Memory disaggregation provides efficient memory utilization across network-connected systems. It allows a node to use part of memory in remote nodes in the same cluster. Recent studies have improved RDMA-based memory disaggregation systems, supporting lower latency and higher bandwidth than the prior generation of disaggregated memory. However, the current disaggregated memory systems manage remote memory only at coarse granularity due to the limitation of the access validation mechanism of RDMA. In such systems, to support fine-grained remote page allocation, the trustworthiness of all participating systems needs to be assumed, and thus a security breach in a node can propagate to the entire cluster. From the security perspective, the memory-providing node must protect its memory from memory-requesting nodes. On the other hand, the memory-requesting node requires the confidentiality and integrity protection of its memory contents even if they are stored in remote nodes. To address the weak isolation support in the current system, this study proposes a novel hardware-assisted memory disaggregation system. Based on the security features of FPGA, the logic in each per-node FPGA board provides a secure memory disaggregation engine. With its own networks, a set of FPGA-based engines form a trusted memory disaggregation system, which is isolated from the privileged software of each participating node. The secure memory disaggregation system allows fine-grained memory management in memory-providing nodes, while the access validation is guaranteed with the hardware-hardened mechanism. In addition, the proposed system hides the memory access patterns observable from remote nodes, supporting obliviousness. Our evaluation with FPGA implementation shows that such fine-grained secure disaggregated memory is feasible with comparable performance to the latest software-based techniques.

翻译：内存分解为连接网络的系统提供了高效的记忆利用。 它允许节点在同一组群的远程节点中使用部分内存。 最近的研究改进了基于RDMA的内存分解系统,从而改善了基于RDMA的内存分解系统,使内存分解系统与先前的分解内存的节点相比,更低的内存和带宽度较高; 但是,由于RDMA的存取验证机制有限,目前的分解内存系统只能以粗微的颗粒性管理远程内存。 在这类系统中,为了支持微小的远程页面分配,需要假设所有参与系统的可信度,从而可以将节点的安全漏洞传播到整个组群中。 从安全角度看,提供内存分解的节点必须保护其内存分解系统不受内存要求节点的影响。 另一方面, 内存分解的内存分解节点要求节点需要对其内存内容的保密和完整性加以保护。 为了解决当前系统中的隔离支持, 本项的内存分解分解分解分解分解分解系统是安全的内存系统, 内存分解的内存分解系统是安全的, 内存分解码分解的内存分解的内存分解的内存分解的系统是安全的, 。 内存分解的内存的内存分解系统是保密的内存的内存分解的系统是保密的系统是保密的系统, 。