Abstract

Securing CXL-based tiered memory introduces substantial overhead. To ensure the confidentiality, integrity, and freshness of data stored in CXL memory, transmitting security metadata over the CXL link consumes link bandwidth and increases memory access latency. In addition, re-encrypting migrated pages makes page migration more expensive. To address these challenges, we propose two mechanisms. First, Self Protective CXL Memory (SPCM) secures memory by offloading the cryptographic hardware components and decoupling BMTs across memory tiers, eliminating the need to fetch security metadata over the CXL link. Second, Temporary Seed Encryption (TSE) removes migration overhead by assigning a dynamic page-level temporary seed to each migrated page. Our evaluation demonstrates that the proposed mechanisms reduce the total execution time by 65.4% compared to the baseline system.