Multi-core parallel encryption and decryption device

Abstract

This application provides a multi-core parallel encryption / decryption device. Through a configured encryption / decryption micro-engine, multiple data packets to be encrypted / decrypted, stored in DRAM memory, are distributed to multiple encryption / decryption control modules within the micro-engine. Each encryption / decryption control module calls a DMA controller to copy each data packet to SRAM memory and calls a specific encryption / decryption hardware circuit core to perform encryption / decryption operations on the messages within each data packet. This achieves parallel operation on each data packet, with each operation remaining independent and non-interfering with others, significantly improving the execution efficiency of encryption / decryption operations. It solves the problem in existing technologies where smart network cards (NICs) have limited computing power due to using a single hardware encryption / decryption circuit, making it difficult to achieve the performance indicators of high-speed networks. This helps smart NICs quickly process high-volume real-time services.

Description

Technical Field

[0001] This application relates to the field of network communication technology, and in particular to a multi-core parallel encryption and decryption device. Background Technology

[0002] Data Processing Units (DPUs) often act as offloading engines for CPUs (Central Processing Units), offloading complex computations from the CPU to the DPU, thereby alleviating the CPU's resource overhead. Network interfaces are ideal privacy boundaries. To ensure information security and protect data from unauthorized access or tampering during data transmission, network data packets need to be encrypted and decrypted. However, encryption and decryption algorithms are very expensive, such as the asymmetric encryption algorithm SM2, hash algorithm SM3, and symmetric block cipher algorithm SM4 in national cryptographic standards. If the CPU is used for processing, it can only handle a small portion of the data volume; furthermore, considering high-speed networks like 25G / 40G / 100G, the CPU is almost incapable of completing this task. Therefore, it is necessary to transfer these encryption and decryption algorithms to the DPU to reduce the CPU's burden and improve overall system and network performance.

[0003] A smart network interface card (NIC) is a hardware device with network communication and data processing capabilities, capable of performing encryption and decryption operations in hardware. Therefore, offloading the encryption and decryption of network data packets to the smart NIC hardware in an inline manner is gradually replacing solutions that rely on dedicated encryption / decryption chips.

[0004] However, current smart network cards only use a single hardware encryption / decryption circuit to process the input network data packets one by one, which limits their computing power. Especially when processing high-volume real-time services (such as IPsec-encapsulated security data), they often need to queue for processing, making it difficult to achieve the performance indicators of high-speed networks. Summary of the Invention

[0005] In view of the shortcomings of the prior art described above, the purpose of this application is to provide a multi-core parallel encryption and decryption device to solve the problem that the computing power of smart network cards is limited due to the use of a single hardware encryption and decryption circuit, making it difficult to achieve the performance indicators of high-speed networks.

[0006] To achieve the above and other related objectives, a first aspect of this application provides a multi-core parallel encryption / decryption device, comprising: a DRAM memory, an SRAM memory, a DMA controller, an encryption / decryption micro-engine, and multiple encryption / decryption hardware circuit cores; wherein, the encryption / decryption micro-engine is connected to the DMA controller and each encryption / decryption hardware circuit core, the DMA controller is connected to the DRAM memory and the SRAM memory, and each encryption / decryption hardware circuit core is connected to the SRAM memory; the encryption / decryption micro-engine comprises: multiple encryption / decryption control modules, each encryption / decryption control module being connected to one encryption / decryption hardware circuit core; the encryption / decryption micro-engine is used to allocate multiple data packets to be encrypted / decrypted stored in the DRAM memory to each encryption / decryption control module, and through each encryption / decryption control module, respectively invokes the DMA controller and its respective connected encryption / decryption hardware circuit core to perform encryption / decryption operations on the messages to be encrypted / decrypted in each data packet in parallel, generating encryption / decryption data and authentication data of the messages to be encrypted / decrypted.

[0007] In some embodiments of the first aspect of this application, the method of calling the DMA controller and the connected encryption / decryption hardware circuit core through the encryption / decryption control module to perform encryption / decryption operations on the messages to be encrypted / decrypted in each data packet to be encrypted / decrypted includes: calling the DMA controller through the encryption / decryption control module to copy the allocated data packets to be encrypted / decrypted from the DRAM memory to the SRAM memory; wherein, the data packets to be encrypted / decrypted include: a message to be encrypted / decrypted and encryption / decryption algorithm parameters and authentication algorithm parameters of the message to be encrypted / decrypted; calling the connected encryption / decryption hardware circuit core through the encryption / decryption control module to perform encryption / decryption operations on the message to be encrypted / decrypted according to the encryption / decryption algorithm parameters and the authentication algorithm parameters, so as to generate encryption / decryption data and authentication data of the message to be encrypted / decrypted and store them in the SRAM memory; and calling the DMA controller again through the encryption / decryption control module to copy the encryption / decryption data and the authentication data from the SRAM memory to the DRAM memory.

[0008] In some embodiments of the first aspect of this application, each of the encryption / decryption hardware circuit cores includes: an encryption / decryption instruction buffer for storing a preset encryption / decryption execution instruction set and an encryption / decryption execution parameter set.

[0009] In some embodiments of the first aspect of this application, the method of calling the DMA controller and the connected encryption / decryption hardware circuit core through the encryption / decryption control module to perform encryption / decryption operations on the messages to be encrypted / decrypted in each data packet to be encrypted / decrypted further includes: copying the messages to be encrypted / decrypted in the data packet to be encrypted / decrypted, as well as the encryption / decryption algorithm parameters and authentication algorithm parameters of the messages to be encrypted / decrypted, to the SRAM memory; then, through the encryption / decryption control module, writing each SRAM address of the stored data into the encryption / decryption operation parameter set of the encryption / decryption instruction buffer; and after storing the encryption / decryption data and authentication data of the messages to be encrypted / decrypted in the SRAM memory, writing each SRAM address of the stored data into the encryption / decryption operation parameter set of the encryption / decryption instruction buffer through the encryption / decryption control module.

[0010] In some embodiments of the first aspect of this application, the encryption / decryption execution instruction set is initialized into the encryption / decryption instruction buffer of each encryption / decryption hardware circuit core when the encryption / decryption micro-engine starts, including: encryption / decryption algorithm execution instructions, authentication algorithm execution instructions, encryption / decryption algorithm parameter read / write instructions, authentication algorithm parameter read / write instructions, message to be encrypted / decrypted read / write instructions, and data write-back instructions.

[0011] In some embodiments of the first aspect of this application, the method for generating encryption / decryption data and authentication data of the message to be encrypted / decrypted includes: calling the connected encryption / decryption hardware circuit core through the encryption / decryption control module to run read / write instructions for the message to be encrypted / decrypted stored in the encryption / decryption instruction buffer, so as to obtain the SRAM address for storing the message to be encrypted / decrypted and the message to be encrypted / decrypted; calling the connected encryption / decryption hardware circuit core through the encryption / decryption control module to run read / write instructions for encryption / decryption algorithm parameters stored in the encryption / decryption instruction buffer, so as to obtain the SRAM address for storing the encryption / decryption algorithm parameters and the encryption / decryption algorithm parameters; calling the connected encryption / decryption hardware circuit core through the encryption / decryption control module to run encryption / decryption algorithm execution instructions stored in the encryption / decryption instruction buffer according to the obtained encryption / decryption algorithm parameters, and processing the obtained message to be encrypted / decrypted. The message undergoes encryption and decryption operations to generate encrypted and decrypted data for the message to be encrypted and decrypted. The encryption and decryption control module calls the connected encryption and decryption hardware circuit core to execute read / write instructions for authentication algorithm parameters stored in the encryption and decryption instruction buffer, thereby obtaining the SRAM address for storing the authentication algorithm parameters and the authentication algorithm parameters themselves. The encryption and decryption control module then calls the connected encryption and decryption hardware circuit core to execute authentication algorithm execution instructions stored in the encryption and decryption instruction buffer based on the obtained authentication algorithm parameters, performing authentication operations on the obtained message to be encrypted and decrypted to generate authentication data for the message to be encrypted and decrypted. Finally, the encryption and decryption control module calls the connected encryption and decryption hardware circuit core to execute data write-back instructions stored in the encryption and decryption instruction buffer, writing the generated encrypted and decrypted data and the authentication data back to the SRAM memory.

[0012] In some embodiments of the first aspect of this application, the DRAM memory includes: a plurality of DRAM address partitions; each DRAM address partition is used to store a data packet to be encrypted / decrypted, as well as encryption / decryption data and authentication data of the data packet to be encrypted / decrypted.

[0013] In some embodiments of the first aspect of this application, the multi-core parallel encryption / decryption device further includes: a data output module connected to the DRAM memory, used to send the data packet to be encrypted / decrypted stored in the DRAM memory, as well as the encryption / decryption data and authentication data of the encrypted / decrypted message, to an external device, and release the corresponding DRAM address partition.

[0014] In some embodiments of the first aspect of this application, the SRAM memory includes: a plurality of SRAM address partitions; each SRAM address partition is used to store a data packet to be encrypted / decrypted copied from the DRAM memory by the DMA controller, as well as encryption / decryption data and authentication data of the generated message to be encrypted / decrypted; after the encryption / decryption data and the authentication data are copied from the SRAM memory to the DRAM memory, the corresponding SRAM address partition is released.

[0015] In some embodiments of the first aspect of this application, the encryption / decryption micro-engine includes: multiple protocol encapsulation modules, each connected to the DRAM memory; obtaining each data packet to be encrypted / decrypted stored in the DRAM memory through each protocol encapsulation module, and performing protocol encapsulation operations on each message to be encrypted / decrypted to generate header data for each message to be encrypted / decrypted; storing each message to be encrypted / decrypted and its corresponding header data together in the DRAM memory, so that each encryption / decryption control module can call the DMA controller and the encryption / decryption hardware circuit connected to it to verify and perform encryption / decryption operations on each message to be encrypted / decrypted.

[0016] As described above, this application has the following beneficial effects: This application provides a multi-core parallel encryption and decryption device. Through a configured encryption and decryption micro-engine, multiple data packets to be encrypted and decrypted stored in DRAM memory are allocated to multiple encryption and decryption control modules of the encryption and decryption micro-engine. Each encryption and decryption control module calls a DMA controller to copy each data packet to be encrypted and decrypted to SRAM memory, and calls each encryption and decryption hardware circuit core to perform encryption and decryption operations on the messages to be encrypted and decrypted in each data packet. This achieves parallel operation on each data packet, and each operation process remains independent and does not interfere with each other, greatly improving the execution efficiency of encryption and decryption operations. It solves the problem in the prior art where the computing power of smart network cards is limited due to the use of a single hardware encryption and decryption circuit, making it difficult to achieve the performance indicators of high-speed networks. This helps smart network cards to quickly process large-volume real-time services. Attached Figure Description

[0017] Figure 1 The diagram shown is a structural schematic of a multi-core parallel encryption / decryption device according to an embodiment of this application.

[0018] Figure 2 The diagram shown is a flowchart illustrating the encryption and decryption operations performed in one embodiment of this application.

[0019] Figure 3 The diagram shown is a schematic representation of the encryption / decryption hardware circuit core in one embodiment of this application.

[0020] Figure 4The diagram shown is a flowchart illustrating a method for generating encryption / decryption data and authentication data in one embodiment of this application.

[0021] Figure 5 The diagram shown is a schematic representation of a quad-core parallel encryption / decryption device in a specific embodiment of this application. Detailed Implementation

[0022] The following specific examples illustrate the implementation of this application. Those skilled in the art can easily understand other advantages and effects of this application from the content disclosed in this specification. This application can also be implemented or applied through other different specific embodiments, and various details in this specification can also be modified or changed based on different viewpoints and applications without departing from the spirit of this application. It should be noted that, unless otherwise specified, the following embodiments and features in the embodiments can be combined with each other.

[0023] The technical solutions of this application can be applied to various communication systems, such as: Long Term Evolution (LTE) systems, LTE Frequency Division Duplex (FDD) systems, future 5th Generation (5G) communication systems, new radio access technology (NR), LTE Time Division Duplex (TDD), Worldwide Interoperability for Microwave Access (WiMAX), Universal Mobile Telecommunication System (UMTS), and vehicle-to-XV2X. V2X can include vehicle to network (V2N), vehicle to vehicle (V2V), vehicle to infrastructure (V2I), vehicle to pedestrian (V2P), Long Term Evolution-Vehicle (LTE-V), vehicle-to-everything (V2X), machine-type communication (MTC), Internet of Things (IoT), Long Term Evolution-Machine (LTE-M), and machine to machine (M2M).

[0024] To address the problems mentioned above, this invention provides a multi-core parallel encryption / decryption device. This device aims to solve the problem in existing technologies where the limited computing power of smart network cards (NICs) using only a single hardware encryption / decryption circuit makes it difficult to meet the performance requirements of high-speed networks. By employing a multi-core parallel approach, the device performs encryption / decryption operations on multiple data packets input to the smart NIC, thereby improving the computing power of the smart NIC and meeting the performance requirements of high-speed networks.

[0025] Meanwhile, to make the objectives, technical solutions, and advantages of the present invention clearer, the technical solutions in the embodiments of the present invention will be further described in detail below with reference to the accompanying drawings. It should be understood that the specific embodiments described herein are only for explaining the present invention and are not intended to limit the invention.

[0026] like Figure 1 The diagram illustrates the structure of a multi-core parallel encryption / decryption device according to an embodiment of the present invention. In this embodiment, the multi-core parallel encryption / decryption device performs encryption / decryption operations on multiple data packets to be encrypted / decrypted from an input smart network interface card (NIC), and sends the generated data to an external device via the smart NIC. The multi-core parallel encryption / decryption device includes: a DRAM memory 1, an SRAM memory 2, a DMA controller 3, an encryption / decryption micro-engine 4, and multiple encryption / decryption hardware circuit cores 5.

[0027] Among them, such as Figure 1 As shown, the encryption / decryption microengine 4 is connected to the DMA controller and each encryption / decryption hardware circuit core 5, respectively. The DMA controller 3 is connected to the DRAM memory 1 and the SRAM memory 2, respectively, and each encryption / decryption hardware circuit core 5 is connected to the SRAM memory. Furthermore, the encryption / decryption microengine 4 includes: multiple encryption / decryption control modules 41; each encryption / decryption control module 41 is connected to one encryption / decryption hardware circuit core 5.

[0028] Specifically, the encryption / decryption micro-engine 4 is used to allocate multiple data packets to be encrypted / decrypted stored in the DRAM memory 1 to each of the encryption / decryption control modules 41, and each of the encryption / decryption control modules 41 calls the DMA controller 3 and the encryption / decryption hardware circuit core 5 connected to it respectively, so as to perform encryption / decryption operations on the messages to be encrypted / decrypted in each data packet in parallel, and generate encryption / decryption data and authentication data of the messages to be encrypted / decrypted.

[0029] The purpose of this design in this embodiment is to enable multiple encryption / decryption control modules 41 to call each encryption / decryption hardware circuit core 5 to perform encryption / decryption operations on each data packet to be decrypted in parallel, so that multiple data packets to be encrypted / decrypted can be operated on at one time, and each operation process remains independent and does not interfere with each other, thereby greatly improving the execution efficiency, effectively improving the device's encryption / decryption computing power, and enabling it to quickly process large-volume real-time services and meet the performance indicators of high-speed networks.

[0030] In one embodiment, such as Figure 2 As shown, the method of calling the DMA controller 3 and the connected encryption / decryption hardware circuit core 5 through the encryption / decryption control module 41 to perform encryption / decryption operations on the messages to be encrypted / decrypted in each data packet to be encrypted / decrypted includes steps S1 to S3.

[0031] Step S1: The encryption / decryption control module 41 calls the DMA controller 3 to copy the allocated data packet to be encrypted / decrypted from the DRAM memory 1 to the SRAM memory 2.

[0032] In one specific embodiment, the DRAM memory 1 includes multiple DRAM address partitions for storing data packets to be encrypted / decrypted input to the smart network interface card. The data packets to be encrypted / decrypted include a message to be encrypted / decrypted, along with encryption / decryption algorithm parameters and authentication algorithm parameters for that message. Furthermore, the SRAM memory 2 includes multiple SRAM address partitions; each SRAM address partition stores a data packet to be encrypted / decrypted copied from the DRAM memory 1 by the DMA controller 3, as well as the generated encryption / decryption data and authentication data for that message.

[0033] It should be noted that the encryption / decryption algorithm parameters include, but are not limited to: the key (KEY) value, the security parameter index (SPI) value, and the initialization vector (IV) value used in the encryption / decryption algorithm operation. The generated authentication data includes, but is not limited to: the integrity check (ICV) value.

[0034] Step S2: The encryption / decryption control module 41 calls the connected encryption / decryption hardware circuit core 5 to perform encryption / decryption operations on the message to be encrypted / decrypted according to the encryption / decryption algorithm parameters and the authentication algorithm parameters, so as to generate encryption / decryption data and authentication data of the message to be encrypted / decrypted and store them in the SRAM memory 2.

[0035] It should be noted that this application stores the read and write data of each encryption / decryption hardware circuit core 5 in the SRAM memory, which can achieve more efficient and faster data read and write, thereby ensuring the computing power of the multi-core parallel encryption / decryption device and high-speed network transmission.

[0036] In one specific embodiment, such as Figure 3 As shown, each of the encryption / decryption hardware circuit cores 5 includes: an encryption / decryption instruction buffer 51, used to store a preset encryption / decryption operation instruction set and an encryption / decryption operation parameter set.

[0037] The encryption / decryption instruction set is initialized into the encryption / decryption instruction buffer 51 of each encryption / decryption hardware circuit core 5 when the encryption / decryption micro-engine 4 starts, and includes: encryption / decryption algorithm running instructions, authentication algorithm running instructions, encryption / decryption algorithm parameter read / write instructions, authentication algorithm parameter read / write instructions, message to be encrypted / decrypted read / write instructions, and data write-back instructions.

[0038] The encryption / decryption operation parameter set includes: encryption / decryption algorithm parameters, authentication algorithm parameters, the message to be encrypted / decrypted, and the corresponding SRAM addresses of the generated encryption / decryption data and authentication data in the SRAM memory 2. The initialization method includes: copying the message to be encrypted / decrypted from the data packet to be encrypted / decrypted, along with its encryption / decryption algorithm parameters and authentication algorithm parameters, to the SRAM memory 2; then, through the encryption / decryption control module 41, writing the SRAM addresses of the stored data into the encryption / decryption operation parameter set of the encryption / decryption instruction buffer 51; and after storing the encryption / decryption data and authentication data of the message to be encrypted / decrypted in the SRAM memory 2, through the encryption / decryption control module 41, writing the SRAM addresses of the stored data into the encryption / decryption instruction buffer 51 into the encryption / decryption operation parameter set.

[0039] In this application, the encryption and decryption algorithms supported by each encryption and decryption hardware circuit core mainly include mainstream cryptographic algorithms such as AES, CHACHA and SM4, and the authentication algorithms supported mainly include mainstream hash algorithms such as SHA-1, SHA-256, SHA-384, SHA-512, GF-128, POLY1305 and SM3.

[0040] The purpose of this design in this embodiment is to use a preset encryption / decryption operation instruction set and encryption / decryption operation parameter set to call each of the encryption / decryption hardware circuit cores 5, which can effectively improve the instruction execution efficiency of each of the encryption / decryption hardware circuit cores 5, thereby further improving the computing power of the multi-core parallel encryption / decryption device.

[0041] In one specific embodiment, such as Figure 4 As shown, the method for generating the encryption / decryption data and authentication data of the message to be encrypted / decrypted includes steps S21 to S26.

[0042] Step S21: The encryption / decryption control module 41 calls the connected encryption / decryption hardware circuit core 5 to run the read / write instructions of the message to be encrypted / decrypted stored in the encryption / decryption instruction buffer 51, so as to obtain the SRAM address for storing the message to be encrypted / decrypted and the message to be encrypted / decrypted.

[0043] Step S22: The encryption / decryption control module 41 calls the connected encryption / decryption hardware circuit core 5 to run the encryption / decryption algorithm parameter read / write instructions stored in the encryption / decryption instruction buffer 51 to obtain the SRAM address used to store the encryption / decryption algorithm parameters and the encryption / decryption algorithm parameters.

[0044] Step S23: The encryption / decryption control module 41 calls the connected encryption / decryption hardware circuit core 5, and according to the obtained encryption / decryption algorithm parameters, runs the encryption / decryption algorithm execution instructions stored in the encryption / decryption instruction buffer 51 to perform encryption / decryption operations on the message to be encrypted / decrypted, so as to generate the encryption / decryption data of the message to be encrypted / decrypted.

[0045] Step S24: The encryption / decryption control module 41 calls the connected encryption / decryption hardware circuit core 5 to run the authentication algorithm parameter read / write instructions stored in the encryption / decryption instruction buffer 51 to obtain the SRAM address used to store the authentication algorithm parameters and the authentication algorithm parameters.

[0046] Step S25: The encryption / decryption control module 41 calls the connected encryption / decryption hardware circuit core 5, and according to the obtained authentication algorithm parameters, runs the authentication algorithm execution instructions stored in the encryption / decryption instruction buffer 51 to perform authentication operations on the message to be encrypted / decrypted, so as to generate authentication data of the message to be encrypted / decrypted.

[0047] Step S26: The encryption / decryption control module 41 calls the connected encryption / decryption hardware circuit core 5 to run the data write-back instruction stored in the encryption / decryption instruction buffer, and writes the generated encryption / decryption data and the authentication data back to the SRAM memory 2.

[0048] It should be noted that if authentication of the message to be encrypted / decrypted is not required, then there is no need to generate corresponding authentication data, and steps S24 and S25 can be omitted. Furthermore, when writing back data, only the encryption / decryption data needs to be written back. Similarly, if encryption / decryption of the message to be encrypted / decrypted is not required, then there is no need to generate corresponding encryption / decryption data, and steps S22 and S23 can be omitted. Furthermore, when writing back data, only the authentication data needs to be written back. Therefore, whether encryption / decryption data and authentication data are generated during the encryption / decryption operation performed by the encryption / decryption hardware circuit can be set according to requirements, and this application does not impose any limitations.

[0049] In one embodiment, the encryption / decryption microengine 4 includes multiple protocol encapsulation modules. Each of the protocol encapsulation modules is connected to the DRAM memory.

[0050] Therefore, the encryption / decryption micro-engine 4 can perform protocol encapsulation on the message to be encrypted / decrypted before performing encryption / decryption operations on it. Specifically, this includes: obtaining each data packet to be encrypted / decrypted stored in the DRAM memory 1 through each protocol encapsulation module, performing protocol encapsulation operations on each message to be encrypted / decrypted to generate header data for each message; and storing each message to be encrypted / decrypted and its corresponding header data together in the DRAM memory 1, so that each encryption / decryption control module 41 can respectively call the DMA controller 3 and its connected encryption / decryption hardware circuit core 5 to perform encryption / decryption operations on each message to be encrypted / decrypted.

[0051] It should be noted that, in this embodiment, the header data of the corresponding message to be encrypted / decrypted generated by the protocol encapsulation module is stored in the same DRAM address partition as the message to be encrypted / decrypted. When the encryption / decryption control module 41 calls the DMA controller 3 to copy the data packet to be encrypted / decrypted from the DRAM memory 1 to the SRAM memory 2, the DMA controller 3 simultaneously copies data from the DRAM memory 1 to the SRAM memory 2, providing parameter basis for performing encryption / decryption operations on the message to be encrypted / decrypted.

[0052] Specifically, the header data refers to the metadata in the network request or response message, which provides additional information about the request or response, such as the data types, languages, and encoding methods that the client can accept.

[0053] Taking IPsec protocol messages as an example, in tunnel mode, the methods for encapsulating the protocol include adding IP header data and ESP header data, and encapsulating them in a new IPO data packet for transmission.

[0054] Step S3: The encryption / decryption control module 41 calls the DMA controller 3 again to copy the encryption / decryption data and the authentication data from the SRAM memory 2 to the DRAM memory 1.

[0055] In a preferred embodiment, after the encryption / decryption data and the authentication data are copied from the SRAM memory 2 to the DRAM memory 1, the corresponding SRAM address partition is released so that the multi-core parallel encryption / decryption device can continue to perform subsequent encryption / decryption operations.

[0056] In one embodiment, the multi-core parallel encryption / decryption device further includes a data output module. The data output module is connected to the DRAM memory 1 and is used to send the data packet to be encrypted / decrypted, along with the encryption / decryption data and authentication data of the encrypted / decrypted message stored in the DRAM memory 1, to an external device, and to release the corresponding DRAM address partition, so that the multi-core parallel encryption / decryption device can continue to perform subsequent encryption / decryption operations, thereby improving the resource utilization of the DRAM memory.

[0057] To better describe the specific structure of the multi-core parallel encryption / decryption device and the specific process of performing encryption / decryption operations on multiple data packets to be encrypted / decrypted from the input smart network card in parallel using this device, this application provides a specific embodiment to illustrate in detail the structure of a quad-core parallel encryption / decryption device and the process of performing encryption operations using this device.

[0058] Example: A quad-core parallel encryption / decryption device 500.

[0059] like Figure 5 As shown, the quad-core parallel encryption / decryption device 500 includes: a DRAM memory 501, an SRAM memory 502, a DMA controller 503, an encryption / decryption micro-engine 504, and four encryption / decryption hardware circuit cores 505.

[0060] The DRAM memory 501 includes four DRAM address partitions: a first DRAM address partition, a second DRAM address partition, a third DRAM address partition, and a fourth DRAM address partition, each capable of storing four different data packets to be encrypted / decrypted. The SRAM memory 502 includes four SRAM address partitions corresponding one-to-one with the DRAM address partitions: a first SRAM address partition, a second SRAM address partition, a third SRAM address partition, and a fourth SRAM address partition, each capable of storing four different data packets to be encrypted / decrypted copied from each DRAM address partition of the DRAM memory 501 by the DMA controller. The encryption / decryption microengine 504 includes: The system includes four protocol encapsulation modules and four encryption / decryption control modules 5042 connected to each protocol encapsulation module. These modules are: a first protocol encapsulation module 5041, a second protocol encapsulation module 5041, a third protocol encapsulation module 5041, a fourth protocol encapsulation module 5041, a first encryption / decryption control module 5042, a second encryption / decryption control module 5042, a third encryption / decryption control module 5042, and a fourth encryption / decryption control module 5042. Each encryption / decryption hardware circuit core 505 is also a first encryption / decryption hardware circuit core 505, a second encryption / decryption hardware circuit core 505, a third encryption / decryption hardware circuit core 505, and a fourth encryption / decryption hardware circuit core 505. Each core includes an encryption / decryption instruction buffer for storing encryption / decryption operation instruction sets and encryption / decryption operation parameter sets.

[0061] like Figure 5 As shown, the first protocol encapsulation module 5041, the second protocol encapsulation module 5041, the third protocol encapsulation module 5041, and the fourth protocol encapsulation module 5041 of the encryption / decryption microengine 504 are respectively connected to the DRAM memory 501; the first encryption / decryption control module 5042, the second encryption / decryption control module 5042, the third encryption / decryption control module 5042, and the fourth encryption / decryption control module 5042 of the encryption / decryption microengine 504 are respectively connected to the DMA controller and each encryption / decryption hardware circuit core 505. Specifically, the first encryption / decryption control module 5042 is connected to the first encryption / decryption hardware circuit core 505, the second encryption / decryption control module 5042 is connected to the second encryption / decryption hardware circuit core 505, the third encryption / decryption control module 5042 is connected to the third encryption / decryption hardware circuit core 505, and the fourth encryption / decryption control module 5042 is connected to the fourth encryption / decryption hardware circuit core 505; the DMA controller 503 is respectively connected to the DRAM memory 501 and the SRAM memory 502, and each encryption / decryption hardware circuit core 505 is respectively connected to the SRAM memory 502.

[0062] The encryption / decryption micro-engine 504 is used to distribute multiple data packets to be encrypted / decrypted stored in the DRAM memory 501 to each protocol encapsulation module 5041 and each encryption / decryption control module 5042. Each protocol encapsulation module 5041 performs protocol encapsulation operations on the messages to be encrypted / decrypted in each data packet, and each encryption / decryption control module 5042 calls the DMA controller 503 and the encryption / decryption hardware circuit core 505 connected to it respectively to perform encryption / decryption operations on the messages to be encrypted / decrypted in each data packet in parallel, generating encryption / decryption data and authentication data of the messages to be encrypted / decrypted.

[0063] Specifically, the first protocol encapsulation module 5041 is used to perform protocol encapsulation operations on the message to be encrypted / decrypted stored in the first DRAM address partition, and the first encryption / decryption control module 5042 is used to perform encryption / decryption operations on the message to be encrypted / decrypted stored in the first DRAM address partition by calling the DMA controller 503 and the first encryption / decryption hardware circuit core 505; the second protocol encapsulation module 5041 is used to perform protocol encapsulation operations on the message to be encrypted / decrypted stored in the second DRAM address partition, and the second encryption / decryption control module 5042 is used to perform encryption / decryption operations on the message to be encrypted / decrypted stored in the second DRAM address partition by calling the DMA controller 503 and the second encryption / decryption hardware circuit core 505. The third protocol encapsulation module 5041 is used to perform protocol encapsulation operations on the message to be encrypted / decrypted stored in the third DRAM address partition. The third encryption / decryption control module 5042 is used to perform encryption / decryption operations on the message to be encrypted / decrypted stored in the third DRAM address partition by calling the DMA controller 503 and the third encryption / decryption hardware circuit core 505. The fourth protocol encapsulation module 5041 is used to perform protocol encapsulation operations on the message to be encrypted / decrypted stored in the fourth DRAM address partition. The fourth encryption / decryption control module 5042 is used to perform encryption / decryption operations on the message to be encrypted / decrypted stored in the fourth DRAM address partition by calling the DMA controller 503 and the fourth encryption / decryption hardware circuit core 505. It should be noted that each protocol encapsulation module 5041 and each encryption / decryption control module 5042 operate independently without interfering with each other. After one operation is completed, the next data to be encrypted / decrypted is input and executed without affecting the process of other modules or being affected by other modules. This allows multiple data packets to be encrypted / decrypted to be executed at once, greatly improving execution efficiency and effectively enhancing the device's encryption / decryption capabilities. It can quickly process high-volume real-time services and meet the performance indicators of high-speed networks.

[0064] Taking the encryption operation of an IPsec protocol message by a protocol encapsulation module 5041 and an encryption / decryption control module 5042 of a quad-core parallel encryption / decryption device 500 as an example, the specific process is as described in steps S501 to S511.

[0065] Step S501: Obtain the IPsec protocol data packet to be encrypted from the first DRAM address partition stored in the DRAM memory 501 through the first protocol encapsulation module 5041.

[0066] The IPsec protocol data packet to be encrypted includes: the IPsec protocol message to be encrypted and the encryption algorithm parameters of the IPsec protocol message to be encrypted; if authentication of the IPsec protocol message to be encrypted is required, the data packet to be encrypted also includes the authentication algorithm parameters of the IPsec protocol message to be encrypted.

[0067] Step S502: Perform protocol encapsulation operation on the obtained IPsec protocol messages to be encrypted, generate header data for each IPsec protocol message to be encrypted, and store the header data in the first DRAM address partition of the DRAM memory 501.

[0068] It should be noted that the first DRAM address partition is allocated with several DRAM addresses, which can not only store various types of data of the original IPsec protocol data packet to be encrypted, but also store various types of data corresponding to the IPsec protocol message to be encrypted generated later, such as header data, including IP header data and ESP header data.

[0069] Step S503: The first encryption / decryption control module 5042 calls the DMA controller 503 to copy the IPsec protocol data packet to be encrypted and the corresponding header data from the first DRAM address partition of the DRAM memory 501 to the first SRAM address partition of the SRAM memory 502, and the first encryption / decryption control module 5042 writes each SRAM address of the stored data into the encryption / decryption operation parameter set of the first encryption / decryption hardware circuit core 505.

[0070] Step S504: The first encryption / decryption control module 5042 calls the first encryption / decryption hardware circuit core 505 to run the message read / write instructions to be encrypted / decrypted in the encryption / decryption execution instruction set, so as to obtain the SRAM address for storing the encrypted IPsec protocol message and the IPsec protocol message to be encrypted.

[0071] Step S505: The first encryption / decryption control module 5042 calls the first encryption / decryption hardware circuit core 505 to run the encryption / decryption algorithm parameter read / write instructions in the encryption / decryption execution instruction set to obtain the SRAM address for storing the encryption algorithm parameters and the encryption / decryption algorithm parameters.

[0072] Step S506: The first encryption / decryption control module 5042 calls the first encryption / decryption hardware circuit core 505 to run the encryption / decryption algorithm execution instructions in the encryption / decryption execution instruction set according to the obtained encryption algorithm parameters, and performs encryption operation on the obtained IPsec protocol message to be encrypted to generate the ciphertext data of the IPsec protocol message to be encrypted.

[0073] Step S507: The first encryption / decryption control module 5042 calls the first encryption / decryption hardware circuit core 505 to run the authentication algorithm parameter read / write instructions in the encryption / decryption execution instruction set to obtain the SRAM address for storing the authentication algorithm parameters and the authentication algorithm parameters.

[0074] Step S508: The first encryption / decryption control module 5042 calls the first encryption / decryption hardware circuit core 505 to run the authentication algorithm execution instructions in the encryption / decryption execution instruction set according to the obtained authentication algorithm parameters, and performs authentication operation on the obtained IPsec protocol message to be encrypted to generate authentication data of the IPsec protocol message to be encrypted.

[0075] Step S509: The first encryption / decryption control module 5042 calls the first encryption / decryption hardware circuit core 505 to run the data write-back instruction in the encryption / decryption operation instruction set, and writes back the generated ciphertext data and the authentication data to the first SRAM address partition of the SRAM memory 502. At the same time, the SRAM addresses of the stored data are written into the encryption / decryption operation parameter set of the first encryption / decryption hardware circuit core 505.

[0076] Step S510: The first encryption / decryption control module 5042 calls the DMA controller 503 again to copy the ciphertext data and the authentication data from the first SRAM address partition of the SRAM memory 502 to the first DRAM address partition of the DRAM memory 501, and releases the first SRAM address partition.

[0077] Step S511: Send the IPsec protocol data packet to be encrypted, the ciphertext data and authentication data of the encrypted IPsec protocol message stored in the DRAM memory 501 to an external device, and release the first DRAM address partition.

[0078] Similarly, the principle is the same as steps S501 to S511 above when performing decryption operations on the message to be decrypted in the data packet to be decrypted.

[0079] In the embodiments of this application, terms such as "first" and "second" are used to distinguish identical or similar items with essentially the same function and effect. For example, "first XX" and "second XX" are merely used to distinguish different XXs and do not limit their order. Those skilled in the art will understand that terms such as "first" and "second" do not limit the quantity or execution order, and that terms such as "first" and "second" do not necessarily imply that they are different.

[0080] It should be noted that, in the embodiments of this application, the words "exemplary" or "for example" indicate examples, illustrations, or descriptions. Any embodiment or design described as "exemplary" or "for example" in this application should not be construed as being more preferred or advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary" or "for example" is intended to present the relevant concepts in a concrete manner.

[0081] In this application embodiment, "at least one" refers to one or more, and "more than one" refers to two or more. "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A alone, A and B simultaneously, or B alone, where A and B can be singular or plural. The character " / " generally indicates that the preceding and following related objects are in an "or" relationship. "At least one of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one of a, b, or c can represent: a, b, c, ab, ac, bc, or abc, where a, b, and c can be single or multiple.

[0082] It should be understood that the module division in the embodiments of this application is illustrative and only represents a logical functional division. In actual implementation, there may be other division methods. Furthermore, the functional modules in the various embodiments of this application can be integrated into a single processor, exist as separate physical entities, or be integrated into a single module. The integrated modules described above can be implemented in hardware or as software functional modules.

[0083] Those skilled in the art will recognize that the various illustrative logical blocks and steps described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this application.

[0084] In the embodiments provided in this application, it should be understood that the device embodiments described above are merely illustrative. For example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between devices or units may be electrical, mechanical, or other forms.

[0085] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0086] In addition, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0087] In the above embodiments, the functions of each functional unit can be implemented entirely or partially through software, hardware, firmware, or any combination thereof. When implemented using software, it can be implemented entirely or partially in the form of a computer program product. A computer program product includes one or more computer instructions (programs). When the computer program instructions (programs) are loaded and executed on a computer, all or part of the flow or function according to the embodiments of this application is generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. Computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that integrates one or more available media. The available media can be magnetic media (e.g., floppy disks, hard disks, magnetic tapes), optical media (e.g., high-density digital video discs, DVDs), or semiconductor media (e.g., solid-state disks, SSDs, etc.).

[0088] If a function is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0089] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0090] In summary, this application provides a multi-core parallel encryption / decryption device. Through a configured encryption / decryption micro-engine, multiple data packets to be encrypted / decrypted, stored in DRAM memory, are distributed to multiple encryption / decryption control modules within the micro-engine. Each encryption / decryption control module then calls a DMA controller to copy each data packet to SRAM memory and calls a specific encryption / decryption hardware circuit core to perform encryption / decryption operations on the messages within each data packet. This achieves parallel operation on each data packet, with each operation remaining independent and non-interfering with others, significantly improving the execution efficiency of encryption / decryption operations. It solves the problem in existing technologies where smart network cards, due to the use of a single hardware encryption / decryption circuit, have limited computing power and struggle to achieve high-speed network performance indicators. This facilitates the rapid processing of high-volume real-time services by smart network cards.

[0091] Therefore, this application effectively overcomes the various shortcomings of the prior art and has high industrial application value.

[0092] The above embodiments are merely illustrative of the principles and effects of this application and are not intended to limit this application. Any person skilled in the art can modify or alter the above embodiments without departing from the spirit and scope of this application. Therefore, all equivalent modifications or alterations made by those skilled in the art without departing from the spirit and technical concept disclosed in this application should still be covered by the claims of this application.

Claims

1. A multi-core parallel encryption / decryption device, characterized in that, include: DRAM memory, SRAM memory, DMA controller, encryption / decryption microengine, and multiple encryption / decryption hardware circuit cores; The encryption / decryption micro-engine is connected to the DMA controller and each encryption / decryption hardware circuit core, the DMA controller is connected to the DRAM memory and the SRAM memory, and each encryption / decryption hardware circuit core is connected to the SRAM memory. The encryption / decryption micro-engine includes: multiple encryption / decryption control modules, each of which is connected to an encryption / decryption hardware circuit core; the encryption / decryption micro-engine is used to allocate multiple data packets to be encrypted / decrypted stored in the DRAM memory to each of the encryption / decryption control modules, and through each encryption / decryption control module, to call the DMA controller and the encryption / decryption hardware circuit core connected to it respectively, so as to perform encryption / decryption operations on the messages to be encrypted / decrypted in each data packet in parallel, and generate encryption / decryption data and authentication data of the messages to be encrypted / decrypted; The method of using the encryption / decryption control module to invoke the DMA controller and the connected encryption / decryption hardware circuit core to perform encryption / decryption operations on the messages to be encrypted / decrypted in each data packet to be encrypted / decrypted includes: invoking the DMA controller through the encryption / decryption control module to copy the allocated data packets to be encrypted / decrypted from the DRAM memory to the SRAM memory; wherein, the data packets to be encrypted / decrypted include: the message to be encrypted / decrypted and the encryption / decryption algorithm parameters and authentication algorithm parameters of the message to be encrypted / decrypted; invoking the connected encryption / decryption hardware circuit core through the encryption / decryption control module to perform encryption / decryption operations on the message to be encrypted / decrypted according to the encryption / decryption algorithm parameters and the authentication algorithm parameters, so as to generate encryption / decryption data and authentication data of the message to be encrypted / decrypted and store them in the SRAM memory; and invoking the DMA controller again through the encryption / decryption control module to copy the encryption / decryption data and the authentication data from the SRAM memory to the DRAM memory.

2. The multi-core parallel encryption / decryption device according to claim 1, characterized in that, Each of the encryption / decryption hardware circuit cores includes: an encryption / decryption instruction buffer, used to store a preset encryption / decryption execution instruction set and an encryption / decryption execution parameter set.

3. The multi-core parallel encryption / decryption device according to claim 2, characterized in that, The method of using the encryption / decryption control module to call the DMA controller and the connected encryption / decryption hardware circuit core to perform encryption / decryption operations on the messages to be encrypted / decrypted in each data packet also includes: After copying the message to be encrypted / decrypted, along with the encryption / decryption algorithm parameters and authentication algorithm parameters of the message to be encrypted / decrypted, into the SRAM memory, the encryption / decryption control module writes each SRAM address of the stored data into the encryption / decryption operation parameter set of the encryption / decryption instruction buffer. After storing the encryption / decryption data and authentication data of the message to be encrypted / decrypted in the SRAM memory, the encryption / decryption control module writes the SRAM addresses of the stored data into the encryption / decryption operation parameter set of the encryption / decryption instruction buffer.

4. The multi-core parallel encryption / decryption device according to claim 2, characterized in that, The encryption / decryption instruction set is initialized into the encryption / decryption instruction buffer of each encryption / decryption hardware circuit core when the encryption / decryption micro-engine starts, including: Commands for running encryption / decryption algorithms, commands for running authentication algorithms, commands for reading / writing encryption / decryption algorithm parameters, commands for reading / writing authentication algorithm parameters, commands for reading / writing messages to be encrypted / decrypted, and commands for writing back data.

5. The multi-core parallel encryption / decryption device according to claim 4, characterized in that, The methods for generating the encryption / decryption data and authentication data of the message to be encrypted / decrypted include: The encryption / decryption control module calls the connected encryption / decryption hardware circuit core to run the read / write instructions for the message to be encrypted / decrypted stored in the encryption / decryption instruction buffer, so as to obtain the SRAM address for storing the message to be encrypted / decrypted and the message to be encrypted / decrypted. The encryption / decryption control module calls the connected encryption / decryption hardware circuit core to run the encryption / decryption algorithm parameter read / write instructions stored in the encryption / decryption instruction buffer, so as to obtain the SRAM address used to store the encryption / decryption algorithm parameters and the encryption / decryption algorithm parameters. The encryption / decryption control module calls the connected encryption / decryption hardware circuit core, and according to the obtained encryption / decryption algorithm parameters, runs the encryption / decryption algorithm execution instructions stored in the encryption / decryption instruction buffer to perform encryption / decryption operations on the obtained message to be encrypted / decrypted, so as to generate the encryption / decryption data of the message to be encrypted / decrypted. The encryption / decryption control module calls the connected encryption / decryption hardware circuit core to run the authentication algorithm parameter read / write instructions stored in the encryption / decryption instruction buffer, so as to obtain the SRAM address used to store the authentication algorithm parameters and the authentication algorithm parameters. The encryption / decryption control module calls the connected encryption / decryption hardware circuit core, runs the authentication algorithm execution instructions stored in the encryption / decryption instruction buffer according to the obtained authentication algorithm parameters, performs authentication operation on the obtained message to be encrypted / decrypted, and generates authentication data of the message to be encrypted / decrypted. The encryption / decryption control module calls the connected encryption / decryption hardware circuit core to execute the data write-back instruction stored in the encryption / decryption instruction buffer, and writes the generated encryption / decryption data and the authentication data back to the SRAM memory.

6. The multi-core parallel encryption / decryption device according to claim 1, characterized in that, The DRAM memory includes: multiple DRAM address partitions; each DRAM address partition is used to store a data packet to be encrypted or decrypted, as well as the encryption / decryption data and authentication data of the data packet to be encrypted or decrypted.

7. The multi-core parallel encryption / decryption device according to claim 6, characterized in that, The multi-core parallel encryption / decryption device also includes: The data output module, connected to the DRAM memory, is used to send the data packet to be encrypted / decrypted, as well as the encryption / decryption data and authentication data of the encrypted / decrypted message stored in the DRAM memory, to an external device, and release the corresponding DRAM address partition.

8. The multi-core parallel encryption / decryption device according to claim 1, characterized in that, The SRAM memory includes: multiple SRAM address partitions; each SRAM address partition is used to store a data packet to be encrypted / decrypted copied from the DRAM memory by the DMA controller, as well as the encryption / decryption data and authentication data of the generated message to be encrypted / decrypted; after the encryption / decryption data and the authentication data are copied from the SRAM memory to the DRAM memory, the corresponding SRAM address partition is released.

9. The multi-core parallel encryption / decryption device according to claim 1, characterized in that, The encryption / decryption micro-engine includes: Multiple protocol encapsulation modules are connected to the DRAM memory, respectively; Each protocol encapsulation module obtains the corresponding data packets to be encrypted or decrypted stored in the DRAM memory, and performs protocol encapsulation operations on each message to be encrypted or decrypted to generate the header data of each message to be encrypted or decrypted. Each message to be encrypted or decrypted, along with its corresponding header data, is stored in the DRAM memory. This allows each encryption / decryption control module to call the DMA controller and its connected encryption / decryption hardware circuit to perform encryption / decryption operations on each message.

Images