WO2024208271A1 - 内存页面管理方法及装置 - Google Patents

内存页面管理方法及装置 Download PDF

Info

Publication number
WO2024208271A1
WO2024208271A1 PCT/CN2024/085826 CN2024085826W WO2024208271A1 WO 2024208271 A1 WO2024208271 A1 WO 2024208271A1 CN 2024085826 W CN2024085826 W CN 2024085826W WO 2024208271 A1 WO2024208271 A1 WO 2024208271A1
Authority
WO
WIPO (PCT)
Prior art keywords
memory
memory page
page
secure
target data
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2024/085826
Other languages
English (en)
French (fr)
Inventor
刘双
陈洲
闫守孟
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Alipay Hangzhou Information Technology Co Ltd
Original Assignee
Alipay Hangzhou Information Technology Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Alipay Hangzhou Information Technology Co Ltd filed Critical Alipay Hangzhou Information Technology Co Ltd
Publication of WO2024208271A1 publication Critical patent/WO2024208271A1/zh
Priority to US19/299,031 priority Critical patent/US20250371174A1/en
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Classifications

    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/602—Providing cryptographic facilities or services
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F12/00—Accessing, addressing or allocating within memory systems or architectures
    • G06F12/02—Addressing or allocation; Relocation
    • G06F12/08—Addressing or allocation; Relocation in hierarchically structured memory systems, e.g. virtual memory systems
    • G06F12/10—Address translation
    • G06F12/1009—Address translation using page tables, e.g. page table structures
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/70—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
    • G06F21/78—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure storage of data
    • G06F21/79—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure storage of data in semiconductor storage media, e.g. directly-addressable memories
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/46—Multiprogramming arrangements
    • G06F9/50—Allocation of resources, e.g. of the central processing unit [CPU]
    • G06F9/5005—Allocation of resources, e.g. of the central processing unit [CPU] to service a request
    • G06F9/5011—Allocation of resources, e.g. of the central processing unit [CPU] to service a request the resources being hardware resources other than CPUs, Servers and Terminals
    • G06F9/5022—Mechanisms to release resources
    • Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
    • Y02—TECHNOLOGIES OR APPLICATIONS FOR MITIGATION OR ADAPTATION AGAINST CLIMATE CHANGE
    • Y02D—CLIMATE CHANGE MITIGATION TECHNOLOGIES IN INFORMATION AND COMMUNICATION TECHNOLOGIES [ICT], I.E. INFORMATION AND COMMUNICATION TECHNOLOGIES AIMING AT THE REDUCTION OF THEIR OWN ENERGY USE
    • Y02D10/00—Energy efficient computing, e.g. low power processors, power management or thermal management

Definitions

  • One or more embodiments of the present specification relate to the computer field, and in particular, to a memory page management method and device.
  • TEE trusted execution environment
  • One or more embodiments of the present specification provide a memory page management method and device.
  • a memory page management method is provided, the method being executed by a computing device, the computing device comprising a processor and a memory, the processor comprising a memory encryption engine (MEE), the memory comprising a secure memory area.
  • the method comprises: determining a first memory page to be swapped out from the secure memory area; determining a second memory page from the memory, the second memory page being located outside the secure memory area; encrypting target data stored on the first memory page according to a physical address of the second memory page through the MEE, obtaining a target ciphertext and writing it into the second memory page; releasing the first memory page, and locking the second memory page, so that the target data is only allowed to be swapped into the secure memory area from the second memory page.
  • MEE memory encryption engine
  • the method further includes: when a security application that is allowed to access the target data requests to access the target data and a page fault occurs, determining the second memory page for storing the target data from the memory; determining a third memory page from the secure memory area; and decrypting the target ciphertext written to the second memory page according to the physical address of the second memory page through the MEE to obtain The target data is stored in the third memory page; and the page table corresponding to the security application is updated according to the third memory page.
  • the method further includes: after determining the second memory page from the memory, clearing a cache line corresponding to the second memory page in a cache of the processor.
  • the secure memory area belongs to a hardware-based TEE.
  • a memory page management device which is deployed in a computing device, wherein the computing device includes a processor and a memory, wherein the processor includes an MEE, and wherein the memory includes a secure memory area.
  • the device includes: a paging driver module, configured to determine a first memory page to be swapped out from the secure memory area; the paging driver module, further configured to determine a second memory page from the memory, wherein the second memory page is located outside the secure memory area; a secure paging module, configured to encrypt the target data stored on the first memory page according to the physical address of the second memory page through the MEE, obtain the target ciphertext and write it into the second memory page; the paging driver module, configured to release the first memory page and lock the second memory page, so that the target data is only allowed to be swapped into the secure memory area from the second memory page.
  • the paging driver module is further configured to determine the second memory page for storing the target data from the memory when a security application allowed to access the target data requests access to the target data and a page fault occurs; the paging driver module is further configured to determine a third memory page from the secure memory area; the secure paging module is further configured to decrypt the target ciphertext written to the second memory page according to the physical address of the second memory page through the MEE, obtain the target data and store it in the third memory page; the paging driver module is further configured to update the page table corresponding to the security application according to the third memory page.
  • the secure paging module is further configured to clear a cache line corresponding to the second memory page in the processor's cache after determining the second memory page from the memory.
  • the secure memory area belongs to a hardware-based TEE.
  • a computing device comprising a memory and a processor, the processor comprising a processing core and a memory encryption and decryption engine, the memory comprising a secure memory area, the memory storing executable code/instructions located outside the secure memory area, and when the processing core of the processor executes the executable code/instructions, the method described in any one of the first aspects is implemented.
  • a computer-readable storage medium on which a computer program/instruction is stored.
  • the computing device implements any one of the methods in the first aspect.
  • the computing device is in the secure memory area After determining the first memory page to be swapped out, a second memory page can be determined from the ordinary memory outside the secure memory area; then, the target data stored on the first memory page is encrypted according to the physical address of the second memory page through MEE, the target ciphertext is obtained and written into the second memory page, and then the first memory page is released and the second memory page is locked, so that the target data is only allowed to be swapped into the secure memory area from the second memory page.
  • the MEE in the multiplexing processor is used to complete the encryption of the target data stored on the secure memory page, so that the swapping out of the secure memory page can be completed more quickly.
  • FIG1 is a schematic diagram of a structure of a computing device supporting hardware-based TEE
  • FIG2 is a flowchart of a memory page management method provided in an embodiment of this specification.
  • FIG3 is a second flowchart of a memory page management method provided in an embodiment of this specification.
  • FIG. 4 is a schematic diagram of the structure of a memory page management device provided in an embodiment of this specification.
  • TEE can play the role of a black box.
  • the code and data in TEE cannot be peeped even at the operating system layer. They can only be operated through the pre-defined interfaces in the code.
  • the calculations in TEE are plaintext data, rather than the complex cryptographic operations in homomorphic encryption, and there is almost no loss in efficiency in the calculation process.
  • FIG1 is a schematic diagram of the structure of a computing device that supports hardware-based TEE.
  • the computing device may include a processor and a memory.
  • the processor includes one or more processing cores, and the processing core includes but is not limited to pre-fetch logic for extracting instructions, decoding logic for decoding instructions, and execution logic for executing instructions, etc.
  • the processor may also include a cache for caching instructions and/or data, for example, including but not limited to caches at multiple levels such as L1, L2, and LLC.
  • the processor may also include a system agent configured with MEE, wherein the functions of the MEE are described in detail below.
  • the computing device may also include other functional modules, for example, a memory controller for supporting the processor to access the memory.
  • the memory controller may be coupled to a system agent including the MEE, or may be independent of the processor and the memory.
  • the computing device can create an enclave (enclave or enclave) based on SGX technology as a TEE for executing specific applications (secure applications).
  • the computing device can use the newly added processor instructions in the processor to allocate part of the EPC (Enclave Page Cache) area in the memory for the above-mentioned Enclave to reside.
  • the memory area corresponding to the aforementioned EPC is the secure memory/secure memory area belonging to the TEE.
  • the MEE in the processor is used to encrypt and decrypt data exchanged between the processor and the secure memory area.
  • data related to secure applications code and data in the enclave
  • they can be encrypted by the MEE inside the processor to obtain the corresponding ciphertext, which can be written to the secure memory area through the memory controller; only the MEE can decrypt the ciphertext in the secure memory area. Therefore, the security boundary of the enclave only includes itself and the processor. Neither privileged software nor non-privileged software can access the enclave. Even the operating system administrator and the virtual machine monitor (VMM; also known as the hypervisor) cannot affect the code and data in the enclave.
  • VMM virtual machine monitor
  • a memory paging mechanism may be enabled due to insufficient available physical memory in a secure memory area.
  • Different from the paging process of ordinary memory pages in order to ensure the security of data stored in the secure memory area, before swapping out the secure memory page belonging to the secure memory area, it is necessary to encrypt the target data stored therein to obtain the target ciphertext.
  • a Nonce for ensuring freshness and/or a message authentication code (MAC) for verifying integrity may be generated, and then the target ciphertext is stored in an ordinary memory page outside the secure memory area.
  • MAC message authentication code
  • the computing device that executes the method includes a processor and a memory, the processor includes an MEE, and the memory includes a secure memory area. After the computing device determines the first memory page to be swapped out from the secure memory area, it can determine the second memory page from the ordinary memory outside the secure memory area; then, the target data stored on the first memory page is encrypted according to the physical address of the second memory page through the MEE, the target ciphertext is obtained and written to the second memory page, and then the first memory page is released and the second memory page is locked, so that the target data is only allowed to be swapped into the secure memory area from the second memory page.
  • the computing device can complete the encryption of the target data stored on the secure memory page by reusing the MEE in the processor, and can complete the swapping out of the secure memory page more quickly, so as to support the more efficient operation of secure applications that rely on secure memory pages.
  • FIG2 is one of the flowcharts of a memory page management method provided in an embodiment of this specification.
  • the method can be executed by a computing device, the computing device includes a processor and a memory, the processor includes an MEE, the memory includes a secure memory area, the secure memory area belongs to a hardware-based TEE, and the processor may also include one or more processing cores.
  • the method exemplarily describes the process of swapping out a secure memory page belonging to a secure memory area.
  • the method may include but is not limited to part or all of the following steps S21 to S29 .
  • Step S21 determining a first memory page to be swapped out from the secure memory area.
  • the operating system (OS) deployed by the computing device can be configured with a paging driver module, which monitors the usage of memory, such as the usage of the secure memory area.
  • the paging driver module monitors that the available physical memory in the secure memory area is insufficient, the paging driver module can trigger the paging process of the secure memory page, and determine the first memory page to be swapped out from multiple secure memory pages belonging to the secure memory area according to a pre-configured decision rule based on access frequency and/or access time.
  • the processor of the computing device can execute part of the instructions corresponding to the paging driver module through its processing core, so that the computing device implements the aforementioned step S21.
  • Step S23 determining a second memory page from the memory, where the second memory page is located outside the secure memory area.
  • the paging driver module can also monitor the usage of the common memory area in the memory except the secure memory area, for example. After the paging driver module determines the first memory page to be swapped out, it can then determine the second memory page from the common memory area.
  • the processor of the computing device can execute part of the instructions corresponding to the paging driver module through its processing core, so that the computing device implements the aforementioned step S23.
  • the following step S27 can be directly executed.
  • the second memory page is not an idle memory page, for example, the second memory page stores business data accessible to applications outside the TEE, the following steps S25 and S27 can be executed in sequence.
  • Step S25 clearing the cache line corresponding to the second memory page in the processor's cache.
  • the OS or virtual machine monitor deployed in the computing device can be configured with a secure paging module.
  • the paging driver module can provide the physical memory addresses of the first memory page and the second memory page to the secure paging module, and the secure paging module clears the cache line corresponding to the second memory page in the processor's cache according to the physical address of the second memory page, ensuring that the physical address of the second memory page and its corresponding data in the processor's cache are consistent, avoiding the occurrence of two different copies of the same physical memory address in the processor's cache, such as plaintext data and target ciphertext.
  • the processor of the computing device can execute some instructions corresponding to the secure paging module through its processing core, so that the computing device implements the aforementioned step S25.
  • Step S27 encrypting the target data stored on the first memory page according to the physical address of the second memory page through the MEE of the processor, obtaining the target ciphertext and writing it into the second memory page.
  • the secure paging module may provide a first page management request to the MEE, which includes at least the physical memory addresses of the first memory page and the second memory page, and may also include indication information for indicating that the page management operation that the MEE needs to perform is to swap out the secure memory page, thereby triggering the MEE to implement the function described in step S27.
  • the processor of the computing device may execute part of the instructions corresponding to the secure paging module through its processing core, complete the provision of the aforementioned first page management request by the processing core to the MEE, and then trigger the MEE to perform the corresponding page management operation.
  • MEE is mainly used to encrypt and decrypt data exchanged between the processor and the secure memory area.
  • data related to security applications is transferred from the processor to the secure memory area, it is encrypted by MEE to obtain the corresponding ciphertext and written to the secure memory area through the memory controller.
  • the physical memory address of the secure memory page corresponding to the processed data is usually selected as input.
  • MEE in response to the first page management request, MEE can implement: through the memory controller, according to the physical address of the first memory page, read the first ciphertext of the target data stored in the first memory page from the secure memory area, decrypt the first ciphertext according to the physical address of the first memory page to obtain the target data; and then encrypt the target data according to the physical address of the second memory page to obtain the target ciphertext, and write the target ciphertext corresponding to the target data into the second memory page according to the physical address of the second memory page through the memory controller.
  • the computing device may also generate a Nonce for ensuring the freshness of the target data through a secure paging module, and/or generate a MAC for verifying the integrity of the target data and/or the target ciphertext.
  • Step S29 releasing the first memory page and locking the second memory page, so that the target data is only allowed to be swapped from the second memory page into the secure memory area.
  • the paging driver module can update the page table corresponding to the security application that is allowed to access the first memory page, and clear the first ciphertext of the target data stored on the first memory page, thereby completing the release of the first memory page.
  • the aforementioned page table includes one or more page table entries, one of which includes a mapping relationship between the virtual memory page corresponding to the target data and the first memory page, and the security application initiates access to the target data stored in the first memory page through the virtual memory page; the paging driver module can, for example, delete the page table entry corresponding to the first memory page from the page table, or invalidate the page table entry corresponding to the first memory page, thereby completing the update of the relevant page table.
  • the paging driver module can lock the second memory page to fix the target ciphertext corresponding to the target data at the physical address of the second memory page until the target ciphertext in the second memory page is swapped into the secure memory area.
  • the OS deployed in the computing device can be prohibited from swapping out the second memory page to the swap space of the disk and from performing page migration on the second memory page; or, the OS deployed in the computing device can be prohibited from swapping out the second memory page to the swap space of the disk and from performing page migration on the second memory page;
  • the second memory page is allowed to be swapped out to the swap space of the disk.
  • the processor of the computing device can execute part of the instructions corresponding to the paging driver module through its processing core, so that the computing device implements the aforementioned step S29.
  • the computing device can also maintain the correspondence between the target data and the second memory page, for example, by maintaining the correspondence between the virtual memory page corresponding to the target data and the second memory page through the paging driver module, so that when a security application requests to access the target data in a subsequent process, the paging driver module can swap the target data back into the secure memory area according to the correspondence.
  • the process of swapping target data from outside the secure memory area into the secure memory area may include, but is not limited to, part or all of the following steps S31 to S37 .
  • Step S31 when a security application that is allowed to access target data requests to access target data and a page fault occurs, a second memory page for storing the target data is determined from the memory.
  • the security application can initiate access to the target data through the virtual memory page corresponding to the target data. Since the page table entry corresponding to the virtual memory page in the page table of the security application has been deleted or invalid, a page fault error will occur.
  • the paging driver module can handle the page fault error and determine that the memory page used to store the target data is the second memory page in the ordinary memory space based on the correspondence between the virtual memory page and the second memory page maintained by it.
  • Step S33 determining a third memory page from the secure memory area.
  • the paging driver module may determine a third memory page in an idle state from the secure memory area.
  • the processor of the computing device can execute part of the instructions corresponding to the paging driver module through its processing core, so that the computing device implements the aforementioned steps S31 and S33.
  • Step S35 decrypting the target ciphertext written in the second memory page according to the physical address of the second memory page through MEE, obtaining the target data and storing it in the third memory page.
  • the paging driver module may provide the physical memory addresses of the second memory page and the third memory page to the secure paging module.
  • the secure paging module may provide the MEE with a second page management request, which includes at least the physical memory addresses of the second memory page and the third memory page, and may also include indication information for indicating that the page management operation to be performed by the MEE is to swap in the secure memory page, thereby triggering the MEE to complete the function described in step S35.
  • the processor of the computing device may execute part of the instructions corresponding to the secure paging module through its processing core to complete the processing by the processor.
  • the core provides the aforementioned second page management request to MEE, triggering MEE to perform the corresponding page management operation.
  • MEE in response to the second page management request, MEE can: read the target ciphertext of the target data written to the second memory page from the ordinary memory outside the secure memory area through the memory controller according to the physical address of the second memory page, and decrypt the target ciphertext according to the physical address of the second memory page to obtain the target data; then encrypt the target data according to the physical address of the third memory page to obtain the second ciphertext, and write the second ciphertext to the third memory page according to the physical address of the third memory page through the memory controller.
  • the computing device may also verify the freshness of the target data according to the corresponding Nonce through the secure paging module to avoid replay attacks; and/or, the computing device may also verify the integrity of the target data and/or the target ciphertext according to the corresponding MAC through the secure paging module. It is understandable that if the Nonce verification fails or the MAC verification fails, it indicates that there may be an intruder who launches a replay attack or maliciously changes the target ciphertext stored in the second memory page, and corresponding technical means can be used to deal with it.
  • Step S37 update the page table corresponding to the security application according to the third memory page.
  • the paging driver module can add or update a valid page table entry in the page corresponding to the security application, and the page table entry includes the correspondence between the virtual memory page for supporting the security application to access the target data and the third memory page.
  • the third memory page for storing the target data can be queried according to the relevant page table entry in the updated page table, thereby specifically realizing the access to the target data stored through the third memory page.
  • the computing device may also correspondingly release the second memory page originally used to store the target data.
  • the security driver module may return a response message of the successful completion of the paging operation to the paging driver module, triggering the paging driver module to execute the aforementioned step S37, and delete the target ciphertext from the ordinary memory area according to the physical memory address of the second memory page, thereby completing the release of the second memory page.
  • the various method steps implemented by the computing device are described in combination with the paging driver module and the secure paging module, it is understandable that the computing device may not rely on the paging driver module and the secure paging module to implement the aforementioned method steps, for example, it may rely on other software modules to implement them.
  • a memory page management device 400 is also provided in the embodiment of this specification, which is deployed in a computing device, wherein the computing device includes a processor and a memory, wherein the processor includes an MEE, and the memory includes a secure memory area.
  • the device 400 includes: a paging driver module 41, configured to determine a first memory page to be swapped out from the secure memory area; the paging driver module 41 is also configured to determine a second memory page from the memory, wherein the second memory page is located outside the secure memory area; a secure paging module 43, configured to execute, through the MEE, a swap operation on the memory stored on the first memory page according to the physical address of the second memory page.
  • the target data is encrypted to obtain the target ciphertext and write it into the second memory page; the paging driver module 41 is configured to release the first memory page and lock the second memory page, so that the target data is only allowed to be swapped into the secure memory area from the second memory page.
  • the paging driver module 41 is further configured to determine the second memory page for storing the target data from the memory when a security application allowed to access the target data requests access to the target data and a page fault occurs; the paging driver module 41 is further configured to determine a third memory page from the secure memory area; the secure paging module 43 is further configured to execute, through the MEE, decryption of the target ciphertext written to the second memory page according to the physical address of the second memory page, obtain the target data and store it in the third memory page; the paging driver module 41 is further configured to update the page table corresponding to the security application according to the third memory page.
  • the secure paging module 43 is further configured to clear a cache line corresponding to the second memory page in the high-speed cache of the processor after determining the second memory page from the memory.
  • the secure memory area belongs to a hardware-based TEE.
  • the functions described in this specification can be implemented by hardware, software, firmware, or any combination thereof.
  • the computer programs corresponding to these functions can be stored in a computer-readable medium or transmitted as one or more instructions/codes on a computer-readable medium, so that when the computer programs corresponding to these functions are executed by a computer, the method described in any embodiment of this specification is implemented by the computer.
  • a computer-readable storage medium is also provided in an embodiment of the present specification, on which a computer program/instruction is stored.
  • the memory page management method provided in any embodiment of the present specification is implemented.
  • a computing device including a memory and a processor, the processor including a processing core and an MEE, the memory including a secure memory area, the memory storing executable code/instructions located outside the secure memory area, and when the processing core of the processor executes the executable code/instructions, the memory page management method provided in any one of the embodiments of the present specification is implemented.
  • each embodiment in this specification is described in a progressive manner, and the same or similar parts of each embodiment can be referred to each other, and each embodiment focuses on the differences from other embodiments.
  • the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • General Engineering & Computer Science (AREA)
  • Software Systems (AREA)
  • General Physics & Mathematics (AREA)
  • Physics & Mathematics (AREA)
  • Computer Hardware Design (AREA)
  • Computer Security & Cryptography (AREA)
  • Health & Medical Sciences (AREA)
  • Bioethics (AREA)
  • General Health & Medical Sciences (AREA)
  • Storage Device Security (AREA)
  • Memory System Of A Hierarchy Structure (AREA)

Abstract

一种内存页面管理方法及装置。执行该方法的计算设备包括处理器和内存，该处理器包括内存加解密引擎MEE，该内存中包括安全内存区域。在从安全内存区域中确定出待换出的第一内存页面后，可以从安全内存区域外的普通内存中确定出第二内存页面；然后通过MEE实现根据第一内存页面的物理地址对存储在第一内存页面上的目标数据进行加密，获得目标密文并将其写入第二内存页面；进而释放该第一内存页面并锁定第二内存页面，使得该目标数据仅允许从第二内存页面换入安全内存区域。

Description

内存页面管理方法及装置
本申请要求于2023年04月06日提交中国国家知识产权局、申请号为202310377569.9、申请名称为“内存页面管理方法及装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本说明书一个或多个实施例涉及计算机领域，尤其涉及一种内存页面管理方法及装置。
背景技术
基于硬件的可信执行环境(trusted execution environment，TEE)解决方案中，通常需要在计算设备的内存中预留属于TEE的安全内存区域。计算设备运行过程中，可能因安全内存区域中剩余安全内存不足而启用内存换页机制，将属于安全内存区域的某些安全内存页面换出到安全内存区域外，即将存储在某些安全内存页面上的目标数据换出到普通内存。
希望有一种新的技术方案，以期能够更为快速的完成换出安全内存页面。
发明内容
本说明书一个或多个实施例中提供了一种内存页面管理方法及装置。
第一方面，提供了一种内存页面管理方法，所述方法由计算设备执行，所述计算设备包括处理器和内存，所述处理器包括内存加解密引擎(memory encryption engine，MEE)，所述内存中包括安全内存区域。其中，所述方法包括：从所述安全内存区域中确定出待换出的第一内存页面；从所述内存中确定出第二内存页面，所述第二内存页面位于所述安全内存区域外；通过所述MEE，根据所述第二内存页面的物理地址对存储在所述第一内存页面上的目标数据进行加密，获得目标密文并将其写入所述第二内存页面；释放所述第一内存页面，并锁定所述第二内存页面，使得所述目标数据仅允许从所述第二内存页面换入所述安全内存区域。
在一种可能的实施方式中，其中，所述方法还包括：当允许访问所述目标数据的安全应用请求访问所述目标数据而发生缺页错误时，从所述内存中确定出用于存储所述目标数据的所述第二内存页面；从所述安全内存区域中确定出第三内存页面；通过所述MEE，根据所述第二内存页面的物理地址对写入所述第二内存页面的所述目标密文进行解密，获得 所述目标数据并将其存储至所述第三内存页面；根据所述第三内存页面更新所述安全应用对应的页表。
在一种可能的实施方式中，所述方法还包括：在所述从所述内存中确定出第二内存页面之后，清空所述处理器的高速缓存中与所述第二内存页面对应的缓存行。
在一种可能的实施方式中，所述安全内存区域属于基于硬件的TEE。
第二方面，提供了一种内存页面管理装置，部署在计算设备中，所述计算设备包括处理器和内存，所述处理器包括MEE，所述内存中包括安全内存区域。所述装置包括：换页驱动模块，配置为从所述安全内存区域中确定出待换出的第一内存页面；所述换页驱动模块，还配置为从所述内存中确定出第二内存页面，所述第二内存页面位于所述安全内存区域外；安全换页模块，配置为通过所述MEE，根据所述第二内存页面的物理地址对存储在所述第一内存页面上的目标数据进行加密，获得目标密文并将其写入所述第二内存页面；所述换页驱动模块，配置为释放所述第一内存页面，并锁定所述第二内存页面，使得所述目标数据仅允许从所述第二内存页面换入所述安全内存区域。
在一种可能的实施方式中，所述换页驱动模块，还配置为当允许访问所述目标数据的安全应用请求访问所述目标数据而发生缺页错误时，从所述内存中确定出用于存储所述目标数据的所述第二内存页面；所述换页驱动模块，还配置为从所述安全内存区域中确定出第三内存页面；所述安全换页模块，还配置为通过所述MEE，根据所述第二内存页面的物理地址对写入所述第二内存页面的所述目标密文进行解密，获得所述目标数据并将其存储至所述第三内存页面；所述换页驱动模块，还配置为根据所述第三内存页面更新所述安全应用对应的页表。
在一种可能的实施方式中，所述安全换页模块，还配置为在从所述内存中确定出第二内存页面之后，清空所述处理器的高速缓存中与所述第二内存页面对应的缓存行。
在一种可能的实施方式中，所述安全内存区域属于基于硬件的TEE。
第三方面，提供了一种计算设备，包括内存和处理器，所述处理器包括处理核心和内存加解密引擎，所述内存包括安全内存区域，所述内存中存储有位于所述安全内存区域外的可执行代码/指令，所述处理器的处理核心执行所述可执行代码/指令时，实现第一方面中任一项所述的方法。
第四方面，提供了一种计算机可读存储介质，其上存储有计算机程序/指令，所述计算机程序/指令在计算设备中执行时，计算设备实现第一方面中任一项所述的方法。
通过本说明书一个或多个实施例中提供的方法及装置，计算设备在从安全内存区域中 确定出待换出的第一内存页面之后，可以从安全内存区域外的普通内存确定出第二内存页面；然后通过MEE实现根据第二内存页面的物理地址对存储在第一内存页面上的目标数据进行加密，获得目标密文并将其写入第二内存页面，进而释放第一内存页面并锁定第二内存页面，使得目标数据仅允许从第二内存页面换入安全内存区域。如此，计算设备在换出属于安全内存区域的安全内存页面的过程中，通过复用处理器中的MEE来完成对存储在安全内存页面上的目标数据进行加密，可以更为快速的完成换出安全内存页面。
附图说明
为了更清楚地说明本说明书实施例的技术方案，下面将对实施例描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本发明的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其它的附图。
图1为示例性提供的一种支持基于硬件的TEE的计算设备的结构示意图；
图2为本说明书实施例中提供的一种内存页面管理方法的流程图之一；
图3为本说明书实施例中提供的一种内存页面管理方法的流程图之二；
图4为本说明书实施例中提供的一种内存页面管理装置的结构示意图。
具体实施方式
下面结合附图，对本说明书所提供的各个非限制性实施例进行详细描述。
目前工业界十分关注TEE技术的解决方案，几乎所有主流的芯片和软件联盟都有自己独立的TEE解决方案，比如Intel SGX(Software Guard Extensions，软件保护扩展)以及ARM Trust zone(信任区)等基于硬件的TEE。其中，TEE可以起到黑箱作用，在TEE中的代码和数据即便是操作系统层都无法偷窥，只有通过代码中预先定义的接口才能对其进行操作。在效率方面，由于TEE的黑箱性质，在TEE中进行运算的是明文数据，而不是同态加密中复杂的密码学运算，计算过程效率几乎没有损失。
图1为示例性提供的一种支持基于硬件的TEE的计算设备的结构示意图。参见图1所示，该计算设备可以包括处理器和内存。处理器包括一个或多个处理核心，处理核心包括但不限于用于提取指令的预取逻辑、用于解码指令的解码逻辑和用于执行指令的执行逻辑等等。该处理器还可以包括用于缓存指令和/或数据的高速缓存，例如可以包括但不限于级别为L1、L2和LLC等多个级别的高速缓存。除此之外，处理器中还可以包括配置有MEE的系统代理，其中该MEE的功能在下文中详细描述。
该计算设备还可以包括其它功能模块，例如还可以包括用于支持处理器访问内存的内存控制器。内存控制器可以耦合到包含MEE的系统代理，也可以独立于处理器和内存。
基于硬件的TEE解决方案中，需要在计算设备的内存中预留安全内存区域，例如预留预定数量的物理内存页面作为安全内存区域。下面以Intel SGX技术的安全内存区域为例进行说明：计算设备可以基于SGX技术创建enclave(围圈或飞地)，以作为用于执行特定应用程序(安全应用)的TEE。计算设备可以利用处理器中新增的处理器指令，在内存中分配部分区域EPC(Enclave Page Cache，围圈页面缓存或飞地页面缓存)，以用于驻留上述的Enclave，前述的EPC所对应的内存区域即为属于TEE的安全内存/安全内存区域。
处理器中的MEE用于对处理器和安全内存区域间交换的数据进行加解密。与安全应用相关的数据(enclave中的代码和数据)从处理器到安全内存区域时，可以被处理器内部的MEE加密以获得对应的密文，密文可以通过内存控制器写入到安全内存区域；安全内存区域中的密文只有MEE能够解密。由此，enclave的安全边界只包含其自身和处理器，无论是特权软件或非特权软件都无法访问Enclave，即便是操作系统管理员和虚拟机监控器(virtual machine monitor，VMM；或称为hypervisor)也无法影响enclave中的代码和数据。
计算设备运行期间，可能因安全内存区域的可用物理内存不足而启用内存换页机制。区别于普通内存页面的换页过程，为了保证安全内存区域存储的数据的安全性，换出属于安全内存区域的安全内存页面前，需要加密其存储的目标数据以获得目标密文，此外还可能生成用于保证新鲜性的Nonce和/或用于验证完整性的信息验证码(message authentication code，MAC)等等，然后再将目标密文存储到安全内存区域外的普通内存页面；可以理解，从普通内存页面将目标密文换入安全内存页面前，需要对应的执行解密操作。对安全内存页面执行换页机制的过程中，通常采用软件的方式完成对数据的加解密操作，耗时较长。
本说明书实施例中至少提供了一种内存页面管理方法和装置。执行该方法的计算设备包括处理器和内存，处理器中包括MEE，内存中包括安全内存区域。计算设备在从安全内存区域中确定出待换出的第一内存页面之后，可以从安全内存区域外的普通内存确定出第二内存页面；然后通过MEE实现根据第二内存页面的物理地址对存储在第一内存页面上的目标数据进行加密，获得目标密文并将其写入第二内存页面，进而释放第一内存页面并锁定第二内存页面，使得目标数据仅允许从第二内存页面换入安全内存区域。如此，计算设备在换出属于安全内存区域的安全内存页面的过程中，通过复用处理器中的MEE来完成对存储在安全内存页面上的目标数据进行加密，可以更为快速的完成换出安全内存页面，以利支持依赖安全内存页面运行的安全应用更加高效的运行。
下面结合图1示例的计算设备详细描述本说明书实施例中提供的技术方案。
图2为本说明书实施例中提供的一种内存页面管理方法的流程图之一。该方法可以由计算设备执行，该计算设备包括处理器和内存，该处理器包括MEE，该内存中包括安全内存区域，该安全内存区域属于基于硬件的TEE，此外该处理器还可以包括一个或多个处理核心。该方法示例性的描述了换出属于安全内存区域的安全内存页面的过程。
参见图2所示，该方法可以包括但不限于如下步骤S21～步骤S29中的部分或全部。
步骤S21，从安全内存区域中确定出待换出的第一内存页面。
计算设备部署的操作系统(operating system，OS)可以配置换页驱动模块，通过换页驱动模块监控内存的使用情况，例如监控安全内存区域的使用情况。当换页驱动模块监控到安全内存区域的可用物理内存不足时，该换页驱动模块可以触发对安全内存页面的换页过程，按照基于访问频次和/或访问时间等预先配置的决策规则，从属于安全内存区域的多个安全内存页面中确定出待换出的第一内存页面。就硬件层面而言，计算设备的处理器可以通过其处理核心执行换页驱动模块所对应的部分指令，使得计算设备实现前述步骤S21。
步骤S23，从内存中确定出第二内存页面，第二内存页面位于安全内存区域外。
换页驱动模块例如还可以监控内存中除安全内存区域外的普通内存区域的使用情况。换页驱动模块决策出待换出的第一内存页面后，可以接着从普通内存区域中确定出第二内存页面。就硬件层面而言，计算设备的处理器可以通过其处理核心执行换页驱动模块所对应的部分指令，使得计算设备实现前述步骤S23。
当第二内存页面是处于空闲态的内存页面的情况下，即第二内存页面的物理内存地址上并未存储相关数据的情况下，可以直接接着执行如下步骤S27。当第二内存页面并非处于空闲态的内存页面的情况下，例如第二内存页面上存储有可供TEE外的应用程序访问的业务数据的情况下，可以依次执行如下步骤S25和步骤S27。
步骤S25，清空处理器的高速缓存中与第二内存页面对应的缓存行。
计算设备中部署的OS或者虚拟机监控器可以配置安全换页模块。换页驱动模块可以向安全换页模块提供第一内存页面和第二内存页面的物理内存地址，由安全换页模块实现根据第二内存页面的物理地址，清空处理器的高速缓存中与第二内存页面对应的缓存行(cache line)，保证第二内存页面的物理地址和其对应在处理器的高速缓存中的数据具有一致性，避免后续过程中发生处理器的高速缓存中对相同物理内存地址同时存在明文数据和目标密文等两个不同的副本。就硬件层面而言，计算设备的处理器可以通过其处理核心执行安全换页模块所对应的部分指令，使得计算设备实现前述步骤S25。
步骤S27，通过处理器的MEE执行根据第二内存页面的物理地址对存储在第一内存页面上的目标数据进行加密，获得目标密文并将其写入第二内存页面。
安全换页模块可以向MEE提供第一页面管理请求，其中至少包括第一内存页面和第二内存页面的物理内存地址，还可以包括用于指示MEE需要执行的页面管理操作是换出安全内存页面的指示信息，从而触发MEE实现步骤S27中所述的功能。就硬件层面而言，计算设备的处理器可以通过其处理核心执行安全换页模块所对应的部分指令，完成由处理核心向MEE提供前述的第一页面管理请求，进而触发MEE执行对应的页面管理操作。
参照前文，MEE主要用于对处理器和安全内存区域间交换的数据进行加解密，与安全应用相关的数据从处理器到安全内存区域时，被MEE加密以获得对应的密文并通过内存控制器写入到安全内存区域。而且，MEE对数据进行加解密的过程中，通常会选择被处理的数据所对应的安全内存页面的物理内存地址作为输入。由此不难理解，前述步骤S27中，响应于第一页面管理请求，MEE可以实现：通过内存控制器实现根据第一内存页面的物理地址，从安全内存区域中读取存储于第一内存页面的目标数据的第一密文，根据第一内存页面的物理地址对该第一密文进行解密以获得目标数据；进而根据第二内存页面的物理地址对该目标数据进行加密以获得目标密文，并通过内存控制器实现根据第二内存页面的物理地址将目标数据所对应的目标密文写入第二内存页面。
在一些可能的实施方式中，计算设备还可以通过安全换页模块生成用于保证目标数据的新鲜性的Nonce，和/或，生成用于验证目标数据和/目标密文的完整性的MAC。
步骤S29，释放第一内存页面，并锁定第二内存页面，使得目标数据仅允许从第二内存页面换入安全内存区域。
换页驱动模块可以更新允许访问第一内存页面的安全应用所对应的页表，并清空第一内存页面上存储的目标数据的第一密文，从而完成释放第一内存页面。例如，前述页表中包括一个或多个页表项，其中一个页表项包括目标数据所对应的虚拟内存页面与该第一内存页面间的映射关系，安全应用通过该虚拟内存页面发起对通过第一内存页面存储的目标数据的访问；换页驱动模块例如可以从该页表中删除第一内存页面所对应的页表项，或者将第一内存页面所对应的页表项置为无效，从而完成对相关页表的更新。
换页驱动模块可以通过锁定第二内存页面，实现将目标数据所对应的目标密文固定在第二内存页面的物理地址上，直到该第二内存页面中的目标密文被换入安全内存区域。换页驱动模块锁定第二内存页面后，可以使计算设备中部署的OS禁止将第二内存页面换出到磁盘的交换空间并且禁止对第二内存页面进行页面迁移；或者，计算设备中部署的OS 允许将第二内存页面换出到磁盘的交换空间，被换出到交换空间的目标密文被重新换入普通内存区域时，仅允许将该目标密文换入到第二内存页面的物理地址而禁止换入到普通内存区域的其它内存页面。
就硬件层面而言，计算设备的处理器可以通过其处理核心执行换页驱动模块所对应的部分指令，使得计算设备实现前述步骤S29。
允许访问目标数据的安全应用请求访问已经被换出安全内存区域的目标数据时，因安全内存区域中原本用于存储目标数据的第一内存页面已经被释放掉，计算设备将会发生缺页错误，此种情况下需要将目标数据重新换入到安全内存区域。由此，计算设备还可以维护目标数据与第二内存页面间的对应关系，例如通过换页驱动模块维护目标数据所对应的虚拟内存页面与第二内存页面间的对应关系，以便后续过程中发生安全应用请求访问目标数据时，换页驱动模块可以根据该对应关系重新将目标数据换入到安全内存区域。
参见图3，从安全内存区域外将目标数据换入安全内存区域的过程，可以包括但不限于如下步骤S31～步骤S37中的部分或全部。
步骤S31，当允许访问目标数据的安全应用请求访问目标数据而发生缺页错误时，从内存中确定出用于存储目标数据的第二内存页面。
安全应用例如可以通过目标数据所对应的虚拟内存页面发起对目标数据的访问，由于安全应用的页表中与该虚拟内存页面对应的页表项已经被删除或无效，因此会发生缺页错误。换页驱动模块可以处理该缺页错误，实现基于其维护的该虚拟内存页面与第二内存页面间的对应关系，确定出用于存储目标数据的内存页面是普通内存空间中的第二内存页面。
步骤S33，从安全内存区域中确定出第三内存页面。
换页驱动模块可以从安全内存区域中确定出处于空闲态的第三内存页面。
就硬件层面而言，计算设备的处理器可以通过其处理核心执行换页驱动模块所对应的部分指令，使得计算设备实现前述步骤S31和步骤S33。
步骤S35，通过MEE执行根据第二内存页面的物理地址对写入第二内存页面中的目标密文进行解密，获得目标数据并将其存储至第三内存页面。
换页驱动模块可以向安全换页模块提供第二内存页面和第三内存页面的物理内存地址。安全换页模块可以向MEE提供第二页面管理请求，其中至少包括第二内存页面和第三内存页面的物理内存地址，还可以包括用于指示MEE需要执行的页面管理操作是换入安全内存页面的指示信息，从而触发MEE完成步骤S35中所述的功能。就硬件层面而言，计算设备的处理器可以通过其处理核心执行安全换页模块所对应的部分指令，完成由处理 核心向MEE提供前述的第二页面管理请求，触发MEE执行对应的页面管理操作。
与前述步骤S27相对应的，响应于第二页面管理请求，MEE可以：通过内存控制器实现根据第二内存页面的物理地址，从安全内存区域外的普通内存中读取已写入第二内存页面的目标数据的目标密文，根据第二内存页面的物理地址对该目标密文进行解密以获得目标数据；进而根据第三内存页面的物理地址对该目标数据进行加密以获得第二密文，并通过内存控制器实现根据第三内存页面的物理地址将第二密文写入第三内存页面。
在一些可能的实施方式中，计算设备还可以通过安全换页模块实现根据相应的Nonce验证目标数据的新鲜性，以避免发生重放攻击；和/或，计算设备还可以通过安全换页模块实现根据相应的MAC验证目标数据和/或目标密文的完整性。可以理解的是，Nonce验证未通过或者MAC验证未通过的情况下，说明可能存在入侵者发起重放攻击或者恶意更改第二内存页面中存储的目标密文，可以采用相应技术手段应对。
步骤S37，根据第三内存页面更新安全应用对应的页表。
换页驱动模块可以在安全应用对应的页面中新增或更新一个有效的页表项，该页表项中包括用于支持安全应用访问目标数据的虚拟内存页面与第三内存页面间的对应关系。如此，对于安全应用通过目标数据所对应的虚拟内存页面发起的对目标数据的访问请求，可以根据更新后的页表中的相关页表项查询到用于存储目标数据的第三内存页面，从而具体实现对通过第三内存页面存储的目标数据进行访问。
完成将目标数据换入安全内存后，计算设备还可以对应的释放原本用于存储目标数据的第二内存页面。例如，安全驱动模块在通过MEE完成执行步骤S35后，可以向换页驱动模块返回成功完成换页操作的响应消息，触发换页驱动模块执行前述步骤S37，并根据第二内存页面的物理内存地址从普通内存区域删除目标密文，完成释放第二内存页面。
前述各个方法实施例中，虽然结合换页驱动模块和安全换页模块来描述计算设备实现的各个方法步骤，然而可以理解的是计算设备在实现前述各个方法步骤的过程中，可能并不依赖换页驱动模块和安全换页模块来实现，例如可能依赖其它软件模块来实现。
与前述方法实施例基于相同的构思，本说明书实施例中还提供了一种内存页面管理装置400，部署在计算设备中，所述计算设备包括处理器和内存，所述处理器包括MEE，所述内存中包括安全内存区域。所述装置400包括：换页驱动模块41，配置为从所述安全内存区域中确定出待换出的第一内存页面；所述换页驱动模块41，还配置为从所述内存中确定出第二内存页面，所述第二内存页面位于所述安全内存区域外；安全换页模块43，配置为通过所述MEE执行根据所述第二内存页面的物理地址对存储在所述第一内存页面上的 目标数据进行加密，获得目标密文并将其写入所述第二内存页面；所述换页驱动模块41，配置为释放所述第一内存页面，并锁定所述第二内存页面，使得所述目标数据仅允许从所述第二内存页面换入所述安全内存区域。
在一种可能的实施方式中，所述换页驱动模块41，还配置为当允许访问所述目标数据的安全应用请求访问所述目标数据而发生缺页错误时，从所述内存中确定出用于存储所述目标数据的所述第二内存页面；所述换页驱动模块41，还配置为从所述安全内存区域中确定出第三内存页面；所述安全换页模块43，还配置为通过所述MEE执行根据所述第二内存页面的物理地址对写入所述第二内存页面的所述目标密文进行解密，获得所述目标数据并将其存储至所述第三内存页面；所述换页驱动模块41，还配置为根据所述第三内存页面更新所述安全应用对应的页表。
在一种可能的实施方式中，所述安全换页模块43，还配置为在从所述内存中确定出第二内存页面之后，清空所述处理器的高速缓存中与所述第二内存页面对应的缓存行。
在一种可能的实施方式中，所述安全内存区域属于基于硬件的TEE。
本领域技术人员应该可以意识到，在上述一个或多个示例中，本说明书所描述的功能可以用硬件、软件、固件或它们的任意组合来实现。当使用软件实现时，可以将这些功能所对应的计算机程序存储在计算机可读介质中或者作为计算机可读介质上的一个或多个指令/代码进行传输，以便这些功能所对应的计算机程序被计算机执行时，通过计算机实现本说明书任意一个实施例中所述的方法。
本说明书实施例中还提供了一种计算机可读存储介质，其上存储有计算机程序/指令，当所述计算机程序/指令在计算设备中执行时，实现本说明书任意一个实施例中提供的内存页面管理方法。
本说明书实施例中还提供了一种计算设备，包括内存和处理器，所述处理器包括处理核心和MEE，所述内存包括安全内存区域，所述内存中存储有位于所述安全内存区域外的可执行代码/指令，所述处理器的处理核心执行所述可执行代码/指令时，实现本说明书任意一个实施例中提供的内存页面管理方法。
本说明书中的各个实施例均采用递进的方式描述，各个实施例中相同、相似的部分互相参见即可，每个实施例中重点说明的都是与其他实施例的不同之处。尤其，对于装置实施例而言，由于其基本相似于方法实施例，所以描述的比较简单，相关之处参见方法实施例的部分说明即可。
上述对本说明书特定实施例进行了描述。其它实施例在所附权利要求书的范围内。在 一些情况下，在权利要求书中记载的动作或步骤可以按照不同于实施例中的顺序来执行并且仍然可以实现期望的结果。另外，在附图中描绘的过程不一定要求示出的特定顺序或者连续顺序才能实现期望的结果。在某些实施方式中，多任务处理和并行处理也是可以的或者可能是有利的。
以上所述的具体实施方式，对本发明的目的、技术方案和有益效果进行了进一步详细说明，所应理解的是，以上所述仅为本发明的具体实施方式而已，并不用于限定本发明的保护范围，凡在本发明的技术方案的基础之上，所做的任何修改、等同替换、改进等，均应包括在本发明的保护范围之内。

Claims (10)

  1. 一种内存页面管理方法，由计算设备执行，所述计算设备包括处理器和内存，所述处理器包括内存加解密引擎MEE，所述内存中包括安全内存区域，所述方法包括：
    从所述安全内存区域中确定出待换出的第一内存页面；
    从所述内存中确定出第二内存页面，所述第二内存页面位于所述安全内存区域外；
    通过所述MEE，根据所述第二内存页面的物理地址对存储在所述第一内存页面上的目标数据进行加密，获得目标密文并将其写入所述第二内存页面；
    释放所述第一内存页面，并锁定所述第二内存页面，使得所述目标数据仅允许从所述第二内存页面换入所述安全内存区域。
  2. 根据权利要求1所述的方法，所述方法还包括：
    当允许访问所述目标数据的安全应用请求访问所述目标数据而发生缺页错误时，从所述内存中确定出用于存储所述目标数据的所述第二内存页面；
    从所述安全内存区域中确定出第三内存页面；
    通过所述MEE，根据所述第二内存页面的物理地址对写入所述第二内存页面的所述目标密文进行解密，获得所述目标数据并将其存储至所述第三内存页面；
    根据所述第三内存页面更新所述安全应用对应的页表。
  3. 根据权利要求1所述的方法，所述方法还包括：在所述从所述内存中确定出第二内存页面之后，清空所述处理器的高速缓存中与所述第二内存页面对应的缓存行。
  4. 根据权利要求1-3中任一项所述的方法，所述安全内存区域属于基于硬件的TEE。
  5. 一种内存页面管理装置，部署在计算设备中，所述计算设备包括处理器和内存，所述处理器包括内存加解密引擎MEE，所述内存中包括安全内存区域，所述装置包括：
    换页驱动模块，配置为从所述安全内存区域中确定出待换出的第一内存页面；
    所述换页驱动模块，还配置为从所述内存中确定出第二内存页面，所述第二内存页面位于所述安全内存区域外；
    安全换页模块，配置为通过所述MEE，根据所述第二内存页面的物理地址对存储在所述第一内存页面上的目标数据进行加密，获得目标密文并将其写入所述第二内存页面；
    所述换页驱动模块，配置为释放所述第一内存页面，并锁定所述第二内存页面，使得所述目标数据仅允许从所述第二内存页面换入所述安全内存区域。
  6. 根据权利要求5所述的装置，其中，
    所述换页驱动模块，还配置为当允许访问所述目标数据的安全应用请求访问所述目标 数据而发生缺页错误时，从所述内存中确定出用于存储所述目标数据的所述第二内存页面；
    所述换页驱动模块，还配置为从所述安全内存区域中确定出第三内存页面；
    所述安全换页模块，还配置为通过所述MEE执行根据所述第二内存页面的物理地址对写入所述第二内存页面的所述目标密文进行解密，获得所述目标数据并将其存储至所述第三内存页面；
    所述换页驱动模块，还配置为根据所述第三内存页面更新所述安全应用对应的页表。
  7. 根据权利要求5所述的装置，所述安全换页模块，还配置为在从所述内存中确定出第二内存页面之后，清空所述处理器的高速缓存中与所述第二内存页面对应的缓存行。
  8. 根据权利要求5-7中任一项所述的装置，所述安全内存区域属于基于硬件的TEE。
  9. 一种计算设备，包括内存和处理器，所述处理器包括处理核心和内存加解密引擎MEE，所述内存包括安全内存区域，所述内存中存储有位于所述安全内存区域外的可执行代码，所述处理器的处理核心执行所述可执行代码时，实现权利要求1-4中任一项所述的方法。
  10. 一种计算机可读存储介质，其上存储有计算机程序，所述计算机程序在计算设备中执行时，计算设备实现权利要求1-4中任一项所述的方法。
PCT/CN2024/085826 2023-04-06 2024-04-03 内存页面管理方法及装置 Ceased WO2024208271A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US19/299,031 US20250371174A1 (en) 2023-04-06 2025-08-13 Memory page management methods and apparatuses

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202310377569.9A CN116108454B (zh) 2023-04-06 2023-04-06 内存页面管理方法及装置
CN202310377569.9 2023-04-06

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US19/299,031 Continuation US20250371174A1 (en) 2023-04-06 2025-08-13 Memory page management methods and apparatuses

Publications (1)

Publication Number Publication Date
WO2024208271A1 true WO2024208271A1 (zh) 2024-10-10

Family

ID=86256468

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2024/085826 Ceased WO2024208271A1 (zh) 2023-04-06 2024-04-03 内存页面管理方法及装置

Country Status (3)

Country Link
US (1) US20250371174A1 (zh)
CN (1) CN116108454B (zh)
WO (1) WO2024208271A1 (zh)

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN116108454B (zh) * 2023-04-06 2023-06-30 支付宝(杭州)信息技术有限公司 内存页面管理方法及装置
CN116933271B (zh) * 2023-08-02 2024-12-13 北京火山引擎科技有限公司 数据处理方法、装置、设备和存储介质

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20080201540A1 (en) * 2007-02-16 2008-08-21 Ravi Sahita Preservation of integrity of data across a storage hierarchy
CN111967065A (zh) * 2020-08-17 2020-11-20 海光信息技术有限公司 一种数据保护方法、处理器及电子设备
CN114647487A (zh) * 2022-03-21 2022-06-21 蚂蚁金服（杭州）网络技术有限公司 基于amd sev的可信执行环境架构及可信执行系统
WO2022154195A1 (ko) * 2021-01-14 2022-07-21 충남대학교산학협력단 모바일 신뢰 실행 환경의 보안성 강화를 위한 장치
CN116108454A (zh) * 2023-04-06 2023-05-12 支付宝(杭州)信息技术有限公司 内存页面管理方法及装置

Family Cites Families (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107563207B (zh) * 2017-08-04 2019-11-22 海光信息技术有限公司 加密方法、装置及解密方法、装置
CN107392011B (zh) * 2017-08-22 2019-11-22 海光信息技术有限公司 一种内存页转移方法
CN109670345A (zh) * 2018-12-21 2019-04-23 成都海光集成电路设计有限公司 内存页面换入换出的保护方法、加速器模块和soc芯片
US12271616B2 (en) * 2021-06-15 2025-04-08 Intel Corporation Independently controlled DMA and CPU access to a shared memory region
CN113342473B (zh) * 2021-06-28 2024-01-19 海光信息技术股份有限公司 数据处理方法、安全虚拟机的迁移方法及相关装置、架构
CN113342711B (zh) * 2021-06-28 2024-02-09 海光信息技术股份有限公司 页表更新方法、装置及相关设备
CN114253738B (zh) * 2021-11-02 2024-05-24 上海交通大学 可信执行环境的内存锁定方法

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20080201540A1 (en) * 2007-02-16 2008-08-21 Ravi Sahita Preservation of integrity of data across a storage hierarchy
CN111967065A (zh) * 2020-08-17 2020-11-20 海光信息技术有限公司 一种数据保护方法、处理器及电子设备
WO2022154195A1 (ko) * 2021-01-14 2022-07-21 충남대학교산학협력단 모바일 신뢰 실행 환경의 보안성 강화를 위한 장치
CN114647487A (zh) * 2022-03-21 2022-06-21 蚂蚁金服（杭州）网络技术有限公司 基于amd sev的可信执行环境架构及可信执行系统
CN116108454A (zh) * 2023-04-06 2023-05-12 支付宝(杭州)信息技术有限公司 内存页面管理方法及装置

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
LI MING-YU, XIA YU-BIN , CHEN HAI-BO: "Memory Optimization System for SGXv2 Trusted Execution Environment", JOURNAL OF SOFTWARE, vol. 33, no. 6, 9 June 2022 (2022-06-09), pages 2012 - 2029, XP093220399, ISSN: 1000-9825, DOI: 10.13328/j.cnki.jos.006566] *

Also Published As

Publication number Publication date
CN116108454B (zh) 2023-06-30
CN116108454A (zh) 2023-05-12
US20250371174A1 (en) 2025-12-04

Similar Documents

Publication Publication Date Title
US11550962B2 (en) Secure processor and a program for a secure processor
JP7428770B2 (ja) コンピュータプログラム、コンピュータ可読記憶媒体及び装置
US12443542B2 (en) System, apparatus and method for integrity protecting tenant workloads in a multi-tenant computing environment
US8788840B2 (en) Secure processor
TWI710898B (zh) 具有所有權表的資料處理設備及方法
CN102473224B (zh) 提供安全应用执行的方法和装置
US20250371174A1 (en) Memory page management methods and apparatuses
CN107526974A (zh) 一种信息密码保护装置和方法
CN117492932B (zh) 虚拟机访问方法和设备
CN116860666A (zh) 一种gpu内存保护方法、装置、芯片及电子设备
JP2019109910A (ja) プロセッサ
TW202441402A (zh) 用於機密計算的保護ats免受惡意裝置的侵害

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 24784353

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE