FoMR: A Software and Hardware Co-Design for Addressing the Performance Bottlenecks in Secure Non-Volatile Memory

现代计算机系统越来越多地将NVM（非易失性存储器）作为主存储器的一部分，例如Intel Optane Persistent memory模块。虽然这样的集成有效地解决了现代应用程序的大容量需求，但基于nvm的计算机服务器的安全性受到了越来越多的关注。虽然英特尔SGX （Software Guard eXtensions）实现了高级安全保护，但它在基于nvm的内存系统上面临着严重的性能下降。该项目旨在解决基于sgx的安全NVM系统中的性能问题，同时不损害安全需求。鉴于依赖英特尔SGX提供安全性的计算机服务器的全球足迹很大，该项目将通过为计算机程序提供高效和安全的操作环境而产生影响。该项目还通过向代表性不足的群体伸出援手，加强了本科和研究生教育。通过开发硬件辅助的零复制页面重新映射和并行重新映射技术，它支持将不安全的页面安全且低成本地动态重新映射到SGX内存。通过开发编译器辅助的用户控制分页，它减少了页面重用距离，从而可以显著减少SGX内存和不可信内存之间的页面重映射总数。通过为安全NVM开发基于缓存内容的Merkle树技术，可以对元数据缓存采用回写替换策略，从而有效减少NVM的写次数。该项目能够提供简单而有效的软件和硬件组件，从而大大提高安全NVM的性能。该奖项反映了美国国家科学基金会的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

Modern computer systems increasingly integrate NVM (non-volatile memory) as part of main memory, e.g., the Intel Optane Persistent Memory module. While such integration effectively addresses the large capacity demands of modern applications, there is an increasing concern on the security of NVM-based computer servers. While Intel SGX (Software Guard eXtensions) achieves high-level security protection, it faces dramatic performance degradation on NVM-based memory systems. This project aims to address the performance issues in SGX-based secure NVM systems without compromising the security requirements. Given the large global footprint of computer servers that rely on Intel SGX to provide security, this project will have an impact by enabling an efficient and secure operating environment for computer programs. This project also enhances undergraduate and graduate education with outreach to under-represented groups.By developing hardware-assisted zero-copy page remapping and parallel remapping techniques, it enables secure and low-cost dynamic remapping of insecure pages to SGX memory. By developing compiler-assisted user-controlled paging, it reduces the page reuse distances such that the total number of page remaps between the SGX memory and the untrusted memory can be significantly reduced. By developing cache contents based Merkle tree techniques for secure NVM, it enables the adoption of write-back replacement policy for metadata caches and thus effectively reduces the number of NVM writes. This project enables the delivery of simple yet effective software and hardware components that dramatically enhance performance in secure NVM.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.