方面，本申请实施例提供了一种芯片，包括：处理器，用于从存储器中调用并运行计算机程序，使得安装有所述芯片的设备执行如上述第一方面或第二方面中任一可能的实现方式所述的方法。
第八方面，本申请实施例提供了一种计算机程序产品，所述计算机程序产品包括计算机程序，当所述计算机程序在计算机或处理器上运行时，使得所述计算机或所述处理器进行如上述第一方面或第二方面中任一可能的实现方式所述的方法。
第九方面，本申请实施例提供了一种电子设备，所述电子设备为上述第一装置或第二装置，或所述电子设备包括上述第一装置和/或第二装置。
 附图说明
图1是本申请实施例提供的一种将计算下放到特定的IO设备/加速器上运行的场景示意图。
图2是本申请实施例提供的一种基于物理地址空间段访问权限表的物理地址访问示意图。
图3是本申请实施例提供的一种基于黑名单白名单机制的物理地址访问示意图。
图4是本申请实施例提供的一种示例性的应用场景示意图。
图5是本申请实施例提供的一种内存访问方法的流程示意图。
图6是图5所示的内存访问方法的一种可能的实现示例的流程示意图。
图7是图5所示的实施例中无效物理地址空间段的一种可能的实现示例的流程示意图。
图8是图5所示的实施例中无效物理地址空间段的另一种可能的实现示例的流程示意图。
图9是本申请实施例提供的一种内存访问装置的结构示意图。
图10是本申请实施例提供的另一种内存访问装置的结构示意图。
 具体实施方式
为了使本技术领域的人员更好地理解本申请方案，下面将结合本申请实施例中的附图，对本申请实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例仅仅是本申请一部分实施例，而不是全部的实施例。基于本申请中的实施例，本领域普通技术人员在没有作出创造性劳动前提下所获得的所有其他实施例，都属于本申请保护的范围。
本申请的说明书和权利要求书及上述附图中的术语“包括”和“具有”以及它们任何变形，意图在于覆盖不排他的包含。例如包含了一系列步骤或单元的过程、方法、系统、产品或设备没有限定于已列出的步骤或单元，而是可选地还包括没有列出的步骤或单元，或可选地还包括对于这些过程、方法、产品或设备固有的其他步骤或单元。
在本说明书中提及“实施例”意味着，结合实施例描述的特定特征、结构或特性可以包含在本申请的至少一个实施例中。在说明书中的各个位置出现该短语并不一定均是指相同的实施例，也不是与其它实施例互斥的独立的或备选的实施例。本领域技术人员显式地和隐式地理解的是，本说明书所描述的实施例可以与其它实施例相结合。
首先，对本申请涉及的相关知识进行介绍，以及进一步分析并提出本申请所具体要解决的技术问题，以便本领域技术人员理解本申请实施例。
随着人工智能(Artificial Intelligence，AI)、自动驾驶计算、云计算等计算和数据密集型应用场景的普及，整个计算体系将会越来越复杂，各种专有的计算设备将会被广泛集成应用，例如图形处理器(Graphics Processing Unit，GPU)、张量处理器(Tensor Processing Unit，TPU)等专有的计算设备；由于前述专有的计算设备通过IO接口与主机连接，故也称为主机的IO设备。主机上的一些计算将会被下放到特定的IO设备/加速器上运行，从而降低主机侧的中央处理器(Central Processing Unit，CPU)的计算压力。IO设备/加速器可以通过互联总线和主机侧CPU连接，例如通过外围设备互联扩展总线(Peripheral Component Interconnect Express，PCIe)、NVLink总线等互联总线与主机侧CPU连接。
请参阅图1，图1是本申请实施例提供的一种将计算下放到特定的IO设备/加速器上运行的场景示意图。如图1所示，主机(host)侧的CPU需要执行一段程序Read_image，该程序Read_image包括三个重要的函数，分别为step1，step2和step3。对于程序Read_image的执行任务，CPU将其下放到其IO设备(包括GPU、TPU)和加速器(Accelerator 1)中，其中，GPU执行step1，TPU执行step2，加速器执行step3；GPU、TPU和加速器计算完了以后，将各自计算得到的结果返回到CPU，然后CPU输出Read_image的结果即可。
在异构系统下，加速器和CPU之间共享虚拟地址空间，通过互联总线访问彼此的内存空间，并且有可能实现存储(cache)一致性。另外，IO设备/加速器可以在本地缓存(快取)CPU的页表，从而缓解CPU的输入输出内存管理单元(Input/output Memory Management Unit，IOMMU)/系统内存管理单元(System Memory Management Unit，SMMU)的查表压力，这也是当今业界PCIe总线协议下的地址翻译服务(Address Translation Service，ATS)机制，此时IO设备可以直接基于物理地址访问CPU的内存空间(也即主机侧的内存空间)。此外，加速器和加速器之间的直接P2P计算场景，也可以直接用物理地址访问彼此的物理地址空间。如此，将大大减少使用虚拟地址访问带来的地址翻译延时。
然而，IO设备/加速器通过物理地址直接访问CPU的内存空间，或者加速器与加速器之间直接用物理地址访问彼此的地址空间，会带来安全风险，特别是在IO设备/加速器是由第三方生产时。其中，主要的安全风险包括：
(1)威胁内存(地址)空间的保密性：IO设备/加速器采用物理地址读其没有读权限的物理地址空间；
(2)威胁内存(地址)空间的正确性：IO设备/加速器采用物理地址写其没有写权限的物理地址空间；
(3)威胁系统的稳健性：IO设备/加速器采用物理地址访问其没有执行权限的物理地址空间；
(4)威胁系统的隔离性(isolation)：IO设备/加速器仿冒拥有访问权限的其他IO设备/加速器的身份去访问其没有权限但该其他IO设备/加速器有权限访问的物理地址空间。
相关技术一：
请参阅图2，图2是本申请实施例提供的一种基于物理地址空间段访问权限表的物理地址访问示意图。如图2所示，基于物理地址建立一个物理地址空间段访问权限表，例如图2中的保护表(Protection Table)，这个物理地址空间段访问权限表的每个条目只需要2比特，用来指示：是否只有读(Read，简称R)权限，或者只有写(Write，简称W)权限，又或者是有读和写权限，还是既没有读权限也没有写权限；并且，这个物理地址空间段访问权限表是基于物理地址来索引的。在建立该物理地址空间段访问权限表后，IO设备/加速器通过物理地址直接访问主机侧CPU本地内存的过程如下：
第一步：将IO设备/加速器访问的物理地址基于物理地址按照物理地址空间的颗粒度(Graininess，简称GS)对齐后，获得用于索引的物理地址号(Physical Address number)，例如该物理地址的高位；然后通过该物理地址的高位来索引该物理地址空间段访问权限表。
第二步：如果通过该物理地址的高位在该物理地址空间段访问权限表可以索引到对应的条目，则进行第三步；否则，直接阻止此次物理地址访问。
第三步：判断在该物理地址空间段访问权限表中索引到的条目的权限信息是否允许此次物理地址访问；如果允许此次物理地址访问，则正常访问；否则，直接阻止此次物理地址访问。
显然，相关技术一存在如下缺点：
(1)必须要建立一个基于物理地址来索引的物理地址空间段访问权限表，但由于物理地址可能是很碎片化的(也就是离散的)，因此这个物理地址空间段访问权限表可能会跨度比较大，并且这个物理地址空间段访问权限表的每个条目并不能被连续分配使用，因为真正使用的表的条目不需要这么多，从而这个物理地址空间段访问权限表的利用率较低，特别是当物理地址空间的管理粒度比较细的时候，最终可能还是要溢出到系统内存中去，从而需要消耗内存空间等资源。
(2)所有进来的物理地址访问都要查这个物理地址空间段访问权限表，因此也会带来查表的延时；并且，当这个物理地址空间段访问权限表溢出到系统内存的时候，查表需要增加对系统内存的访问延时。
(3)对IO设备/加速器仿冒拥有访问权限的其他IO设备/加速器的身份，去访问其没有权限但其他IO设备/加速器有权限访问的物理地址空间的威胁也不能防护。
相关技术二：
请参阅图3，图3是本申请实施例提供的一种基于黑名单白名单机制的物理地址访问示意图。如图3所示，主机(Host)通过PCIe总线和PCIe设备之间互联，端点设备(Endpoint，简称EP)通过根端口(Root Port，简称RP)与RC(Root Complex)处理器连接，从而可以访问主机侧内存；其中，RC处理器连接着处理器内部的芯片总线，可以和主机侧的CPU、内存交互；一个RC可以支持一个或多个端口，每个端口下有独立的拓扑。在主机侧建立一个访问内存的黑名单白名单机制，在本地基于访问端身份号建立一个权限访问表，例如基于总线号，设备号，功能号三者(Bus number，Device number，Function number，BDF)建立一个权限访问表，对于特定的访问端才能通过这个访问表的校验，进而才能让其用物理地址访问本地内存空间。例如，访问端包括3个端点设备，其中，BDF＝08.01的端点设备和BDF＝20.00的端点设备没有访问权限，BDF＝10.00的端点设备有访问权限。
显然，相关技术二存在如下缺点：
(1)保护的粒度是很粗的：对特定的访问端的访问请求要么允许其采用物理地址进行访问，要么都不允许采用物理地址进行访问；
(2)对于同样处于白名单(允许其采用物理地址进行访问)的设备，不能保护这些设备之间彼此相互不影响，不能保证系统的隔离性(isolation)。
综上分析，本申请所要解决的技术问题可以包括如下：
在互联总线中，访问端采用物理地址访问被访问端的内存空间的时候，例如IO设备/加速器采用物理地址访问主机或CPU这端的内存空间的时候，又例如加速器和加速器之间采用物理地址访问彼此的内存空间的时候，能够快速对此次基于物理地址的访问进行安全校验，以保护被访问端这端的内存空间的安全，具体包括：
(1)保护内存(地址)空间的保密性：访问端不能直接用物理地址读其没有读权限的物理地址空间；
(2)保护内存(地址)空间的正确性：访问端不能直接用物理地址写其没有写权限的物理地址空间；
(3)保护系统的稳健性：访问端不能直接用物理地址访问其没有执行权限的物理地址空间；
(4)保护系统的隔离性：访问端不能仿冒拥有访问权限的其他访问端的身份去访问其没有权限但其他访问端有权限访问的物理地址空间。
(5)对物理地址空间的保护能够精确细分到不同的用户(例如进程/虚拟机/容器等)对不同的物理地址空间段实现基于物理地址的访问的安全隔离。
其次，示例性地介绍本申请的应用场景，以便于本领域技术人员理解本申请实施例。
请参阅图4，图4是本申请实施例提供的一种示例性的应用场景示意图，实际中的应用场景可以更加复杂多样。图4所示的系统包括主机(Host)、IO接口、多个节点设备、交换机(Switch)设备等。
其中，主机(Host)为拥有一个或者多个CPU、主存、高速缓冲存储器(例如cache)、IOMMU/SMMU模块、内部互联总线、IO互联接口、本申请实现的物理地址访问保护控制(Physical Address Accession Protection Control，PAAPC)模块等的计算系统。应理解，物理地址访问保护控制模块的实现架构位置不止本实施例中所示的一种；例如，物理地址访问保护控制模块也可以实现在IOMMU/SMMU里面，所有IO接口进来的事务访问都要经过IOMMU/SMMU模块判断处理。
其中，多个节点设备包括节点设备1、节点设备2、节点设备3和节点设备4，节点设备1、节点设备2、节点设备3和节点设备4均可以为：GPU、某处理器单元(XPU)、固态硬盘(SSD)、拥有特定计算功能的加速器、智能网卡、网络交换机等。
其中，交换机设备可以实现总线互联、路由的功能，甚至还可以拥有拥塞控制、服务质量(Quality of Service，QoS)的功能；对于其某些端口，还可以拥有直接和网络对接的功能，例如类似于网卡的功能。
其中，主机、节点设备和交换机设备之间均可以通过互联总线实现互相通信；例如，主机与节点设备或交换机设备通过互联总线实现互相通信，节点设备和交换机设备通过互联总线实现互相通信，节点设备和节点设备之间通过互联总线实现互相通信。
其中，主机、节点设备和交换机设备之间的互联总线可以是任意的互联总线，并不局限于PCIe总线，还可以是NVLink互联总线等其他互联总线。
作为一种示例，图4所示的系统还可以包括加速器(图4中未示出)，加速器可以通过互联总线和主机侧CPU连接，并且可以直接或间接通过互联总线与多个节点设备连接。
需要说明的是，为了便于描述，本申请将发出基于物理地址的访问请求的设备称为访问端(如本申请中的第二装置侧)，以及将接收基于物理地址的访问请求的设备称为被访问端(如本申请中的第一装置侧)。例如：节点设备向主机发送基于物理地址的访问请求，主机接收基于物理地址的访问请求，则节点设备称为访问端，主机称为被访问端；一个节点设备向另外一个节点设备发送基于物理地址的访问请求，另外一个节点设备接收基于物理地址的访问请求，则该节点设备称为访问端，另外一个节点设备称为被访问端；加速器向主机侧CPU发送基于物理地址的访问请求，主机侧CPU接收基于物理地址的访问请求，则加速器称为访问端，主机侧CPU称为被访问端；加速器向节点设备发送基于物理地址的访问请求，节点设备接收基于物理地址的访问请求，则加速器称为访问端，节点设备称为被访问端；节点设备向加速器发送基于物理地址的访问请求，加速器接收基于物理地址的访问请求，则节点设备称为访问端，加速器称为被访问端；等等。
请参阅图5，图5是本申请实施例提供的一种内存访问方法的流程示意图。其中，图5所示的第二装置为访问端，第一装置为被访问端。图5所示的内存访问方法可以应用于图4所示的应用场景。第一装置和第二装置通过互联总线连接。例如，第一装置或第二装置可以为以下其中一种：主机或主机侧CPU，主机侧加速器，通过IO接口与主机或主机侧CPU连接的节点设备；节点设备可以为：GPU、某处理器单元(XPU)、固态硬盘(SSD)、拥有特定计算功能的加速器、智能网卡、网络交换机等。在一种可能的实现方式中，第一装置或第二装置也可以是指上述任意一种设备中的虚拟资源，如主机中的虚拟机、设备的虚拟功能实体、操作系统、容器等。第一装置和第二装置之间的通路是安全的，第一装置与第二装置在进行数据交互时，数据在交互过程中是不会被篡改。例如，第一访问请求中携带的身份号、第一安全校验值和第一信息等不会被篡改。图5所示的内存访问方法包括但不限于如下步骤或操作：
501：第二装置向第一装置发送第一访问请求，所述第一访问请求包括身份号、第一安全校验值和第一信息，所述第一信息包括第一物理地址。
作为一种示例，本申请实施例中的身份号为一个全局唯一身份号(以下简称全局身份号)，可选地，其可以用来标识访问端(第二装置)的身份，例如，身份号为IO设备/加速器发出的访问事务(即第二装置侧)的全局唯一身份(ID)，具体可以为全局唯一标识符(Globally Unique Identifier，GUID)。作为另一种示例，可选地，身份号可以用来标识被访问端(第一装置)的身份，例如，可基于被访问目的资源(即第二装置侧)的全局唯一身份(ID)号(以下简称全局身份ID)。其中，该全局身份号可以是互联系统中的节点身份号，也可以是系统软件管理下的对应事务(例如为访问请求事务或者被访问目的资源)的全局身份号。例如，在现有PCIe技术中，本申请中的全局身份号就是总线号，设备号，功能号三者(Bus number，Device number，Function number，BDF)；如果有需要，还可以加上进程地址空间身份(Process Address Space ID，PASID)。又例如，在ARM的SMMU系统下，该全局身份号就是流身份(Stream ID)；如果有子流身份(Sub-stream ID，该全局身份号就是流身份和子流身份；还有其他体系的类似逻辑作用的ID。
需要说明的是，无论身份号是用于标识第一装置还是用于标识第二装置，该身份号在访存请求权限的校验过程中的作用都是一致的，即均是用于第一装置基于该身份号来派生不同的密钥，后续密码安全数学计算都可以基于这个派生的密钥来计算，例如基于该身份号派生出后续的第一密钥，且基于该第一密钥生成第一安全校验值和第二安全校验值，并利用上述两个校验值对该访存请求的权限进行校验等。其中，
当身份号用于标识第二装置时，第一装置可以基于第二装置发送的访问请求中的身份号识别出该第二装置的具体身份，此时可以理解的是，第一装置侧需要预先维护并存储多个第二装置的相关信息。例如，被访问端可以基于访问端身份号分别为每个访问端建立一个存储物理地址空间访问权限的区域表，或者，被访问端也可以基于访问端身份号为所有访问端建立一个存储物理地址空间访问权限的区域表。由于访问端(第二装置)的数量可能较多，因此，此种情况下可能需要维护和存储的区域表的数量就相对更多，相应地，所需的存储资源就会变多。但是，由于第一装置可以基于身份号获知具体是哪个第二装置来访问，因此可以针对性的做更精准的管控。
而当身份号用于标识第一装置时，则第一装置无法基于第二装置发送的访问请求中的身份号识别出第二装置的具体身份，此时可以理解的是，第一装置侧需要预先维护并存储自身的相关信息。例如，被访问端可以基于被访问端的身份号建立一个存储物理地址空间访问权限的区域表。此种情况下由于被访问端仅需要维护和存储自身的控制表，相应地，所需的存储资源就会变少。因此，需要的存储资源和控制资源就很少，即可以节省大量的区域表的存储和维护成本。当然，第一装置依然可以基于该身份号确定对应的第一密钥，并基于第一密钥确定第一安全校验值和第二安全校验值。
其中，上述需要预先维护并存储的区域表可以是由第一装置本身来实现，也可以是由第一装置上的操作系统、虚拟化软件、或者独立的管理软件等来实现，本申请实施例对此不作具体限定。
基于上述分析，可以看出，本申请实施例中的身份号具体标识什么，取决于第一装置侧具体存储维护的是什么。例如，如果身份号标识第一装置，那么对应地，第一装置侧存储维护的就是第一装置身份号与第一密钥的映射关系，在校验过程中，就可以通过第一装置的身份号索引到第一密钥；如果身份号标识第二装置，那么对应地，第一装置侧存储维护的就是第二装置身份号与第一密钥的映射关系，在校验过程中，就可以通过第二装置的身份号索引到第一密钥。
502：第一装置接收来自第二装置的第一访问请求。
503：第一装置根据所述身份号和所述第一信息计算得到第二安全校验值。
作为一种示例，本申请中的安全校验值可以为消息认证码(Message Authentication Code，MAC)，例如第一安全校验值与第二安全校验值均为MAC；但安全校验值的可能实现也不限于此，视具体密码安全数学计算算法而定。
504：第一装置根据所述第一安全校验值和所述第二安全校验值确定所述第二装置对所述第一物理地址的访问权限。
应理解，第一装置包括存储器，所述存储器的物理地址空间包括第一物理地址，第一物理地址与第一安全校验值对应；其中，第一安全校验值也是由第一装置基于和计算第二安全校验值一样的方法计算得到，并且由第一装置提前发送给第二装置的。
其中，第二装置对第一物理地址的访问权限包括允许访问和不允许访问，具体可以包括：只允许读，只允许写，既允许读也允许写，既不允许读也不允许写。
在本申请实施例中，第二装置在需要访问第一装置中的第一物理地址时，第二装置会向第一装置发送第一访问请求，第一访问请求中携带用于标识第一装置或第二装置的身份号、第一安全校验值和第一信息，第一信息包括需要访问的第一物理地址；第一装置在接收到第一访问请求之后，从第一访问请求中获取到身份号、第一安全校验值和第一信息，然后根据身份号和第一信息计算得到第二安全校验值，再根据第一安全校验值和第二安全校验值来确定第二装置对第一物理地址有没有访问权限。应理解，根据第一安全校验值和第二安全校验值确定第二装置对第一物理地址的访问权限，可以理解为一种校验过程；在校验通过的情况下，允许第二装置访问第一物理地址；在校验不通过的情况下，阻止第二装置访问第一物理地址。如此，本申请在直接使用物理地址访问内存空间时，存在校验过程，能够保护被访问端的物理地址空间的安全，至少包括以下方面：(1)保护物理地址空间的保密性，也即能够确保被访问端的物理地址空间不能被没有读权限的访问端进行读；(2)保护物理地址空间的正确性，也即能够确保被访问端的物理地址空间不能被没有写权限的访问端进行写；(3)保护系统的稳健性，也即能够确保被访问端的物理地址空间不能被没有执行权限的访问端进行访问；(4)保护系统的隔离性，也即能够使得被访问端的物理地址空间不能被没有访问权限的访问端冒充有访问权限的访问端而进行访问。此外，相比于被访问端通过查表的方式来确定访问权限而言，本申请能够实现“以算代查”，节省了被访问端因为要安全校验而实现复杂的数据结构(例如页表那样的数据结构)所需的资源；并且，校验只需要(硬件化的)数学计算，不存在查表等硬件动作，因此能够减低安全校验的延时，实现快速校验，大大提高安全校验的效率。
在一种可能的实现方式中，在所述接收来自第二装置的第一访问请求之前，所述方法还包括：第一装置接收来自所述第二装置的物理地址申请请求，所述物理地址申请请求包括所述身份号；第一装置针对所述身份号生成第一密钥；第一装置向所述第二装置发送所述物理地址申请请求的第一响应，所述第一响应包括所述第一安全校验值和所述第一信息，所述第一安全校验值是基于所述第一密钥计算得到的；第二装置接收来自所述第一装置的所述第一响应。
作为一种示例，密钥的派生策略可采用以下算法实现：
key_x＝fun1_RotKey(身份号，单调递增参数)；
在上述密钥的派生策略中，fun1表示派生计算函数，可以为终止密钥导出函数(Halting Key Derivation Functions，HKDF)等标准密钥派生函数；RotKey为派生计算的根密钥；单调递增参数可以为计数器值或者系统时间。需要说明的是，当被访问端采用上述密钥的派生策略更新某个全局身份号对应的密钥时，需要改变计数器值或者调用新的系统时间来生成新的密钥，以防止前后两次派生计算获得相同的密钥。
应理解，当采用上述派生策略生成第一密钥时，第一密钥＝fun1_RotKey(第一装置或第二装置的身份号，单调递增参数)。
作为一种示例，所述根据所述身份号和所述第一信息计算得到第二安全校验值，包括：根据所述身份号索引第一密钥，根据所述第一密钥和所述第一信息计算得到所述第二安全校验值。
作为一种示例，安全校验值为MAC，MAC的计算如下：MAC＝fun2_key_x(PA_x)；
上述MAC的计算公式中，fun2表示摘要计算函数，可以为安全哈希算法(Secure Hash Algorithm，SHA)2等标准摘要计算函数；key_x为密钥，fun2计算时需要密钥作为算子；PA_x表示物理地址。应理解，若PA_x为第一物理地址，key_x为第一密钥，则上述公式计算得到的MAC为第一安全校验值或第二安全校验值。需要说明的是，在采用上述MAC的计算方式计算第二安全校验值时，需要先基于第一装置或者第二装置的身份号索引到第一密钥。
在本实现方式中，第二装置在访问第一物理地址之前，需要获得第一安全校验值和第一信息，第二装置通过向第一装置发送物理地址申请请求的方式来获得第一安全校验值和第一信息，物理地址申请请求中携带第一装置或第二装置的身份号；第一装置接收来自物理地址申请请求后，获取到物理地址申请请求中的第一装置或第二装置的身份号，并针对第一装置或第二装置的身份号生成第一密钥，以及基于第一密钥计算得到的第一安全校验值，再将第一安全校验值和第一信息通过第一响应发送给第二装置。如此，可以保证第二装置通过第一访问请求访问第一物理地址的访问权限是第一装置开放给第二装置的，也即是通过合法途径获得访问权限的，对于被访问端(第一装置)而言，通过第一访问请求访问第一物理地址是预期的访问，保证了第一装置的物理地址空间的安全性。应理解，被访问端针对访问端或被访问端的身份号生成的密钥是不对外公开的，也即访问端不能获取到针对其生成的密钥，例如第一装置不会对外公开第一密钥，第一密钥不能被第二装置获取到；并且，安全校验值是基于针对访问端或被访问端的身份号生成的密钥计算得到的，例如第一安全校验值是基于针对第一装置或第二装置的身份号生成的第一密钥计算得到的，而计算安全校验值的密码安全数学计算算法是被业界和理论证明足够安全的算法；故对于任意一个访问端而言，不能仿冒、猜测获得安全校验值(包括不能仿冒、猜测获得其想要攻击的物理地址空间对应的安全校验值)，也不能仿冒、猜测获得针对其他访问端的安全校验值，因此被访问端的物理地址空间的安全性是可以保证的。例如第二装置不能仿冒、猜测获得第一安全校验值，第二装置只能向第一装置请求获取第一安全校验值；第二装置也不能获取到第一装置中未开放给第二装置访问的其他物理地址对应的安全校验值，故第二装置就无法访问该其他物理地址，如此保证了第一装置的物理地址空间的安全性。
在一种可能的实现方式中，所述第一信息还包括第一权限值，所述第一权限值用于表示所述第二装置对所述第一物理地址的第一访问权限。应理解，第一访问权限包括以下至少一项：只读，只写，既能读也能写，既不能读也不能写。
其中，第一权限值用3个比特位表示。例如，第一权限值表示为RWX，R表示读操作，W表示写操作，X表示执行操作(为便于描述，下文把X省去)；当RW＝10时，第一访问权限为只读；当RW＝01时，第一访问权限为只写；当RW＝11时，第一访问权限为既能读也能写；当RW＝00时，第一访问权限为既不能读也不能写。需要说明的是，本申请下文中描述的其他权限值采用与第一权限值相同的表示方法，例如下文中的权限值A、权限值B、第二权限值、第三权限值和第四权限值等均采用与第一权限值相同的表示方法。
作为一种示例，安全校验值为MAC，MAC的计算如下：MAC＝fun2_key_x(PA_x，pert_x)；
上述MAC的计算公式中，fun2表示摘要计算函数，可以为SHA2等标准摘要计算函数；key_x为密钥，fun2计算时需要密钥作为算子；PA_x表示物理地址；pert_x表示某一物理地址对应的权限值A，pert_x可以为编码值；某一物理地址对应的权限值A用于表示访问端对该物理地址的第一访问权限。
应理解，若第一信息包括第一物理地址和第一权限值，当采用上述MAC的计算方式计算第一安全校验值或第二安全校验值时，PA_x为第一物理地址，key_x为第一密钥，pert_x为第一权限值；其中，在采用上述MAC的计算方式计算第二安全校验值时，需要先基于第一装置或第二装置的身份号索引到第一密钥。
在本实现方式中，第一装置可以通过第一响应告知第二装置其对第一物理地址的第一访问权限，如此第二装置可以获得其对第一物理地址的第一访问权限；进一步地，第二装置在访问第一物理地址时，在第一访问请求中携带的第一信息还包括第一权限值；由于第一信息中包括的信息数量越多，第一信息越不容易被仿冒、猜测；而第一安全校验值和第二安全校验值是基于第一信息计算得到的，第一信息中包括的信息数量越多，则决定第一安全校验值和第二安全校验值的因素越多，第一安全校验值也越不容易被仿冒、猜测，第一安全校验值和第二安全校验值校验成功的可能性也就越严苛；如此，有利于保证第一装置的物理地址空间的安全性。需要说明的是，在通过密码安全数学计算算法计算得到第一安全校验值或第二安全校验值时，第一权限值可能是密码安全数学计算算法的输入参数；具体地，先基于第一物理地址推测得到第一权限值，然后将其作为密码安全数学计算算法的输入参数；或者将第一权限值的各种可能取值作为密码安全数学计算算法的输入参数，也即针对第一权限值表示的第一访问权限的各种可能均计算一个第一安全校验值或第二安全校验；由于第一信息中包括第一权限值，故在计算第二安全校验值时，无需推测得到第一权限值，或者无需针对第一访问权限均计算一个第二安全校验值用于与第一安全校验值进行校验；如此，能够减低安全校验的延时，有利于实现快速校验，大大提高安全校验的效率。
在一种可能的实现方式中，所述第一信息还包括物理地址空间的颗粒度，所述物理地址空间的颗粒度用于表征所述物理地址空间范围大小，所述物理地址空间包括所述第一物理地址。例如，所述物理地址空间包括第一物理地址空间段，所述第一物理地址空间段包括所述第一物理地址。需要说明的是，物理地址空间的颗粒度用于表征物理地址空间范围大小；也即，物理地址空间一共多少位，减去颗粒度，就是高多少位，颗粒度就是指低多少位，低多少位是用于表示物理地址空间范围。当颗粒度为n时，表示物理地址区间范围为2^n；进一步地，该物理地址空间范围起始于对齐地址，即该物理地址空间范围表示低n比特位从全的0到2^n，物理地址高比特位不变的物理地址区间。例如，假设物理地址以48比特位表示，颗粒度为8，则物理地址区间范围为256，所对应的物理地址空间范围为高40比特位不变，低8比特位从全0到256的物理地址区间；也即，只用到48bit的物理地址空间中的低8位的8bit，也就是地址空间为0000000到11111111，前面40位是没有用到的。
作为一种示例，所述根据所述身份号和所述第一信息计算得到第二安全校验值，包括：根据所述身份号索引第一密钥；若所述第一信息包括第一权限值，则根据所述第一物理地址和所述物理地址空间的颗粒度确定所述第一物理地址的高位；若所述第一信息不包括第一权限值，根据所述第一物理地址和所述物理地址空间的颗粒度确定所述第一物理地址的高位和所述第一权限值；根据所述物理地址空间的颗粒度、所述第一物理地址的高位、所述第一权限值和所述第一密钥计算得到所述第二安全校验值。
作为一种示例，安全校验值为MAC，MAC的计算如下：MAC＝fun2_key_x(range_x,pa_align,pert_x)；
上述MAC的计算公式中，fun2表示摘要计算函数，可以为SHA2等标准摘要计算函数；key_x为密钥，fun2计算时需要密钥作为算子；range_x表示物理地址空间的颗粒度，range_x可以为编码值；pa_align表示物理地址基于物理地址空间的颗粒度对齐后的高位；pert_x表示某一物理地址空间段对应的权限值A，pert_x可以为编码值。需要说明的是，一个物理地址空间段对应一个权限值A，则该物理地址空间段中的任意一个物理地址也对应该权限值A。
应理解，若第一信息包括第一物理地址和物理地址空间的颗粒度，当采用上述MAC的计算方式计算第一安全校验值或第二安全校验值时，key_x为第一密钥；range_x为第一装置或第二装置的身份号对应的物理地址空间的颗粒度；pa_align为第一物理地址基于物理地址空间的颗粒度对齐后的高位，也即第一物理地址的高位，且第一物理地址的高位可以根据第一物理地址和物理地址空间的颗粒度确定出；pert_x为第一权限值，此时第一权限值用于表示第二装置对第一物理地址空间段的第一访问权限，且第一权限值可以根据第一物理地址和物理地址空间的颗粒度确定(推测)出。其中，在采用上述MAC的计算方式计算第二安全校验值时，需要先基于第一装置或第二装置的身份号索引到第一密钥。
在本实现方式中，第一装置包括存储器，该存储器的物理地址空间包括N个物理地址空间段，N为正整数；例如，第一装置将允许第二装置访问的物理地址空间按照一定的(可编程)颗粒度划分为N个物理地址空间段；第一装置在接收到来自第二装置的物理地址申请请求之后，可以针对N个物理地址空间段中的每个物理地址空间段计算一个安全校验值，以得到N个安全校验值，N个安全校验值与N个物理地址空间段对应，且N个安全校验值是基于第一密钥计算得到的；第一装置向第二装置发送的第一响应包括物理地址空间的颗粒度、N个物理地址空间段和N个安全校验值。由于第一物理地址空间段是N个物理地址空间段中的其中一个物理地址空间段，而第一物理地址是第一物理地址空间段中的其中一个物理地址，故N个安全校验值中与第一物理地址空间段对应的安全校验值即为第一安全校验值，也即N个安全校验值包括第一安全校验值；此种情况下，第一信息包括第一响应中的物理地址空间的颗粒度和第一物理地址空间段中的第一物理地址。第二装置在访问第一物理地址时，在第一访问请求中携带的第一信息还包括物理地址空间的颗粒度；由于第一信息中包括的信息数量越多，第一信息越不容易被仿冒、猜测；而第一安全校验值和第二安全校验值是基于第一信息计算得到的，第一信息中包括的信息数量越多，则决定第一安全校验值和第二安全校验值的因素越多，第一安全校验值也越不容易被仿冒、猜测，第一安全校验值和第二安全校验值校验成功的可能性也就越严苛；如此，有利于保证第一装置的物理地址空间的安全性。应理解的是，第二装置在访问第一物理地址空间段中的其他物理地址时，在对应的访问请求中携带的安全校验值也是第一安全校验值；如此，对于任意一个物理地址空间段，针对其计算一个安全校验值，使得该物理地址空间段中的所有物理地址均对应同一个安全校验值，访问端在访问该物理地址段中的每个物理地址时，均携带同一个安全校验值，而无需针对该物理地址空间段中的每个物理地址均携带不同的安全校验值，从而可以减少开销。
在一种可能的实现方式中，所述第一权限值还用于表示所述第二装置对所述第一物理地址空间段的第一访问权限。其中，第一装置包括存储器，该存储器的物理地址空间包括N个物理地址空间段，N为正整数；第一装置在接收到来自第二装置的物理地址申请请求之后，可以针对N个物理地址空间段中的每个物理地址空间段确定一个权限值A，以得到N个权限值A，N个权限值A与N个物理地址空间段对应，N个权限值A中的任意一个权限值A用于表示第二装置对与该任意一个权限值A对应的物理地址空间段的第一访问权限；第一装置向第二装置发送的第一响应包括物理地址空间的颗粒度、N个物理地址空间段、N个安全校验值和N个权限值A。由于第一物理地址空间段是N个物理地址空间段中的其中一个物理地址空间段，而第一物理地址是第一物理地址空间段中的其中一个物理地址，故N个权限值A中与第一物理地址空间段对应的权限值A即为第一权限值，也即N个权限值A包括第一权限值；此种实现方式中，第一信息包括第一响应中的物理地址空间的颗粒度、第一物理地址空间段中的第一物理地址和N个权限值A中的第一权限值。应理解的是，第二装置在访问第一物理地址空间段中的其他物理地址时，在对应的访问请求中携带的权限值A也是第一权限值；如此，对于任意一个物理地址空间段，针对其确定一个权限值A，使得该物理地址空间段中的所有物理地址均对应同一个权限值A，访问端在访问该物理地址段中的每个物理地址时，均携带同一个权限值A，而无需针对该物理地址空间段中的每个物理地址均携带不同的权限值A，从而可以减少开销。
作为一种示例，安全校验值为MAC，MAC的计算如下：MAC＝fun2_key_x(range_x,pa_align,pert_x)；
上述MAC的计算公式中，fun2表示摘要计算函数，可以为SHA2等标准摘要计算函数；key_x为密钥，fun2计算时需要密钥作为算子；range_x表示物理地址空间的颗粒度，range_x可以为编码值；pa_align表示物理地址基于物理地址空间的颗粒度对齐后的高位；pert_x表示某一物理地址空间段对应的权限值A，pert_x可以为编码值。
应理解，若第一信息包括第一物理地址、物理地址空间的颗粒度和第一权限值，当采用上述MAC的计算方式计算第一安全校验值或第二安全校验值时，key_x为第一密钥；range_x为第一装置或第二装置的身份号对应的物理地址空间的颗粒度；pa_align为第一物理地址基于物理地址空间的颗粒度对齐后的高位，也即第一物理地址的高位，且第一物理地址的高位可以根据第一物理地址和物理地址空间的颗粒度确定出；pert_x为第一权限值，此时第一权限值用于表示第二装置对第一物理地址空间段的第一访问权限。其中，在采用上述MAC的计算方式计算第二安全校验值时，需要先基于第一装置或第二装置的身份号索引到第一密钥；且此种情况下，第一权限值是第一访问请求中携带的。
在本实现方式中，第二装置在访问第一物理地址时，在第一访问请求中携带的第一信息还包括第一权限值；由于第一信息中包括的信息数量越多，第一信息越不容易被仿冒、猜测；而第一安全校验值和第二安全校验值是基于第一信息计算得到的，第一信息中包括的信息数量越多，则决定第一安全校验值和第二安全校验值的因素越多，第一安全校验值也越不容易被仿冒、猜测，第一安全校验值和第二安全校验值校验成功的可能性也就越严苛；如此，有利于保证第一装置的物理地址空间的安全性。需要说明的是，在通过密码安全数学计算算法计算得到第一安全校验值或第二安全校验值时，第一权限值可能是密码安全数学计算算法的输入参数；具体地，先基于第一物理地址和物理地址空间的颗粒度推测得到第一权限值，然后将其作为密码安全数学计算算法的输入参数；或者将第一权限值的各种可能取值作为密码安全数学计算算法的输入参数，也即针对第一权限值表示的第一访问权限的各种可能均计算一个第一安全校验值或第二安全校验；由于第一信息中包括第一权限值，故在计算第二安全校验值时，无需推测得到第一权限值，或者无需针对第一访问权限均计算一个第二安全校验值用于与第一安全校验值进行校验；如此，能够减低安全校验的延时，有利于实现快速校验，大大提高安全校验的效率。
在一种可能的实现方式中，所述根据所述第一安全校验值和所述第二安全校验值确定所述第二装置对所述第一物理地址的访问权限，包括：将所述第一安全校验值与所述第二安全校验值进行校验；若所述第一安全校验值与所述第二安全校验值校验成功，则确定所述第二装置对所述第一物理地址的访问权限为允许访问。其中，访问权限为允许访问包括以下至少一项：只允许读，只允许写，既允许读也允许写。
在本实现方式中，当且仅当第一安全校验值与第二安全校验值校验成功了，才能允许第二装置访问第一物理地址，也即第二装置对第一物理地址的访问权限为允许访问。其中，第一安全校验值与第二安全校验值校验成功可以指第一安全校验值与第二安全校验值相同，例如第一安全校验值与第二安全校验值为MAC的情况时；但也不限于此，视具体密码安全数学计算算法而定。
在一种可能的实现方式中，所述第一安全校验值和所述第二安全校验值是基于第一密钥计算得到的；所述方法还包括：第一装置针对所述身份号生成第二密钥；第一装置向所述第二装置发送无效命令，所述无效命令用于无效所述第一物理地址或第一物理地址空间段；第二装置接收来自所述第一装置的所述无效命令；第二装置向所述第一装置发送无效命令的响应；第一装置接收来自所述第二装置的所述无效命令的响应；在接收来自所述第二装置的所述无效命令的响应之后，或在所述无效命令超时之后，第一装置采用所述第二密钥替代所述第一密钥。
其中，第一装置针对第一装置或第二装置的身份号生成第二密钥的过程，可对应参照生成第一密钥的过程，此处不再赘述。
其中，采用第二密钥替代第一密钥可以指：不再采用第一密钥计算安全校验值，仅采用第二密钥计算安全校验值。
可选地，第二装置在接收到无效命令之后，不再向第一装置发送访问第一物理地址或第一物理地址空间段的访问请求。
在本实现方式中，在需要改变第二装置对第一物理地址或第一物理地址空间段的访问权限的时候，例如在需要使得第二装置对第一物理地址或第一物理地址空间段没有访问权限的时候，也即在无效第一物理地址或第一物理地址空间段的时候，可以针对第一装置或第二装置的身份号重新生成第二密钥，采用重新生成的第二密钥替代原来的第一密钥进行安全校验。之后，第二装置再次访问第一物理地址或第一物理地址空间段时，在访问请求中携带的安全校验值还是第一安全校验值，第一安全校验值是基于第一密钥计算得到的；第一装置接收到该访问请求后，基于第二密钥计算安全校验值，故第一装置计算得到的安全校验值和该访问请求中携带的第一安全校验值会校验不成功，从而阻止第二装置访问第一物理地址或第一物理地址空间段，也即使得第二装置对第一物理地址或第一物理地址空间段没有访问权限。如此，若被访问端需要改变访问端对某个物理地址或物理地址空间段的访问权限，被访问端可以针对访问端的身份号或者被访问端的身份号重新生成新的密钥，替代旧的密钥，以实现改变访问端对这个物理地址或物理地址空间段的访问权限；从而被访问端能够灵活管理物理地址空间，包括动态分配物理地址空间段，动态修改分配出去的物理地址空间段的访问权限，动态回收分配出去的物理地址空间段；并且，当身份号用于标识第二装置即访问端时，被访问端在管理物理地址空间时，可以精细到各个第二装置的身份号，以保证不同身份号之间互相不影响。
在一种可能的实现方式中，在向所述第二装置发送无效命令之后，在接收所述无效命令的响应之前，或在所述无效命令超时之前，所述方法还包括：接收来自所述第二装置的安全校验值获取请求，所述安全校验值获取请求包括所述身份号、第三安全校验值和第二信息，所述第三安全校验值是基于所述第一密钥计算得到的，所述第二信息包括第二物理地址；根据所述身份号、所述第二信息和所述第一密钥计算得到第四安全校验值；将所述第三安全校验值与所述第四安全校验值进行校验；若所述第三安全校验值与所述第四安全校验值校验成功，则向所述第二装置发送所述安全校验值获取请求的第二响应，所述第二响应包括第五安全校验值，所述第五安全校验值是基于所述第二密钥计算得到的。应理解，第一装置包括存储器，该存储器的物理地址空间包括第二物理地址，第二物理地址与第一物理地址不同，也即第二物理地址不是要被无效掉的；其中，第二物理地址与第三安全校验值对应，且第三安全校验值也是由第一装置基于和计算第四安全校验值一样的方法计算得到，并且由第一装置提前发送给第二装置的。
其中，第三安全校验值和第四安全校验值的计算过程，可以对应参照第一安全校验值和第二安全校验值的计算过程，此处不再赘述。此外，第五安全校验值的计算过程也可以参照第一安全校验值的计算过程，但需要将第一密钥替换成第二密钥。
其中，第三安全校验值与第四安全校验值的校验过程，可以对应参照第一安全校验值与第二安全校验值的校验过程，此处不再赘述。
在本实现方式中，在无效第一物理地址或第一物理地址空间段的时候，由于第一装置针对第一装置或第二装置的身份号重新生成了第二密钥，以替代第一密钥；而对于没有被无效的第二物理地址，其对应的第三安全校验值是基于第一密钥计算得到的，第二装置为了确保对第二物理地址仍然具备访问权限，第二装置需要获取到第二物理地址对应的基于第二密钥计算得到的第五安全校验值，第五安全校验值可以用于替代第三安全校验值；故第二装置向第一装置发送安全校验值获取请求，第一装置通过第二响应将第五安全校验值发送给第二装置，从而保证第二装置对第二物理地址仍然具备访问权限。需要说明的是，访问端向被访问端重新获取安全校验值时，也是需要进行安全校验的，从而进一步保护了被访问端的物理地址空间的安全。应理解，对于要被无效的第一物理地址或第一物理地址空间段，即使第二装置请求重新获取基于第二密钥针对第一物理地址或第一物理地址空间段计算得到的新的安全校验值，第一装置不会发送新的安全校验值；如此对于要被无效的物理地址或物理地址空间段，则不再给访问端新的安全校验值，而访问段又不能猜测到新的安全校验值，故访问端必然不能通过被访问端的校验，也即没有了被无效的物理地址或物理地址空间段的访问权限，从而保护了被访问端的物理地址空间的安全。
在一种可能的实现方式中，所述第二信息还包括第二权限值，所述第二权限值用于表示所述第二装置对所述第二物理地址的第一访问权限。需要说明的是，本实现方式的具体过程及有益效果可以对应参照上述相关实现方式的描述，此处不再重复描述。
在一种可能的实现方式中，所述第二信息还包括物理地址空间的颗粒度，所述物理地址空间的颗粒度用于表征所述物理地址空间范围大小，所述物理地址空间包括所述第二物理地址。例如，所述物理地址空间包括第二物理地址空间段，所述第二物理地址空间段包括所述第二物理地址。需要说明的是，本实现方式的具体过程及有益效果可以对应参照上述相关实现方式的描述，此处不再重复描述。
应理解，第二物理地址空间段可是N个物理地址空间段中除第一物理地址空间段之外的任意一个，也即第二物理地址空间段为无需被无效的物理地址空间段，其可以继续被第二装置访问。进一步地，而对于无需被无效的物理地址空间段，需要为其重新分配安全校验值，以确保其可以继续被访问，故第一装置向第二装置发送第五安全校验值，第五安全校验值不仅用于访问第二物理地址时的校验，还用于访问第二物理地址空间段中的所有物理地址时的校验。
在一种可能的实现方式中，所述第二权限值还用于表示所述第二装置对所述第二物理地址空间段的第一访问权限。需要说明的是，本实现方式的具体过程及有益效果可以对应参照上述相关实现方式的描述，此处不再重复描述。
在一种可能的实现方式中，在向所述第二装置发送无效命令之后，在接收所述无效命令的响应之前，或在所述无效命令超时之前，所述方法还包括：接收来自所述第二装置的第二访问请求，所述第二访问请求包括所述身份号、第六安全校验值和第三信息，所述第三信息包括第三物理地址；根据所述身份号、所述第三信息和所述第一密钥计算得到第七安全校验值，以及根据所述身份号、所述第三信息和所述第二密钥计算得到第八安全校验值；将所述第六安全校验值分别与所述第七安全校验值和所述第八安全校验值进行校验；若所述第六安全校验值与所述第七安全校验值校验成功，或所述第六安全校验值与所述第八安全校验值校验成功，则确定所述第二装置对所述第三物理地址的访问权限为允许访问。应理解，第一装置包括存储器，该存储器的物理地址空间包括第三物理地址，第三物理地址与第一物理地址不同，也即第三物理地址不是要被无效掉的；其中，第三物理地址与第六安全校验值对应，且第六安全校验值也是由第一装置基于和计算第七安全校验值或第八安全校验值一样的方法计算得到，并且由第一装置提前发送给第二装置的。其中，在发送无效命令之后，接收无效命令的响应之前，或在无效命令超时之前，第一装置接收到的访问请求携带的安全校验值可能是基于旧的密钥计算得到的，也可能是基于新的密钥计算得到的；例如，第六安全校验值可能是基于第一密钥计算得到的，也可能是基于第二密钥计算得到的。
其中，第六安全校验值的计算过程可以对应参照第一安全校验值或第五安全校验值的计算过程，第七安全校验值的计算过程可以对应参照第二安全校验值的计算过程，第八安全校验值的计算过程也可以参照第五安全校验值的计算过程，此处不再赘述。
其中，第六安全校验值与第七安全校验值的校验过程，以及第六安全校验值与第八安全校验值的校验过程，可以对应参照第一安全校验值与第二安全校验值的校验过程，此处不再赘述。
在本实现方式中，虽然第一装置在发送无效命令之前，已经针对第二装置重新生成了第二密钥，但是，在第一装置发送无效命令之后，以及在接收无效命令的响应之前，或在无效命令超时之前，第一密钥和第二密钥是短暂共存的；故在此时间段内，如果第一装置接收来自第二装置的第二访问请求，只要第六安全校验值与第七安全校验值和第八安全校验值中的任意一个校验成功，都是允许第二装置访问第三物理地址的，从而保证了在无效第一物理地址或第一物理地址空间段的过程中，第二装置可以正常访问未被无效的第三物理地址。需要说明的是，在更新密钥的过程中，本申请在某段时间内利用了旧的密钥和新的密钥双密钥短暂共存的机制；其中，旧的密钥只用于计算校验用的安全校验值，不再用于计算需要发送给访问端的新的安全校验值；而新的密钥则既可以用于计算校验用的安全校验值，也用于计算需要发送给访问端的新的安全校验值；如此，使用双密钥短暂共存的机制，可以避免因更新密钥而对其他物理地址或其他物理地址空间段的访问带来影响。
在一种可能的实现方式中，所述第三信息还包括第三权限值，所述第三权限值用于表示所述第二装置对所述第三物理地址的第一访问权限。需要说明的是，本实现方式的具体过程及有益效果可以对应参照上述相关实现方式的描述，此处不再重复描述。
在一种可能的实现方式中，所述第三信息还包括物理地址空间的颗粒度，所述物理地址空间的颗粒度用于表征所述物理地址空间范围大小，所述物理地址空间包括所述第三物理地址。例如，所述物理地址空间包括第三物理地址空间段，所述第三物理地址空间段包括所述第三物理地址。需要说明的是，本实现方式的具体过程及有益效果可以对应参照上述相关实现方式的描述，此处不再重复描述。
在一种可能的实现方式中，所述第三权限值还用于表示所述第二装置对所述第三物理地址空间段的第一访问权限。需要说明的是，本实现方式的具体过程及有益效果可以对应参照上述相关实现方式的描述，此处不再重复描述。
在一种可能的实现方式中，所述第一装置包括区域表，所述区域表包括第一索引号和第四权限值，所述第一索引号与所述第四权限值对应，所述第四权限值用于表示所述第一物理地址或第一物理地址空间段的第二访问权限；所述第一信息还包括所述第一索引号。需要说明的是，当身份号用于标识第二装置时，被访问端可以基于访问端的身份号分别为每个访问端建立一个存储物理地址空间访问权限的区域表，也可以基于访问端的身份号为所有访问端建立一个存储物理地址空间访问权限的区域表，或者，当身份号用于标识第一装置时，被访问端可以基于被访问端的身份号建立一个存储物理地址空间访问权限的区域表。例如，区域表的每个条目只需要少量的几比特，用来存储物理地址或物理地址空间段的访问权限，区域表可以是一个连续的并且跨度可控的轻量级表；而且，若区域表的条目用来存储物理地址空间段的访问权限，则区域表的每个条目都可以连续分配使用，不和具体的物理地址绑定，从而不会造成区域表的条目可能想使用但因物理地址空间很离散而使用不到的情况。其中，第一装置包括存储器，该存储器的物理地址空间包括N个物理地址空间段，N为正整数；第一装置在接收到来自第二装置的物理地址申请请求之后，可以针对N个物理地址空间段中的每个物理地址空间段在区域表中建立一个条目，从而区域表中包括N个条目，N个条目与N个物理地址空间段对应；并且，N个条目中的每个条目中用于存储对应的物理地址空间段的访问权限，每个条目包括区域号、索引号和权限值B，其中，区域号用于表示该条目对应的物理地址空间段，索引号用于索引该条目中的权限值B，权限值B用于表示该条目对应的物理地址空间段的第二访问权限，故N个条目有N个索引号和N个权限值B，N个物理地址空间段、N个索引号和N个权限值B是一一对应的；第一装置向第二装置发送的第一响应包括N个索引号。应当理解，N个索引号中与第一物理地址空间段对应的索引号即为第一索引号，第一信息可以包括第一索引号。第二装置在访问第一物理地址空间段中的其他物理地址时，在对应的访问请求中携带的索引号也是第一索引号；如此，对于任意一个物理地址空间段，其在区域表中对应一个索引号，故该物理地址空间段中的所有物理地址均对应同一个索引号，访问端在访问该物理地址段中的每个物理地址时，均携带同一个索引号，而不是针对该物理地址空间段中的每个物理地址均携带不同的索引号，从而可以减少开销。
其中，第二访问权限包括以下至少一项：只读，只写，既能读也能写，既不能读也不能写。举例来说，表1为一个区域表的示例。
表1区域表
在表1中，一共有4个物理地址空间段的条目，分别为物理地址空间段PA0、物理地址空间段PA1、物理地址空间段PA2和物理地址空间段PA3的条目；R表示读权限，W表示写权限。应理解，当对某一个物理地址空间段有某一权限时，那么这个物理地址空间段的所有物理地址都有这个权限；例如，物理地址空间段PA0允许写，那么物理地址空间段PA0中的所有物理地址都允许写。
作为一种示例，所述根据所述身份号和所述第一信息计算得到第二安全校验值，包括：根据所述身份号索引第一密钥；若所述第一信息包括第一权限值，则根据所述第一物理地址和所述物理地址空间的颗粒度确定所述第一物理地址的高位；若所述第一信息不包括第一权限值，根据所述第一物理地址和所述物理地址空间的颗粒度确定所述第一物理地址的高位和所述第一权限值；根据所述物理地址空间的颗粒度、所述第一物理地址的高位、所述第一权限值、所述第一索引号和所述第一密钥计算得到所述第二安全校验值。
作为一种示例，本申请中的安全校验值为MAC，MAC的计算如下：MAC＝fun2_key_x(range_x,pa_align,pert_x,range index)；
其中，fun2表示摘要计算函数；key_x为密钥；range_x表示物理地址空间的颗粒度；pa_align表示物理地址基于物理地址空间的颗粒度对齐后的高位；pert_x表示物理地址空间段对应的权限值A，物理地址空间段对应的权限值A用于表示访问端对该物理地址空间段的第一访问权限；range index表示区域表的索引号。应理解，若range_x为第一信息中的物理地址空间的颗粒度，pa_align为第一物理地址基于物理地址空间的颗粒度对齐后的高位，pert_x为第一权限值，range index为第一索引号，key_x为第一密钥，则上述公式计算得到的MAC为第一安全校验值或第二安全校验值。
在本实现方式中，第一装置包括区域表，第一信息还包括第一索引号，基于第一索引号可以在区域表中索引到第四权限值，第四权限值用于表示第一物理地址或第一物理地址空间段的第二访问权限，第一物理地址空间段包括第一物理地址，第一装置可以通过第一响应将第一索引号发送给第二装置；第二装置在访问第一物理地址时，在第一访问请求中携带的第一信息还包括第一索引号；由于第一信息中包括的信息数量越多，第一信息越不容易被仿冒、猜测；而第一安全校验值和第二安全校验值是基于第一信息计算得到的，第一信息中包括的信息数量越多，则决定第一安全校验值和第二安全校验值的因素越多，第一安全校验值也越不容易被仿冒、猜测，第一安全校验值和第二安全校验值校验成功的可能性也就越严苛；如此，有利于保证第一装置的物理地址空间的安全性。应理解的是，若第四权限值用于表示第一物理地址空间段的第二访问权限，第二装置在访问第一物理地址空间段中的其他物理地址时，在对应的访问请求中携带的区域表中的索引号也是第一索引号；如此，对于任意一个物理地址空间段，在建立区域表时针对其确定一个索引号，如此该物理地址空间段中的所有物理地址均对应同一个索引号，访问端在访问该物理地址段中的每个物理地址时，均携带同一个索引号，而不是针对该物理地址空间段中的每个物理地址均携带不同的索引号，从而可以减少开销。
在一种可能的实现方式中，所述根据所述第一安全校验值和所述第二安全校验值确定所述第二装置对所述第一物理地址的访问权限，包括：将所述第一安全校验值与所述第二安全校验值进行校验；若所述第一安全校验值与所述第二安全校验值校验成功，且所述第四标权限值表示的第二访问权限为允许访问，则确定所述第二装置对所述第一物理地址的访问权限为允许访问。应理解，当存在区域表时，安全校验值校验成功以后，还去查区域表；如果查区域表得到的第四权限值表示的第二访问权限为允许访问时，才允许访问。
其中，在存在区域表的情况下，第一安全校验值与第二安全校验值的校验过程和不存在区域表的情况下是相同的。
在本实现方式中，当且仅当第一安全校验值与第二安全校验值校验成功，且基于第一访问请求携带的第一索引号在区域表中索引到的第四标权限值表示的第二访问权限为允许访问时，才能允许第二装置访问第一物理地址，也即第二装置对第一物理地址的访问权限为允许访问。如此，在建立了区域表的基础上，访问端发出的访问请求还需要携带区域表的索引号；并且，被访问端基于访问请求携带的区域表的索引号，在本地区域表中索引此访问请求将要访问的物理地址或物理地址空间段的条目，以获得对应的权限值；针对此访问请求，只有安全校验值校验成功且在区域表中索引到的权限值表示的第二访问权限为允许访问时，才能允许此访问请求继续访问；否则，阻止此访问请求的继续访问。
在一种可能的实现方式中，所述方法还包括：将所述区域表中的所述第四权限值修改为第五权限值。
其中，第五权限值可以为任意期望的值；例如，第四权限值表示的第二访问权限为只允许写，那么第五权限值表示的第二访问权限可以包括：只允许读，即允许读也允许写，即不允许读也不允许写。
在本实现方式中，在需要改变第二装置对第一物理地址或第一物理地址空间段的访问权限的时候，例如在需要使得第二装置对第一物理地址或第一物理地址空间段没有访问权限的时候，也即在无效第一物理地址或第一物理地址空间段的时候，第一装置仅需要将区域表中的第四权限值修改为第五权限值，例如第五权限值用于表示第一物理地址或第一物理地址空间段的第二访问权限为不允许访问；之后，第二装置再次访问第一物理地址或第一物理地址空间段时，第一装置基于访问请求中携带的第一索引号在区域表中索引到的是第五权限值，而第五权限表示的第二访问权限为不允许访问，从而阻止了第二装置访问第一物理地址或第一物理地址空间段，实现改变第二装置对第一物理地址或第一物理地址空间段的访问权限。如此，若被访问端需要改变访问端对某个物理地址或物理地址空间段的访问权限，如果该物理地址或物理地址空间段在区域表中有对应的条目存在，则被访问端无需针对访问端或被访问端的身份号重新生成密钥，直接修改区域表中对应条目的权限值即可，例如可以直接修改对应条目的权限值为期望的值，而保持针对访问端或被访问端的身份号的密钥不变，从而可以减少被访问端因为需要改变物理地址或物理地址空间段的访问权限而更新密钥的频率和额外开销，以及提高物理地址空间回收的效率(例如提高无效物理地址或物理地址空间段的效率)。
下面通过具体示例对图5所示的内存访问方法进行更详细的介绍。
一、物理地址访问安全保护。
请参阅图6，图6是图5所示的内存访问方法的一种可能的实现示例的流程示意图，该可能的实现示例的流程包括但不限于如下步骤或操作：
601：访问端向被访问端发送翻译请求(Translation Request)。
应理解，访问端在向被访问端发起基于物理地址的访问请求之前，需要通过一定的机制获得访问的物理地址；也即访问端需要向被访问端发送物理地址申请请求，以从被访问端处获取访问的物理地址。例如，如果访问端和被访问端之间的互联总线是PCIe总线，则其可以通过PCIe的地址翻译服务(Address Translation Service，ATS)机制来获得要访问的物理地址空间对应的物理地址，或者是类似ATS机制的其他机制获得要访问的物理地址空间对应的物理地址。
其中，当身份号用于标识第一装置时，访问端向被访问端发送的翻译请求中携带被访问端的全局身份号，被访问端的全局身份号用于标识访问端的身份。当身份号用于标识第二装置时，访问端向被访问端发送的翻译请求中携带访问端的全局身份号，访问端的全局身份号用于标识访问端的身份。
其中，图6是以PCIe总线下的ATS机制为例，访问端向被访问端发送的翻译请求是物理地址申请请求的一个具体示例。
602：被访问端针对访问端生成密钥(key_x)，以及计算消息认证码(Message Authentication Code，MAC)。
需要说明的是，如果访问端是首次向被访问端申请物理地址，被访问端之前没有为这个访问端派生过密钥，则被访问端在接收到来自访问端的翻译请求后，需要为这个访问端派生密钥。具体地，被访问端基于翻译请求中携带的访问端或者被访问端的全局身份号来派生密钥；例如，被访问端本地存储根密钥(RotKey)，当访问端申请物理地址时，被访问端基于根密钥针对访问端或者被访问端的全局身份号生成第一密钥。其中，密钥的派生策略可采用以下算法实现：
key_x＝fun1_RotKey(全局身份号，单调递增参数)；
在上述密钥的派生策略中，fun1表示派生计算函数，可以为终止密钥导出函数(Halting Key Derivation Functions，HKDF)等标准密钥派生函数；RotKey为派生计算的根密钥；单调递增参数可以为计数器值或者系统时间。需要说明的是，当被访问端采用上述密钥的派生策略更新某个全局身份号对应的密钥时，需要改变计数器值或者调用新的系统时间来生成新的密钥，以防止前后两次派生计算获得相同的密钥。
进一步地，被访问端还对允许访问端访问的物理地址空间按照一定的颗粒度进行密码安全数学计算，例如足够安全的对称分组加密(AES-CMAC)算法。具体地，被访问端会针对访问端确定其物理地址空间的颗粒度、物理地址基于物理地址空间的颗粒度对齐后的高位(也即该物理地址的高位)、物理地址空间中的各个物理地址空间段对应的权限值A，其中，物理地址空间的颗粒度可以为该颗粒度的编码值，任意一个权限值A用于表示访问端对该权限值A对应的物理地址空间段的第一访问权限的，任意一个权限值A可以为对应物理地址空间段的第一访问权限的编码值；并且还基于第一密钥进行密码安全数学计算，以获得对应的安全校验值。
作为一种示例，安全校验值为MAC，其中MAC的计算如下：MAC＝fun2_key_x(range_x,pa_align,pert_x)；
上述MAC的计算公式中，fun2表示摘要计算函数，可以为安全哈希算法(Secure Hash Algorithm，SHA)2等标准摘要计算函数；key_x为密钥，例如第一密钥，fun2计算时需要密钥作为算子；range_x表示物理地址空间的颗粒度，range_x可以为编码值；pa_align表示物理地址基于物理地址空间的颗粒度对齐后的高位；pert_x表示某一物理地址空间段对应的权限值A，pert_x可以为编码值。
可选地，被访问端还可以基于访问端或者被访问端的全局身份号来建立一个物理地址空间的轻量级的区域表，区域表的每个条目只需要少量的几比特，每个条目用来存储对应区域号所表示的物理地址空间段的第二访问权限，这个区域表是一个连续的并且跨度可控的轻量级表，而且区域表的每个条目都可以连续分配使用，不和具体的物理地址绑定，从而不会造成区域表的条目可能想使用，但因物理地址空间很离散而使用不到的情况。在本申请中可选择建立或者不建立这个区域表。
如图6所示，被访问端开放给访问端的物理地址空间包括的N个物理地址空间段为物理地址空间段PA0、物理地址空间段PA1、物理地址空间段PA2和物理地址空间段PA3，且区域表中包括：物理地址空间段PA0、物理地址空间段PA1、物理地址空间段PA2和物理地址空间段PA3；物理地址空间段PA0、物理地址空间段PA1、物理地址空间段PA2和物理地址空间段PA3对应的索引号(range index)，依次为0-3；物理地址空间段PA0、物理地址空间段PA1、物理地址空间段PA2和物理地址空间段PA3对应的权限值B，其中，任意一个权限值B用于表示对应的物理地址空间段的第二访问权限。
作为一种示例，当区域表包括某个物理地址空间段对应的权限值B时，在计算该物理地址空间段对应的MAC时的输入参数还包括物理地址空间段对应的权限值B，具体如下：MAC＝fun2_key_x(range_x,pa_align,pert_x,range index)；
上述MAC的计算公式中，range index表示该物理地址空间段在被访问端建立的区域表中对应的索引号；其他参数的含义如前描述。
应理解，针对物理地址空间段PA0、物理地址空间段PA1、物理地址空间段PA2和物理地址空间段PA3，被访问端可以采用相同的方法分别计算得到对应的MAC。
需要说明的是，图6中的区域表在本申请中是可选实现的，而且对应的表的条目可选地存储或不存储某个物理地址空间段的权限值B。此外，图6计算得到的安全校验值为MAC；本领域技术人员应当理解，本申请中的安全校验值不仅可以为MAC，还可以为其他。
603：被访问端向访问端发送翻译响应(Translation Response)。
其中，图6是以PCIe总线下的ATS机制为例，被访问端向访问端发送的翻译响应是物理地址申请请求的第一响应的一个具体示例。
其中，翻译响应包括：被访问端开放给访问端的物理地址空间的颗粒度、被访问端开放给访问端的物理地址空间段(例如物理地址空间段PA0、物理地址空间段PA1、物理地址空间段PA2和物理地址空间段PA3)、被访问端开放给访问端的各个物理地址空间段对应的MAC(例如物理地址空间段PA0、物理地址空间段PA1、物理地址空间段PA2和物理地址空间段PA3对应的MAC)等；可选地，当被访问端开放给访问端的物理地址空间段在区域表中对应有权限值B时，翻译响应还包括该物理地址空间段对应的索引号(例如物理地址空间段PA0、物理地址空间段PA1、物理地址空间段PA2和物理地址空间段PA3对应的索引号：0-3)。
需要说明的是，图6中访问端主动向被访问端发起物理地址申请请求，这仅是一种可能的实现方式，也可以是被访问端这边主动把图6中的翻译响应同步给访问端(例如NVLink下的传统地址翻译模式)，不需要访问端主动发出翻译请求，此处可以不局限于此。
604：访问端向被访问端发送访问请求(Access Request)。
例如，访问端向被访问端发送第一访问请求，第一访问请求用于请求访问的第一物理地址空间段为物理地址空间段PA0；第一访问请求包括：访问端或者被访问端的全局身份号、第一安全校验值(物理地址空间段PA0对应的MAC)、第一物理地址(物理地址空间段PA0中的一个物理地址)和被访问端开放给访问端的物理地址空间的颗粒度；可选地，第一访问请求还包括第一索引号(物理地址空间段PA0在被访问端建立的区域表中对应的索引号0)。
605：被访问端进行安全校验。
其中，被访问端接收到来自访问端的访问请求之后，根据访问请求中是否携带区域表的索引号，进行安全校验的过程不同。具体如下所示：
第一种：访问请求不携带区域表的索引号。
基于访问请求携带的全局身份号索引到密钥(key_x)；根据访问请求携带的物理地址空间的颗粒度(range_x)和物理地址来获得对齐后的物理地址的高位(pa_align)，以及获得访问请求所要访问的物理地址空间段对应的权限值A(pert_x)；然后用基于key_x，以{range_x,pa_align,pert_x}为输入参数进行密码安全数学计算，得到MAC_x1和MAC_x2。其中，MAC_x1和MAC_x2的计算如下：MAC_x1＝fun2_key_x(range_x,pa_align,pert_x1)；MAC_x2＝fun2_key_x(range_x,pa_align,pert_x2)；
其中，pert_x包括pert_x1和pert_x2，pert_x1和pert_x2分别是根据此次访问请求的类型所获得的此次访问请求对应的权限值A的两种情况，pert_x1表示的第二权限为只读和读写，pert_x2表示的第二权限为只写和读写。作为一种示例，访问请求中也可以携带pert_x1和pert_x2，如此被访问端无需通过计算得到pert_x1和pert_x2。
需要说明的是，针对第一访问权限为只读和读写以及第一访问权限为只写和读写两种情况，均计算了对应的安全校验值，例如pert_x1和pert_x2，带来的有益效果包括：访问请求可以不需要携带权限，减少访问请求的报文开销；被访问端不需要查权限后才能开始计算，减少校验延时。应理解，具体的实施可以灵活实现，不限于此处描述的情况。
进一步需要说明的是，被访问端进行密码安全数学计算得到的值有两个，分别为MAC_x1和MAC_x2，且MAC_x1和MAC_x2分别对应pert_x的两种可能取值，被访问端用本地计算出来MAC_x1和MAC_x2和访问请求携带的MAC进行校验，如果其中的任何一个与访问请求携带的MAC校验成功，则校验通过，允许访问；否则校验不通过，阻止访问。应理解，两个MAC进行校验是指两个MAC进行比对，若两个MAC相等，则说明比对成功，也即校验成功。
例如，在图6所示的示例中，根据访问端的全局身份号或者被访问端的全局身份号索引到第一密钥；根据物理地址空间段PA0中的一个物理地址和被访问端开放给访问端的物理地址空间的颗粒度确定物理地址空间段PA0中的该物理地址的高位，以及物理地址空间段PA0的权限值A；根据被访问端开放给访问端的物理地址空间的颗粒度、物理地址空间段PA0中的该物理地址的高位以及物理地址空间段PA0的权限值A基于第一密钥计算得到第二安全校验值，例如第二安全校验值有两个，分别为对应只读和读写的MAC_x1，以及对应只写和读写的MAC_x2；将第一访问请求中携带的物理地址空间段PA0对应的MAC分别与MAC_x1和MAC_x2进行校验，只要MAC_x1和MAC_x2中的其中一个与第一访问请求中携带的物理地址空间段PA0对应的MAC校验成功，则认为校验成功，允许访问端访问物理地址空间段PA0。
第二种：访问请求携带区域表的索引号。
(1)基于访问请求携带的全局身份号索引到密钥(key_x)；根据访问请求携带的物理地址空间的颗粒度(range_x)和物理地址来获得对齐后的物理地址的高位(pa_align)，以及获得访问请求所要访问的物理地址空间段对应的权限值A(pert_x)；然后用基于key_x，以{range_x,pa_align,pert_x,range index}为输入参数进行密码安全数学计算，得到MAC_x1和MAC_x2。其中，MAC_x1和MAC_x2的计算如下：
MAC_x1＝fun2_key_x(range_x,pa_align,pert_x1,range index)；
MAC_x2＝fun2_key_x(range_x,pa_align,pert_x2,range index)；
其中，输入参数中的range index为访问请求携带的索引号；其他输入参数的描述与访问请求不携带区域表的索引号的情况相同。
被访问端用本地计算出来MAC_x1和MAC_x2和访问请求携带的MAC进行校验，如果其中的任何一个与访问请求携带的MAC校验不成功，则校验不通过，阻止访问；否则进行下一步校验。
(2)基于访问请求携带的索引号来去区域表中索引对应条目的权限值B，然后用索引到的权限值B判断是否允许访问，如果权限值B是允许访问，则允许访问；否则阻止访问；其中，如果访问请求是读，则索引到的权限值B至少要允许读才认为是允许访问；如果访问请求是写，则索引到的权限值B至少要允许写才认为是允许访问。
当且仅当访问请求携带的MAC与被访问端本地计算的MAC校验成功，且基于访问请求携带的索引号索引到的权限值B是允许访问时，才允许访问本地内存空间；否则不允许访问本地内存空间。
例如，在图6所示的示例中，根据访问端的全局身份号索引到第一密钥；根据物理地址空间段PA0中的一个物理地址和被访问端开放给访问端的物理地址空间的颗粒度确定物理地址空间段PA0中的该物理地址的高位，以及物理地址空间段PA0的权限值A；根据被访问端开放给访问端的物理地址空间的颗粒度、物理地址空间段PA0中的该物理地址的高位、物理地址空间段PA0的权限值A、以及第一访问请求携带的索引号0基于第一密钥计算得到第二安全校验值，例如第二安全校验值有两个，分别为对应只读和读写的MAC_x1，以及对应只写和读写的MAC_x2；将第一访问请求中携带的物理地址空间段PA0对应的MAC分别与MAC_x1和MAC_x2进行校验；此外，基于第一访问请求携带的索引号0在区域表中索引；当MAC_x1和MAC_x2中的其中一个与第一访问请求中携带的物理地址空间段PA0对应的MAC校验成功，且索引号0索引到的权限值B为允许访问时，则认为校验成功，允许访问端访问物理地址空间段PA0。
需要说明的是，图6中所描述的内存访问方法的相关描述，还可参见图1至图5所示的实施例中的相关描述，此处不再赘述；作为一种示例，图6所示的访问端和被访问端分别为第二装置和第一装置。
二、物理地址无效流程。
第一种：无区域表。
请参阅图7，图7是图5所示的实施例中无效物理地址空间段的一种可能的实现示例的流程示意图；应理解，图7所示的无效物理地址空间段的流程也可以是基于图6所示的实施例中基础上执行；图7所示的无效物理地址空间段的流程包括但不限于如下步骤或操作：
701：系统软件基于某个全局身份号无效物理地址空间段，被访问端向访问端发送无效命令。
具体地，被访问端这边的系统软件需要无效某个全局身份号下的某个或者某些页表，以便能够回收对应的物理地址空间段以及后续的其他动作。
如图7所示，被访问端开放给某个全局身份号对应的访问端的物理地址段包括物理地址空间段PA0、物理地址空间段PA1和物理地址空间段PA2，系统软件需要回收该全局身份号对应访问端对物理地址空间段PA0的访问权限，也即无效物理地址空间段PA0；其中，无效物理地址空间段PA0之前，密钥管理模块针对该全局身份号派生的第一密钥为密钥_0(key_0)。若要无效物理地址空间段PA0，系统软件将通过密钥管理模块重新为该全局身份号派生一个新的密钥，也即第二密钥，例如第二密钥为密钥_1(key_1)；与此同时，密钥_0只能用于校验，例如被访问端在本地的PAAPC模块标记旧的密钥_0只能用来校验，不再用于计算MAC。并且，系统软件将利用PAAPC模块发送无效命令给该全局身份号对应的访问端，此无效命令将会告知该访问端将其本地缓存的物理地址空间段PA0的地址映射无效掉。
7021：访问端接收到无效命令后，执行地址映射的无效。
可选地，在接收到无效命令后，访问端可以停止发送对被无效的物理地址段的访问请求。
其中，访问端接收到无效命令后，会解析这个无效命令，从而获知无效本地存储的对应地址映射关系，并且不再发送对被无效的物理地址段的访问请求；例如，被访问端告知访问端无效物理地址空间段PA0，访问端将不再向被访问端发送对物理地址空间段PA0的访问请求。
需要说明的是，对于已经发出去且无法阻止(inflight)的对这个被无效的物理地址空间段(例如物理地址空间段PA0)的访问请求，访问端需要保证：
(1)对于读，等待所有的完成报文返回或者能够标记数据污染，后续返回的访问被无效的物理地址空间段(例如物理地址空间段PA0)的完成报文都丢弃；
(2)对于写，访问端返回给被访问端的无效命令的响应要和前面的所有对这个被无效的物理地址空间段(例如物理地址空间段PA0)的访问请求保序，能够实现返回的无效命令响应可以排空(drain)访问端和被访问端之间互联总线上所有的对这个被无效的物理地址空间段(例如物理地址空间段PA0)的访问请求。
7022：访问端向被访问端发送MAC获取请求。
具体地，由于派生了新的密钥，之后会基于新的密钥进行安全校验，为了确保没有被无效的物理地址空间段还能够正常访问，则对于没有被无效的物理地址空间段，需要获取新的MAC，新的MAC是基于新的密钥计算得到的。
例如，访问端通过向被访问端发送MAC获取请求，来获取物理地址空间段PA1对应的新的MAC；其中，MAC获取请求包括：全局身份号，物理地址空间段PA1的其中一个物理地址(比如基地址)，物理地址空间的颗粒度(range_x)，物理地址空间段PA1对应的旧的MAC。
又例如，访问端通过向被访问端发送MAC获取请求，来获取物理地址空间段PA2对应的新的MAC；其中，MAC获取请求包括：全局身份号，物理地址空间段PA2的其中一个物理地址(比如基地址)，物理地址空间的颗粒度(range_x)，物理地址空间段PA2对应的旧的MAC。
7023：访问端向被访问端发送携带旧的MAC的访问请求。
其中，对于没有被无效的物理地址空间段的访问，访问端可以继续发起访问请求；但是，此时访问端可选地暂停或者是适当减少对应数据流的访问量，以降低被访问端这侧的计算压力。
例如，针对物理地址空间段PA1的访问，访问端向被访问端发送携带物理地址空间段PA1对应的旧的MAC的访问请求；针对物理地址空间段PA2，访问端也可以向被访问端发送携带物理地址空间段PA2对应的旧的MAC的访问请求。
其中，携带旧的MAC的访问请求还携带：全局身份号，需要访问的物理地址，物理地址空间的颗粒度，需要访问的物理地址所在的物理地址空间段对应的旧的MAC。
例如，用于访问物理地址空间段PA1的访问请求携带：全局身份号，物理地址空间段PA1的其中一个物理地址，物理地址空间的颗粒度，物理地址空间段PA1对应的旧的MAC。
又例如，用于访问物理地址空间段PA2的访问请求携带：全局身份号，物理地址空间段PA2的其中一个物理地址，物理地址空间的颗粒度，物理地址空间段PA2对应的旧的MAC。
由上描述可知，在访问端还没有返回无效命令的响应之前，或者在被访问端本地的无效命令还没有超时之前，被访问端可能接收到来自访问端的请求包括：(1)MAC获取请求；(2)携带旧的MAC的访问请求。此外，在被访问端向访问端返回新的MAC之后，在访问端还没有返回无效命令的响应之前，或者在被访问端本地的无效命令还没有超时之前，被访问端可能接收到来自访问端的请求还包括：携带旧的MAC的访问请求。因此，在访问端还没有返回无效命令的响应之前，或者在被访问端本地的无效命令还没有超时之前，被访问端至少要能执行以下步骤或操作：
7031：被访问端向访问端返回新的MAC。
其中，在接收到的来自访问端的MAC获取请求后，对于需要重新获取对应的MAC的任意一个物理地址空间段：被访问端首先根据MAC获取请求中携带的信息基于旧的密钥针对该物理地址空间段计算得到MAC_0，然后将针对该物理地址空间段计算得到的MAC_0和MAC获取请求携带的该物理地址空间段对应的MAC进行校验；并且，被访问端判断该物理地址空间段是否是要被无效的；只有前述校验通过了，并且该物理地址空间段不是要被无效的，被访问端才基于新的密钥针对该物理地址空间段计算新的MAC，并且将新的MAC返回给访问端。
例如，针对物理地址空间段PA1，MAC获取请求包括：全局身份号，物理地址空间段PA1的其中一个物理地址，物理地址空间的颗粒度，物理地址空间段PA1对应的旧的MAC；被访问端首先根据MAC获取请求中携带的全局身份号索引到密钥_0，然后根据物理地址空间段PA1的其中一个物理地址、物理地址空间的颗粒度基于密钥_0针对物理地址空间段PA1计算得到MAC_0，再将针对物理地址空间段PA1计算得到的MAC_0和MAC获取请求携带的物理地址空间段PA1对应的旧的MAC进行校验；如果针对物理地址空间段PA1计算得到MAC_0和MAC获取请求携带的物理地址空间段PA1对应的旧的MAC相等，并且被访问端判断到物理地址空间段PA1不是要被无效的，则被访问端根据物理地址空间段PA1的其中一个物理地址、物理地址空间的颗粒度基于密钥_1计算得到物理地址空间段PA1对应的新的MAC，以及将物理地址空间段PA1对应的新的MAC返回给访问端。
同理，针对物理地址空间段PA2，MAC获取请求包括：全局身份号，物理地址空间段PA2的其中一个物理地址，物理地址空间的颗粒度，物理地址空间段PA2对应的旧的MAC；被访问端首先根据MAC获取请求中携带的全局身份号索引到密钥_0，然后根据物理地址空间段PA2的其中一个物理地址、物理地址空间的颗粒度基于密钥_0针对物理地址空间段PA2计算得到MAC_0，再将针对物理地址空间段PA2计算得到的MAC_0和MAC获取请求携带的物理地址空间段PA2对应的旧的MAC进行校验；如果针对物理地址空间段PA2计算得到的MAC_0和MAC获取请求携带的物理地址空间段PA2对应的旧的MAC相等，并且被访问端判断到物理地址空间段PA2不是要被无效的，则被访问端根据物理地址空间段PA2的其中一个物理地址、物理地址空间的颗粒度基于密钥_1计算得到物理地址空间段PA2对应的新的MAC，以及将物理地址空间段PA2对应的新的MAC返回给访问端。
7032：被访问端基于旧的MAC和新的MAC确定接收到的访问请求对应的访问权限。
其中，在访问端还没有返回无效命令的响应之前，或者在被访问端本地的无效命令还没有超时之前，接收到的访问请求(也即第二访问请求)，被访问端选择基于新旧两个密钥分别对访问请求进行访问权限校验，也即基于新旧两个密钥分别计算MAC，只要基于新旧两个密钥中的任意一个密钥计算出来的MAC与访问请求携带的MAC校验通过，则该访问请求是允许访问的。
例如，用于访问物理地址空间段PA1的访问请求携带：全局身份号，物理地址空间段PA1的其中一个物理地址，物理地址空间的颗粒度，物理地址空间段PA1对应的旧的MAC或新的MAC；根据物理地址空间段PA1的其中一个物理地址、物理地址空间的颗粒度基于密钥_0针对物理地址空间段PA1计算得到MAC_0，以及根据物理地址空间段PA1的其中一个物理地址、物理地址空间的颗粒度基于密钥_1针对物理地址空间段PA1计算得到MAC_1；只要基于密钥_0针对物理地址空间段PA1计算得到的MAC_0和基于密钥_1针对物理地址空间段PA1计算得到的MAC_1中的任意一个与访问请求携带的MAC(物理地址空间段PA1对应的旧的MAC或新的MAC)校验通过，则允许访问物理地址空间段PA1。
又例如，用于访问物理地址空间段PA2的访问请求携带：全局身份号，物理地址空间段PA2的其中一个物理地址，物理地址空间的颗粒度，物理地址空间段PA2对应的旧的MAC或新的MAC；根据物理地址空间段PA2的其中一个物理地址、物理地址空间的颗粒度基于密钥_0针对物理地址空间段PA2计算得到MAC_0，以及根据物理地址空间段PA2的其中一个物理地址、物理地址空间的颗粒度基于密钥_1针对物理地址空间段PA2计算得到MAC_1；只要基于密钥_0针对物理地址空间段PA2计算得到的MAC_0和基于密钥_1针对物理地址空间段PA2计算得到MAC_1中的任意一个与访问请求携带的MAC(物理地址空间段PA2对应的旧的MAC或新的MAC)校验通过，则允许访问物理地址空间段PA2。
704：访问端向被访问端发送无效命令的响应。
其中，访问端在决定返回无效命令的响应给被访问端之前，必须保证针对没有被无效的、后续还要继续访问的物理地址空间段，都已经获得了对应的新的MAC。之后，访问端可以返回无效命令的响应给被访问端。
例如，物理地址空间段PA1和物理地址空间段PA2不是要无效的，后续访问端还会访问物理地址空间段PA1和物理地址空间段PA2；那么，在访问端获得了物理地址空间段PA1和物理地址空间段PA2对应的新的MAC之后，访问端才返回无效命令的响应给被访问端。
705：在接收到来自访问端的无效命令的响应之后，被访问端不再使用旧的密钥。
其中，在接收到来自访问端的无效命令的响应之后，被访问端需要做保序：保证无效命令的响应报文能够排空(drain)前面所有此无效命令的响应报文需要保序的报文。被访问端在完成保序之后，关闭旧的密钥(例如密钥_0)的校验功能，不再使用旧的密钥做任何物理地址安全保护操作的密码安全数学计算校验，并且上报无效命令的响应给系统软件。
706：在无效命令超时之后，被访问端不再使用旧的密钥。
其中，如果被访问端在接收到来自访问端的无效命令的响应之前，本地的无效命令已经超时了，此种情况下被访问端可以直接关闭旧的密钥(例如密钥_0)的校验功能，不再使用旧密钥做任何物理地址安全保护操作的密码安全数学计算校验。可选地，被访问端可以不做无效命令的超时，只在等到接收到来自访问端的无效命令的响应之后，才关闭旧的密钥的校验功能，并且上报无效命令的响应给系统软件。之后，系统软件可以回收相应的物理地址空间段，例如物理地址空间段PA0。
707：在无效命令超时之后，在接收到来自访问端的无效命令的响应之前，针对接收到的携带旧的MAC的访问请求，被访问端向访问端发送重试请求；针对接收到的携带新的MAC的访问请求，被访问端向正常进行安全校验。
其中，在无效命令超时之后，旧的密钥已经被关闭，仅开启新的密钥。当访问请求携带旧的MAC时，由于旧的MAC时基于旧的密钥计算得到的，基于新的密钥计算安全校验是无法通过的，故被访问端向访问端返回重试请求，以使访问端在下一次访问请求时携带新的MAC；需要说明的是，重试请求是可选发送的，被访问端也可以不向访问端返回重试请求，直接阻止此次访问。当访问请求携带新的MAC时，由于新的MAC时基于新的密钥计算得到的，基于新的密钥计算安全校验是可以通过的。
例如，在无效命令超时之后，密钥_0已经被关闭，仅开启密钥_1；对于物理地址空间段PA0、物理地址空间段PA1和物理地址空间段PA2中的任意一个的访问，如果访问请求携带旧的MAC，针对该访问请求，被访问端基于密钥_1计算得到MAC_1，MAC_1与访问请求携带的旧的MAC不相等，则不允许访问，被访问端向访问端发送重试请求。然而，物理地址空间段PA1和物理地址空间段PA2中的任意一个的访问，如果访问请求携带新的MAC，针对该访问请求，被访问端基于密钥_1计算得到MAC_1，MAC_1与访问请求携带的新的MAC相等，则允许访问。
708：在接收到来自访问端的无效命令的响应之后，针对接收到的携带旧的MAC的访问请求，被访问端直接阻止。
其中，在完成某个物理地址空间段的无效之后，关闭了旧的密钥，访问端如果还是发出访问被无效的物理地址空间段(例如物理地址空间段PA0)的访问请求，其携带旧的MAC；此时被访问端基于新的密钥(例如密钥_1)来计算得到MAC_1，之后再用这个MAC_1和携带的旧的MAC进行校验，并且会校验不通过，从而阻止了这次访问。同样的，就算访问端发出访问没有被无效的物理地址空间段(例如物理地址空间段PA1或物理地址空间段PA2)的访问请求，其携带旧的MAC，校验也会不通过，从而访问会被阻止。然而，如果访问端发出的是没有被无效的物理地址空间段(例如物理地址空间段PA1或物理地址空间段PA2)的访问请求，其携带新的MAC，此时被访问端基于新的密钥(例如密钥_1)来计算得到MAC_1，之后再用这个MAC_1和携带的新的MAC进行校验，并且校验会通过后，允许该访问请求访问没有被无效的物理地址空间段。
可选地，图7中所示的MAC_0包括MAC_x1_0和MAC_x2_0，MAC_x1_0对应只读和读写，MAC_x2_0对应只写和读写，如果其中的任何一个与访问端发来的MAC校验成功，则说明校验通过；并且，图7中所示的MAC_1包括MAC_x1_1和MAC_x2_1，MAC_x1_1对应只读和读写，MAC_x2_1对应只写和读写，如果其中的任何一个与访问端发来的MAC校验成功，则说明校验通过；具体地描述可以参见图6所示的实施例的描述。
需要说明的是，在上述过程中，其他访问端或者此访问端发出的任何非此全局身份号的访问请求都是可以正常校验的，不会受到任何影响。
进一步需要说明的是，上面的流程步骤或操作并非要严格按照上面描述的顺序执行，有些可以并行执行；图7中所描述的具体流程，可参见图1至图6所示的实施例中的相关描述，此处不再赘述；作为一种示例，图7所示的访问端和被访问端分别为第二装置和第一装置。
第二种：有区域表。
请参阅图8，图8是图5所示的实施例中无效物理地址空间段的另一种可能的实现示例的流程示意图；应理解，图8所示的无效物理地址空间段的流程也可以是基于图6所示的实施例中基础上执行；图8所示的无效物理地址空间段的流程包括但不限于如下步骤或操作：
801：系统软件基于某个全局身份号无效物理地址空间段，被访问端向访问端发送无效命令。
具体地，被访问端这边的系统软件需要无效某个全局身份号下的某个或者某些页表，以便能够回收对应的物理地址空间段以及后续的其他动作。
其中，如果被无效的物理地址空间段在被访问端本地的区域表中有对应的条目存在，则直接修改本地的区域表中对应条目的权限值B，让这个权限值B符合系统软件期望的此全局身份号对此物理地址空间段的访问权限即可；而无需重新申请新的密钥以及将旧的密钥切换为这个新的密钥。
可选地，被访问端甚至可以选择先发无效命令通知访问端无效该物理地址空间段，经过一定的时间后才修改本地区域表中对应的条目的权限值B，之后才告知系统软件无效已经完成；进一步可选地，系统软件可控制被访问端是否要有时间等待以及等待时间的大小等。
可选地，被访问端可选择同样发出无效命令通知访问端，告知其无效的地址映射内容，并且告知其无需要重新发出获取新的安全校验值(例如MAC)的请求。
例如，系统软件需要无效物理地址空间段PA0，被访问端通过向访问端发送无效命令，通知访问端无效物理地址空间段PA0的地址映射。
802：访问端接收到无效命令后，执行地址映射的无效。
可选地，在接收到无效命令后，访问端可以停止发送对被无效的物理地址段的访问请求。
例如，访问端接收到无效物理地址空间段PA0的无效命令，无效物理地址空间段PA0的地址映射。
803：在接收无效命令的响应之前，被访问端接收来自访问端的携带MAC的访问请求。
其中，在接收到无效命令之后，访问端如果继续发出访问被无效的物理地址空间段的访问请求，针对该访问请求，被访问端可能还是会校验通过，因为被访问端还没有修改被无效的物理地址空间段在区域表中对应条目的权限值B，需要等到访问端返回无效命令的响应或者是无效命令超时之后，被访问端才会修改被无效的物理地址空间段在区域表中对应条目的权限值B。此时访问端发出的对被无效的物理地址空间段的访问，在被访问端这边依然可以校验通过，并且允许访问端访问被无效的物理地址空间段。
其中，访问请求携带：全局身份号，需要访问的物理地址，物理地址空间的颗粒度，需要访问的物理地址所在的物理地址空间段对应的MAC，物理地址空间段在区域表中对应的索引号。
例如，被访问端接收来自访问端的访问物理地址空间段PA0的访问请求，该访问请求包括：全局身份号，物理地址空间段PA0中的其中一个物理地址，物理地址空间的颗粒度，物理地址空间段PA0对应的MAC，物理地址空间段PA0在区域表中对应的索引号(也即第一索引号)，其中，物理地址空间段PA0对应的索引号为1。在接收到该访问请求之后，被访问端根据全局身份号索引到密钥_0，根据物理地址空间段PA0的其中一个物理地址、物理地址空间的颗粒度以及物理地址空间段PA0在区域表中对应的索引号基于密钥_0针对物理地址空间段PA1计算得到MAC_x1_0和MAC_x2_0，其中，MAC_x1_0对应只读和读写，MAC_x2_0对应只写和读写，如果其中的任何一个与访问端发来的MAC校验成功(相等)，则说明校验通过；并且，被访问端还根据访问请求中携带的物理地址空间段PA0对应的索引号，在区域表中索引到物理地址空间段PA0对应的权限值B，以及判断物理地址空间段PA0对应的权限值B是否匹配，也即判断物理地址空间段PA0对应的权限值B是否是允许访问。如果针对物理地址空间段PA1计算得到的MAC_x1_0和MAC_x2_0中的其中一个与访问请求携带的物理地址空间段PA0对应的MAC校验成功(相等)，且在区域表中索引到的物理地址空间段PA0对应的权限值B为允许访问，则允许访问物理地址空间段PA0。
804：被访问端接收来自访问端的无效命令的响应。
其中，访问端在完成被无效的物理地址段的地址映射的无效后，会向被访问端发送无效命令的响应；被访问端在接收到无效命令的响应之后，修改被无效的物理地址空间段在区域表中对应条目的权限值B，或者直接删除区域表中被无效的物理地址空间段对应的条目。
例如，被无效的为物理地址空间段PA0，被访问端在接收到无效命令的响应之后，修改物理地址空间段PA0在区域表中对应条目的权限值B，或者直接删除区域表中物理地址空间段PA0对应的条目。
805：在接收无效命令的响应之后，被访问端接收来自访问端的携带MAC的访问请求。
其中，对于在接收无效命令的响应之后接收到的携带MAC的访问请求，如果该访问请求请求访问被无效的物理地址段，那么即使该访问请求中携带的MAC可以校验通过，但是由于已经修改了区域表中被无效的物理地址空间段对应条目的权限值B，或者以及删除了区域表中被无效的物理地址空间段对应的条目，也是不允许该访问请求访问被无效的物理地址段的，从而阻止了访问端对物理地址空间段PA0的访问，保护了被访问端的物理地址空间的安全；如果该访问请求请求访问没有被无效的物理地址段，那么该访问请求可以正常进行。
例如，在接收到针对物理地址空间段PA0的无效命令的响应之后，被访问端接收到访问物理地址空间段PA0的访问请求，该访问请求包括：全局身份号，物理地址空间段PA0中的其中一个物理地址，物理地址空间的颗粒度，物理地址空间段PA0对应的MAC，物理地址空间段PA0在区域表中对应的索引号。在接收到该访问请求之后，被访问端根据全局身份号索引到密钥_0，根据物理地址空间段PA0的其中一个物理地址、物理地址空间的颗粒度以及物理地址空间段PA0在区域表中对应的索引号基于密钥_0针对物理地址空间段PA1计算得到MAC_x1_0和MAC_x2_0；并且，被访问端还根据访问请求中携带的物理地址空间段PA0对应的索引号，在区域表中索引物理地址空间段PA0对应的权限值B。如果针对物理地址空间段PA1计算得到的MAC_x1_0和MAC_x2_0中的其中一个与访问请求携带的物理地址空间段PA0对应的MAC相等，但在区域表中没有索引到的物理地址空间段PA0对应的权限值B，或者在区域表中索引到的物理地址空间段PA0对应的权限值B为不允许访问，则阻止允许访问物理地址空间段PA0。
需要说明是，在上述整个过程中，针对访问端发出的访问没有被无效的物理地址空间段的访问请求，其均是可以正常被访问的。
例如，在无效物理地址空间段PA0的整个过程中，被访问端可以接收到访问物理地址空间段PA1的访问请求，该访问请求包括：全局身份号，物理地址空间段PA1中的其中一个物理地址，物理地址空间的颗粒度，物理地址空间段PA1对应的MAC，物理地址空间段PA1在区域表中对应的索引号；在接收到该访问请求之后，被访问端根据全局身份号索引到密钥_0，根据物理地址空间段PA1的其中一个物理地址、物理地址空间的颗粒度以及物理地址空间段PA1在区域表中对应的索引号基于密钥_0针对物理地址空间段PA1计算得到MAC_x1_0和MAC_x2_0；并且，被访问端还根据访问请求中携带的物理地址空间段PA1对应的索引号，在区域表中索引物理地址空间段PA1对应的权限值B。如果针对物理地址空间段PA1计算得到的MAC_x1_0和MAC_x2_0中的其中一个与访问请求携带的物理地址空间段PA1对应的MAC相等，且在区域表中索引到的物理地址空间段PA1对应的权限值B为允许访问，则允许访问物理地址空间段PA1，否则阻止访问物理地址空间段PA1。
应理解，如果被无效的物理地址空间段在被访问端本端的区域表中没有对应的条目，则无效过程和第一种没有实现区域表的动作行为一样。
需要说明的是，图8中所描述的具体流程，可参见上述图1至图7所示的实施例中的相关描述，此处不再赘述；作为一种示例，图8所示的访问端和被访问端分别为第二装置和第一装置。
请参阅图9，图9是本申请实施例提供了一种内存访问装置的结构示意图，该内存访问装置900应用于第一装置，所述内存访问装置900包括处理单元901和通信单元902；所述通信单元902，用于接收来自第二装置的第一访问请求，所述第一访问请求包括身份号、第一安全校验值和第一信息，所述第一信息包括第一物理地址；所述处理单元901，用于根据所述身份号和第一信息计算得到第二安全校验值；以及根据所述第一安全校验值和所述第二安全校验值确定所述第二装置对所述第一物理地址的访问权限。
在一种可能的实现方式中，所述身份号用于标识所述第一装置，或者所述身份号用于标识所述第二装置。
在一种可能的实现方式中，在所述接收来自第二装置的第一访问请求之前，所述通信单元902还用于：接收来自所述第二装置的物理地址申请请求，所述物理地址申请请求包括所述身份号；所述处理单元901还用于：针对所述身份号生成第一密钥；所述通信单元902还用于：向所述第二装置发送所述物理地址申请请求的第一响应，所述第一响应包括所述第一安全校验值和所述第一信息，所述第一安全校验值是基于所述第一密钥计算得到的。
作为一种示例，所述处理单元901具体用于：根据所述身份号索引第一密钥，根据所述第一密钥和所述第一信息计算得到所述第二安全校验值。
在一种可能的实现方式中，所述第一信息还包括第一权限值，所述第一权限值用于表示所述第二装置对所述第一物理地址的第一访问权限。
在一种可能的实现方式中，所述第一信息还包括物理地址空间的颗粒度，所述物理地址空间的颗粒度用于表征所述物理地址空间范围大小，所述物理地址空间包括所述第一物理地址。例如，所述物理地址空间包括第一物理地址空间段，所述第一物理地址空间段包括所述第一物理地址。
在一种可能的实现方式中，所述第一权限值还用于表示所述第二装置对所述第一物理地址空间段的第一访问权限。
作为一种示例，所述处理单元901具体用于：根据所述身份号索引第一密钥；若所述第一信息包括第一权限值，则根据所述第一物理地址和所述物理地址空间的颗粒度确定所述第一物理地址的高位；若所述第一信息不包括第一权限值，根据所述第一物理地址和所述物理地址空间的颗粒度确定所述第一物理地址的高位和所述第一权限值；根据所述物理地址空间的颗粒度、所述第一物理地址的高位、所述第一权限值和所述第一密钥计算得到所述第二安全校验值。
在一种可能的实现方式中，所述处理单元901具体用于：将所述第一安全校验值与所述第二安全校验值进行校验；若所述第一安全校验值与所述第二安全校验值校验成功，则确定所述第二装置对所述第一物理地址的访问权限为允许访问。
在一种可能的实现方式中，所述第一安全校验值和所述第二安全校验值是基于第一密钥计算得到的；所述处理单元901还用于：针对所述身份号生成第二密钥；所述通信单元902还用于：向所述第二装置发送无效命令，所述无效命令用于无效所述第一物理地址或第一物理地址空间段；所述处理单元901还用于：在接收来自所述第二装置的所述无效命令的响应之后，或在所述无效命令超时之后，采用所述第二密钥替代所述第一密钥。
在一种可能的实现方式中，在向所述第二装置发送无效命令之后，在接收所述无效命令的响应之前，或在所述无效命令超时之前，所述通信单元902还用于：接收来自所述第二装置的安全校验值获取请求，所述安全校验值获取请求包括所述身份号、第三安全校验值和第二信息，所述第三安全校验值是基于所述第一密钥计算得到的，所述第二信息包括第二物理地址；所述处理单元901还用于：根据所述身份号、所述第二信息和所述第一密钥计算得到第四安全校验值；以及将所述第三安全校验值与所述第四安全校验值进行校验；所述通信单元902还用于：若所述第三安全校验值与所述第四安全校验值校验成功，则向所述第二装置发送所述安全校验值获取请求的第二响应，所述第二响应包括第五安全校验值，所述第五安全校验值是基于所述第二密钥计算得到的。
在一种可能的实现方式中，所述第二信息还包括第二权限值，所述第二权限值用于表示所述第二装置对所述第二物理地址的第一访问权限。
在一种可能的实现方式中，所述第二信息还包括物理地址空间的颗粒度，所述物理地址空间的颗粒度用于表征所述物理地址空间范围大小，所述物理地址空间包括所述第二物理地址。例如，所述物理地址空间包括第二物理地址空间段，所述第二物理地址空间段包括所述第二物理地址。
在一种可能的实现方式中，所述第二权限值还用于表示所述第二装置对所述第二物理地址空间段的第一访问权限。
在一种可能的实现方式中，在向所述第二装置发送无效命令之后，在接收所述无效命令的响应之前，或在所述无效命令超时之前，所述通信单元902还用于：接收来自所述第二装置的第二访问请求，所述第二访问请求包括所述身份号、第六安全校验值和第三信息，所述第三信息包括第三物理地址；所述处理单元901还用于：根据所述身份号、所述第三信息和所述第一密钥计算得到第七安全校验值，以及根据所述身份号、所述第三信息和所述第二密钥计算得到第八安全校验值；以及将所述第六安全校验值分别与所述第七安全校验值和所述第八安全校验值进行校验；以及若所述第六安全校验值与所述第七安全校验值校验成功，或所述第六安全校验值与所述第八安全校验值校验成功，则确定所述第二装置对所述第三物理地址的访问权限为允许访问。
在一种可能的实现方式中，所述第三信息还包括第三权限值，所述第三权限值用于表示所述第二装置对所述第三物理地址的第一访问权限。
在一种可能的实现方式中，所述第三信息还包括物理地址空间的颗粒度，所述物理地址空间的颗粒度用于表征所述物理地址空间范围大小，所述物理地址空间包括所述第三物理地址。例如，所述物理地址空间包括第三物理地址空间段，所述第三物理地址空间段包括所述第三物理地址。
在一种可能的实现方式中，所述第三权限值还用于表示所述第二装置对所述第三物理地址空间段的第一访问权限。
在一种可能的实现方式中，所述第一装置包括区域表，所述区域表包括第一索引号和第四权限值，所述第一索引号与所述第四权限值对应，所述第四权限值用于表示所述第一物理地址或第一物理地址空间段的第二访问权限；所述第一信息还包括所述第一索引号。
作为一种示例，所述处理单元901具体用于：根据所述身份号索引第一密钥；若所述第一信息包括第一权限值，则根据所述第一物理地址和所述物理地址空间的颗粒度确定所述第一物理地址的高位；若所述第一信息不包括第一权限值，根据所述第一物理地址和所述物理地址空间的颗粒度确定所述第一物理地址的高位和所述第一权限值；根据所述物理地址空间的颗粒度、所述第一物理地址的高位、所述第一权限值、所述第一索引号和所述第一密钥计算得到所述第二安全校验值。
在一种可能的实现方式中，所述处理单元901具体用于：将所述第一安全校验值与所述第二安全校验值进行校验；若所述第一安全校验值与所述第二安全校验值校验成功，且所述第四标权限值表示的第二访问权限为允许访问，则确定所述第二装置对所述第一物理地址的访问权限为允许访问。
在一种可能的实现方式中，所述处理单元901还用于：将所述区域表中的所述第四权限值修改为第五权限值。
其中，该内存访问装置900还可以包括存储单元903，用于存储内存访问装置900的程序代码和数据。该处理单元901可以是处理器，该通信单元902可以是收发器，该存储单元903可以是存储器(例如RAM、ROM)。
需要说明的是，内存访问装置900各个单元的实现还可以对应参照图1至图8所示的实施例的相应描述，以及内存访问装置900带来的有益效果也可以参照图1至图8所示的实施例的相应描述，此处不再重复描述。
请参阅图10，图10是本申请实施例提供了一种内存访问装置的结构示意图，该内存访问装置1000应用于第二装置，该内存访问装置1000包括处理单元1001和通信单元1002；所述通信单元1002，用于向第一装置发送第一访问请求，所述第一访问请求包括身份号、第一安全校验值和第一信息，所述第一信息包括第一物理地址；所述身份号和第一信息用于计算得到第二安全校验值；所述第一安全校验值和所述第二安全校验值用于确定所述第二装置对所述第一物理地址的访问权限。
在一种可能的实现方式中，所述身份号用于标识所述第一装置，或者所述身份号用于标识所述第二装置。
在一种可能的实现方式中，在所述向第一装置发送第一访问请求之前，所述通信单元1002还用于：向所述第一装置发送物理地址申请请求，所述物理地址申请请求包括所述身份号；以及接收来自所述第一装置的所述物理地址申请请求的第一响应，所述第一响应包括所述第一安全校验值和所述第一信息，所述第一安全校验值是基于第一密钥计算得到的，所述第一密钥是针对所述身份号生成的。
在一种可能的实现方式中，所述第一信息还包括第一权限值，所述第一权限值用于表示所述第二装置对所述第一物理地址的第一访问权限。
在一种可能的实现方式中，所述第一信息还包括物理地址空间的颗粒度，所述物理地址空间的颗粒度用于表征所述物理地址空间范围大小，所述物理地址空间包括所述第一物理地址。例如，所述物理地址空间包括第一物理地址空间段，所述第一物理地址空间段包括所述第一物理地址。
在一种可能的实现方式中，所述第一权限值还用于表示所述第二装置对所述第一物理地址空间段的第一访问权限。
在一种可能的实现方式中，所述通信单元1002还用于：接收来自所述第一装置的无效命令，所述无效命令用于无效所述第一物理地址或第一物理地址空间段；以及向所述第一装置发送所述无效命令的响应。
在一种可能的实现方式中，在接收所述无效命令之后，在发送所述无效命令的响应之前，所述通信单元1002还用于：向所述第一装置发送安全校验值获取请求，所述安全校验值获取请求包括所述身份号、第三安全校验值和第二信息，所述第三安全校验值是基于第一密钥计算得到的，所述第二信息包括第二物理地址；以及接收来自所述第一装置的所述安全校验值获取请求的第二响应，所述第二响应包括第五安全校验值，所述第五安全校验值是基于第二密钥计算得到的，所述第二密钥是针对所述身份号生成的。
在一种可能的实现方式中，所述第二信息还包括第二权限值，所述第二权限值用于表示所述第二装置对所述第二物理地址的第一访问权限。
在一种可能的实现方式中，所述第二信息还包括物理地址空间的颗粒度，所述物理地址空间的颗粒度用于表征所述物理地址空间范围大小，所述物理地址空间包括所述第二物理地址。例如，所述物理地址空间包括第二物理地址空间段，所述第二物理地址空间段包括所述第二物理地址。
在一种可能的实现方式中，所述第二权限值还用于表示所述第二装置对所述第二物理地址空间段的第一访问权限。
在一种可能的实现方式中，在接收所述无效命令之后，在发送所述无效命令的响应之前，所述通信单元1002还用于：向所述第一装置发送第二访问请求，所述第二访问请求包括所述身份号、第六安全校验值和第三信息，所述第三信息包括第三物理地址。
在一种可能的实现方式中，所述第三信息还包括第三权限值，所述第三权限值用于表示所述第二装置对所述第三物理地址的第一访问权限。
在一种可能的实现方式中，所述第三信息还包括物理地址空间的颗粒度，所述物理地址空间的颗粒度用于表征所述物理地址空间范围大小，所述物理地址空间包括所述第三物理地址。例如，所述物理地址空间包括第三物理地址空间段，所述第三物理地址空间段包括所述第三物理地址。
在一种可能的实现方式中，所述第三权限值还用于表示所述第二装置对所述第三物理地址空间段的第一访问权限。
在一种可能的实现方式中，所述第一装置包括区域表，所述区域表包括第一索引号和第四权限值，所述第一索引号与所述第四权限值对应，所述第四权限值用于表示所述第一物理地址或第一物理地址空间段的第二访问权限；所述第一信息还包括所述第一索引号。
其中，该内存访问装置1000还可以包括存储单元1003，用于存储内存访问装置1000的程序代码和数据。该处理单元1001可以是处理器，该通信单元1002可以是收发器，该存储单元1003可以是存储器(例如RAM、ROM)。
需要说明的是，内存访问装置1000各个单元的实现还可以对应参照图1至图8所示的实施例的相应描述，以及内存访问装置1000带来的有益效果也可以参照图1至图8所示的实施例的相应描述，此处不再重复描述。
本申请实施例还提供了一种内存访问装置，包括处理器和传输接口，所述处理器被配置为调用存储在存储器中的程序，以使得所述内存访问装置实现如上述实施例中的方法。
本申请实施例还提供了一种计算机可读存储介质，所述计算机可读存储介质包括计算机程序，当所述计算机程序在计算机或处理器上运行时，使得所述计算机或所述处理器进行如上述实施例中的方法。
本申请实施例还提供了一种芯片，包括：处理器，用于从存储器中调用并运行计算机程序，使得安装有所述芯片的设备执行如上述实施例中的方法。
本申请实施例还提供了一种计算机程序产品，所述计算机程序产品包括计算机程序，当所述计算机程序在计算机或处理器上运行时，使得所述计算机或所述处理器进行如上述实施例中的方法。
应理解，在本申请的各种实施例中，上述各过程的序号的大小并不意味着执行顺序的先后，各过程的执行顺序应以其功能和内在逻辑确定，而不应对本申请实施例的实施过程构成任何限定。
本领域普通技术人员可以意识到，结合本说明书中所公开的实施例描述的各示例的单元及算法步骤，能够以电子硬件、或者计算机软件和电子硬件的结合来实现。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统、装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统、装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，上述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
上述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。
上述功能如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本申请各个实施例上述方法的全部或部分步骤。
本申请实施例方法中的步骤可以根据实际需要进行顺序调整、合并和删减。此外，本申请各实施例中的术语、解释说明，可以参照其他实施例中相应的描述。
本申请实施例装置中的模块可以根据实际需要进行合并、划分和删减。
以上描述，以上实施例仅用以说明本申请的技术方案，而非对其限制；尽管参照前述实施例对本申请进行了详细的说明，本领域的普通技术人员应当理解：其依然可以对前述各实施例所记载的技术方案进行修改，或者对其中部分技术特征进行等同替换；而这些修改或者替换，并不使相应技术方案的本质脱离本申请各实施例技术方案的范围。

Claims (32)

  1. 一种内存访问方法，其特征在于，应用于第一装置，所述方法包括：
    接收来自第二装置的第一访问请求，所述第一访问请求包括身份号、第一安全校验值和第一信息，所述第一信息包括第一物理地址；
    根据所述身份号和所述第一信息计算得到第二安全校验值；
    根据所述第一安全校验值和所述第二安全校验值确定所述第二装置对所述第一物理地址的访问权限。
  2. 根据权利要求1所述的方法，其特征在于，所述身份号用于标识所述第一装置，或者所述身份号用于标识所述第二装置。
  3. 根据权利要求1或2所述的方法，其特征在于，在所述接收来自第二装置的第一访问请求之前，所述方法还包括：
    接收来自所述第二装置的物理地址申请请求，所述物理地址申请请求包括所述身份号；
    针对所述身份号生成第一密钥；
    向所述第二装置发送所述物理地址申请请求的第一响应，所述第一响应包括所述第一安全校验值和所述第一信息，所述第一安全校验值是基于所述第一密钥计算得到的。
  4. 根据权利要求1-3任一项所述的方法，其特征在于，所述第一信息还包括第一权限值，所述第一权限值用于表示所述第二装置对所述第一物理地址的第一访问权限。
  5. 根据权利要求1-4任一项所述的方法，其特征在于，所述第一信息还包括物理地址空间的颗粒度，所述物理地址空间的颗粒度用于表征所述物理地址空间范围大小，所述物理地址空间包括所述第一物理地址。
  6. 根据权利要求1-5任一项所述的方法，其特征在于，所述根据所述第一安全校验值和所述第二安全校验值确定所述第二装置对所述第一物理地址的访问权限，包括：
    将所述第一安全校验值与所述第二安全校验值进行校验；
    若所述第一安全校验值与所述第二安全校验值校验成功，则确定所述第二装置对所述第一物理地址的访问权限为允许访问。
  7. 根据权利要求1-6任一项所述的方法，其特征在于，所述第一安全校验值和所述第二安全校验值是基于第一密钥计算得到的；所述方法还包括：
    针对所述身份号生成第二密钥；
    向所述第二装置发送无效命令，所述无效命令用于无效所述第一物理地址；
    在接收来自所述第二装置的所述无效命令的响应之后，或在所述无效命令超时之后，采用所述第二密钥替代所述第一密钥。
  8. 根据权利要求7所述的方法，其特征在于，在向所述第二装置发送无效命令之后，在接收所述无效命令的响应之前，或在所述无效命令超时之前，所述方法还包括：
    接收来自所述第二装置的安全校验值获取请求，所述安全校验值获取请求包括所述身份号、第三安全校验值和第二信息，所述第三安全校验值是基于所述第一密钥计算得到的，所述第二信息包括第二物理地址；
    根据所述身份号、所述第二信息和所述第一密钥计算得到第四安全校验值；
    将所述第三安全校验值与所述第四安全校验值进行校验；
    若所述第三安全校验值与所述第四安全校验值校验成功，则向所述第二装置发送所述安 全校验值获取请求的第二响应，所述第二响应包括第五安全校验值，所述第五安全校验值是基于所述第二密钥计算得到的。
  9. 根据权利要求8所述的方法，其特征在于，所述第二信息还包括第二权限值，所述第二权限值用于表示所述第二装置对所述第二物理地址的第一访问权限。
  10. 根据权利要求8或9所述的方法，其特征在于，所述第二信息还包括物理地址空间的颗粒度，所述物理地址空间的颗粒度用于表征所述物理地址空间范围大小，所述物理地址空间包括所述第二物理地址。
  11. 根据权利要求7-10任一项所述的方法，其特征在于，在向所述第二装置发送无效命令之后，在接收所述无效命令的响应之前，或在所述无效命令超时之前，所述方法还包括：
    接收来自所述第二装置的第二访问请求，所述第二访问请求包括所述身份号、第六安全校验值和第三信息，所述第三信息包括第三物理地址；
    根据所述身份号、所述第三信息和所述第一密钥计算得到第七安全校验值，以及根据所述身份号、所述第三信息和所述第二密钥计算得到第八安全校验值；
    将所述第六安全校验值分别与所述第七安全校验值和所述第八安全校验值进行校验；
    若所述第六安全校验值与所述第七安全校验值校验成功，或所述第六安全校验值与所述第八安全校验值校验成功，则确定所述第二装置对所述第三物理地址的访问权限为允许访问。
  12. 根据权利要求1-5任一项所述的方法，其特征在于，所述第一装置包括区域表，所述区域表包括第一索引号和第四权限值，所述第一索引号与所述第四权限值对应，所述第四权限值用于表示所述第一物理地址的第二访问权限；所述第一信息还包括所述第一索引号。
  13. 根据权利要求12所述的方法，其特征在于，所述根据所述第一安全校验值和所述第二安全校验值确定所述第二装置对所述第一物理地址的访问权限，包括：
    将所述第一安全校验值与所述第二安全校验值进行校验；
    若所述第一安全校验值与所述第二安全校验值校验成功，且所述第四权限值表示的第二访问权限为允许访问，则确定所述第二装置对所述第一物理地址的访问权限为允许访问。
  14. 根据权利要求12或13所述的方法，其特征在于，所述方法还包括：
    将所述区域表中的所述第四权限值修改为第五权限值。
  15. 一种内存访问方法，其特征在于，应用于第二装置，所述方法包括：
    向第一装置发送第一访问请求，所述第一访问请求包括身份号、第一安全校验值和第一信息，所述第一信息包括第一物理地址；
    所述身份号和所述第一信息用于计算得到第二安全校验值；
    所述第一安全校验值和所述第二安全校验值用于确定所述第二装置对所述第一物理地址的访问权限。
  16. 根据权利要求15所述的方法，其特征在于，所述身份号用于标识所述第一装置，或者所述身份号用于标识所述第二装置。
  17. 根据权利要求15或16所述的方法，其特征在于，在所述向第一装置发送第一访问请求之前，所述方法还包括：
    向所述第一装置发送物理地址申请请求，所述物理地址申请请求包括所述身份号；
    接收来自所述第一装置的所述物理地址申请请求的第一响应，所述第一响应包括所述第一安全校验值和所述第一信息，所述第一安全校验值是基于第一密钥计算得到的，所述第一密钥是针对所述身份号生成的。
  18. 根据权利要求15-17任一项所述的方法，其特征在于，所述第一信息还包括第一权限 值，所述第一权限值用于表示所述第二装置对所述第一物理地址的第一访问权限。
  19. 根据权利要求15-18任一项所述的方法，其特征在于，所述第一信息还包括物理地址空间的颗粒度，所述物理地址空间的颗粒度用于表征所述物理地址空间范围大小，所述物理地址空间包括所述第一物理地址。
  20. 根据权利要求15-19任一项所述的方法，其特征在于，所述方法还包括：
    接收来自所述第一装置的无效命令，所述无效命令用于无效所述第一物理地址；
    向所述第一装置发送所述无效命令的响应。
  21. 根据权利要求20所述的方法，其特征在于，在接收所述无效命令之后，在发送所述无效命令的响应之前，所述方法还包括：
    向所述第一装置发送安全校验值获取请求，所述安全校验值获取请求包括所述身份号、第三安全校验值和第二信息，所述第三安全校验值是基于第一密钥计算得到的，所述第二信息包括第二物理地址；
    接收来自所述第一装置的所述安全校验值获取请求的第二响应，所述第二响应包括第五安全校验值，所述第五安全校验值是基于第二密钥计算得到的，所述第二密钥是针对所述身份号生成的。
  22. 根据权利要求21所述的方法，其特征在于，所述第二信息还包括第二权限值，所述第二权限值用于表示所述第二装置对所述第二物理地址的第一访问权限。
  23. 根据权利要求21或22所述的方法，其特征在于，所述第二信息还包括物理地址空间的颗粒度，所述物理地址空间的颗粒度用于表征所述物理地址空间范围大小，所述物理地址空间包括所述第二物理地址。
  24. 根据权利要求20-23任一项所述的方法，其特征在于，在接收所述无效命令之后，在发送所述无效命令的响应之前，所述方法还包括：
    向所述第一装置发送第二访问请求，所述第二访问请求包括所述身份号、第六安全校验值和第三信息，所述第三信息包括第三物理地址。
  25. 根据权利要求15-19任一项所述的方法，其特征在于，所述第一装置包括区域表，所述区域表包括第一索引号和第四权限值，所述第一索引号与所述第四权限值对应，所述第四权限值用于表示所述第一物理地址的第二访问权限；所述第一信息还包括所述第一索引号。
  26. 一种内存访问装置，其特征在于，应用于第一装置，所述装置包括：
    通信单元，用于接收来自第二装置的第一访问请求，所述第一访问请求包括身份号、第一安全校验值和第一信息，所述第一信息包括第一物理地址；
    处理单元，用于根据所述身份号和第一信息计算得到第二安全校验值；
    以及根据所述第一安全校验值和所述第二安全校验值确定所述第二装置对所述第一物理地址的访问权限。
  27. 根据权利要求26所述的方法，其特征在于，所述身份号用于标识所述第一装置，或者所述身份号用于标识所述第二装置。
  28. 一种内存访问装置，其特征在于，应用于第二装置，所述装置包括：
    通信单元，用于向第一装置发送第一访问请求，所述第一访问请求包括身份号、第一安全校验值和第一信息，所述第一信息包括第一物理地址；
    所述身份号和第一信息用于计算得到第二安全校验值；
    所述第一安全校验值和所述第二安全校验值用于确定所述第二装置对所述第一物理地址的访问权限。
  29. 根据权利要求28所述的方法，其特征在于，所述身份号用于标识所述第一装置，或者所述身份号用于标识所述第二装置。
  30. 一种内存访问装置，其特征在于，包括处理器和传输接口，所述处理器被配置为调用存储在存储器中的程序，以使得所述内存访问装置实现如权利要求1-14或15-25中任一项所述的方法。
  31. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质包括计算机程序，当所述计算机程序在计算机或处理器上运行时，使得所述计算机或所述处理器进行如权利要求1-14或15-25中任一项所述的方法。
  32. 一种芯片，其特征在于，包括：处理器，用于从存储器中调用并运行计算机程序，使得安装有所述芯片的设备执行如权利要求1-14或15-25中任一项所述的方法。
PCT/CN2023/084173 2022-03-30 2023-03-27 内存访问方法及相关设备 WO2023185764A1 (zh)

Applications Claiming Priority (4)

Application Number Priority Date Filing Date Title
CN202210326125.8 2022-03-30
CN202210326125 2022-03-30
CN202310303459.8 2023-03-22
CN202310303459.8A CN116893979A (zh) 2022-03-30 2023-03-22 内存访问方法及相关设备

Publications (1)

Publication Number Publication Date
WO2023185764A1 true WO2023185764A1 (zh) 2023-10-05

Family

ID=88199177

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2023/084173 WO2023185764A1 (zh) 2022-03-30 2023-03-27 内存访问方法及相关设备

Country Status (1)

Country Link
WO (1) WO2023185764A1 (zh)

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107911381A (zh) * 2017-12-01 2018-04-13 济南浪潮高新科技投资发展有限公司 应用程序编程接口的访问方法、系统、服务端及客户端
CN110489983A (zh) * 2019-08-15 2019-11-22 Oppo广东移动通信有限公司 芯片访问方法、装置、芯片及终端
CN112564909A (zh) * 2019-09-25 2021-03-26 英特尔公司 使用消息认证码和无效跟踪的安全地址转换服务
CN113934656A (zh) * 2020-06-25 2022-01-14 英特尔公司 使用密码保护的主机物理地址的安全地址转换服务
WO2022058391A1 (en) * 2020-09-18 2022-03-24 Dometic Sweden Ab Devices and methods for securing communication between a sensor and a device

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107911381A (zh) * 2017-12-01 2018-04-13 济南浪潮高新科技投资发展有限公司 应用程序编程接口的访问方法、系统、服务端及客户端
CN110489983A (zh) * 2019-08-15 2019-11-22 Oppo广东移动通信有限公司 芯片访问方法、装置、芯片及终端
CN112564909A (zh) * 2019-09-25 2021-03-26 英特尔公司 使用消息认证码和无效跟踪的安全地址转换服务
CN113934656A (zh) * 2020-06-25 2022-01-14 英特尔公司 使用密码保护的主机物理地址的安全地址转换服务
WO2022058391A1 (en) * 2020-09-18 2022-03-24 Dometic Sweden Ab Devices and methods for securing communication between a sensor and a device

Similar Documents

Publication Publication Date Title
CN111221758B (zh) 处理远程直接内存访问请求的方法和计算机设备
CN110928646B (zh) 一种访问共享内存的方法、装置、处理器和计算机系统
US8156503B2 (en) System, method and computer program product for accessing a memory space allocated to a virtual machine
US8650406B2 (en) Memory protection and security using credentials
US6421769B1 (en) Efficient memory management for channel drivers in next generation I/O system
US9112752B2 (en) Network interface and protocol
US20070050591A1 (en) System and method for out of user space I/O with server authentication
US20080022120A1 (en) System, Method and Computer Program Product for Secure Access Control to a Storage Device
US11625275B2 (en) Technologies for controlling memory access transactions received from one or more I/O devices
US10303647B2 (en) Access control in peer-to-peer transactions over a peripheral component bus
CN109901909B (zh) 用于虚拟化系统的方法及虚拟化系统
CN111966446B (zh) 一种容器环境下rdma虚拟化方法
CN104731635A (zh) 一种虚拟机访问控制方法,及虚拟机访问控制系统
CN114640716A (zh) 一种基于快速网络路径的云网络缓存加速系统和方法
WO2023136884A1 (en) Zoned accelerator embedded processing
US11334258B2 (en) System and method for memory region protection
WO2023185764A1 (zh) 内存访问方法及相关设备
CN116893979A (zh) 内存访问方法及相关设备
US20070088899A1 (en) Tape drive apparatus and method
CN116113948A (zh) 用于支持输入/输出通道保护的设备和方法
US10901917B1 (en) Address scrambling for storage class memory
US20240113875A1 (en) Method and apparatus for storing keys
US7925801B2 (en) Method and system for protection and security of IO devices using credentials
CN111586034B (zh) 数据处理系统及方法
CN115017089A (zh) 一种远程内存访问的系统及方法

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 23778129

Country of ref document: EP

Kind code of ref document: A1