FoMR: A Software and Hardware Co-Design for Addressing the Performance Bottlenecks in Secure Non-Volatile Memory

现代计算机系统越来越多地将NVM(非易失性存储器)集成为例如Intel Optane永久存储器模块的主存储器的一部分。虽然这种集成有效地解决了现代应用程序的大容量需求，但基于NVM的计算机服务器的安全性受到越来越多的关注。虽然英特尔SGX(软件保护扩展)实现了高级别的安全保护，但它在基于NVM的内存系统上面临着性能急剧下降的问题。该项目旨在解决基于SGX的安全NVM系统中的性能问题，同时不影响安全要求。鉴于依赖英特尔SGX提供安全性的计算机服务器在全球范围内占据了很大的份额，该项目将通过为计算机程序提供高效和安全的操作环境而产生影响。该项目还通过扩展到代表性不足的群体来加强本科生和研究生教育。通过开发硬件辅助的零拷贝页面重新映射和并行重新映射技术，它能够安全且低成本地将不安全的页面动态重新映射到SGX内存。通过开发编译器辅助的用户控制的分页，它减少了页面重用距离，从而可以显著减少SGX内存和不可信内存之间的页面重映射的总数。通过开发用于安全NVM的基于缓存内容的Merkle树技术，它能够对元数据缓存采用回写替换策略，从而有效地减少NVM写入的数量。该项目能够提供简单而有效的软件和硬件组件，从而显著提高安全NVM的性能。该奖项反映了NSF的法定使命，并通过使用基金会的智力优势和更广泛的影响审查标准进行评估，被认为值得支持。

Modern computer systems increasingly integrate NVM (non-volatile memory) as part of main memory, e.g., the Intel Optane Persistent Memory module. While such integration effectively addresses the large capacity demands of modern applications, there is an increasing concern on the security of NVM-based computer servers. While Intel SGX (Software Guard eXtensions) achieves high-level security protection, it faces dramatic performance degradation on NVM-based memory systems. This project aims to address the performance issues in SGX-based secure NVM systems without compromising the security requirements. Given the large global footprint of computer servers that rely on Intel SGX to provide security, this project will have an impact by enabling an efficient and secure operating environment for computer programs. This project also enhances undergraduate and graduate education with outreach to under-represented groups.By developing hardware-assisted zero-copy page remapping and parallel remapping techniques, it enables secure and low-cost dynamic remapping of insecure pages to SGX memory. By developing compiler-assisted user-controlled paging, it reduces the page reuse distances such that the total number of page remaps between the SGX memory and the untrusted memory can be significantly reduced. By developing cache contents based Merkle tree techniques for secure NVM, it enables the adoption of write-back replacement policy for metadata caches and thus effectively reduces the number of NVM writes. This project enables the delivery of simple yet effective software and hardware components that dramatically enhance performance in secure NVM.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.