Data encryption transmission method, application and system

Abstract

The present invention discloses a data encryption transmission method, application and system, wherein the data encryption transmission method comprises: dividing the data to be transmitted into a plurality of data frames based on the length of the data to be transmitted and the effective load of the transmission line; encrypting each data frame using the first key data of the determined field; generating a transmission matrix according to the number of data frames and the second key data of the determined field to obtain the transmission order of each data frame, and transmitting the encrypted data frames accordingly. The present invention encrypts and reorders the data during the data transmission process, prevents the algorithm analysis of the underlying hardware starting from the driver, and realizes the full system security transmission from the driver to the FPGA.

Description

Technical Field

[0001] The present invention relates to the field of data encryption technology, and in particular to a data encryption transmission method, application and system. Background Art

[0002] Secure Hash Algorithm (SHA), also known as hash algorithm, is an encryption algorithm. It has been widely used and developed in digital signature, file verification, data retrieval, etc. due to its short and fixed hash value and anti-collision characteristics. In the context of the rapid development of the current digital economy, information security is increasingly valued, and "digital economy, security is the key". A safe and efficient hash algorithm rapid implementation system and method has broad application prospects not only in the economy, but also in defense and science and technology.

[0003] The implementation process of the hash algorithm is complex and requires traversing all the data of the file to be encrypted, which adds difficulty to the rapid implementation. At present, the application of the hash algorithm is mainly implemented in software. For large files, the software traverses the data and calculates the two processes, which takes a long time and consumes more CPU resources. At the same time, there are certain security risks in the operation of the software, because once the host running the software carries a Trojan virus or the system is hacked, the information and algorithm will be leaked. In addition, the existing encryption chips on the market can also implement the hash algorithm in the form of a circuit, which is relatively safe, but the transmission rate of the chip-mounted circuit under the general interface bus (such as USB interface, serial peripheral interface SPI, universal serial interface UART, integrated circuit bus interface IIC, etc.) is low, about hundreds of kbps, and it is difficult to match people's high-speed and efficient needs in the interactive process. Although the patent CN108628791B is a high-speed security chip based on the PCIE interface, it does not have a matching security driver. If its interface is called to read and write memory to other devices, it is possible to understand the structure of its interface read and write data, and there is a certain risk of algorithm deciphering. Summary of the invention

[0004] Purpose of the invention: In view of the above problems, the present invention provides a data encryption transmission method, application and system, which not only ensures the security of data transmission, but also realizes a safe, efficient and fast encryption process for the entire system from driver to FPGA.

[0005] Technical solution:

[0006] A data encryption transmission method, comprising:

[0007] Dividing the data to be transmitted into a number of data frames based on the length of the data to be transmitted and the effective load of the transmission line;

[0008] Encrypting each data frame using first key data of a certain field;

[0009] A transmission matrix is ​​generated according to the number of data frames and the second key data of the determined field to obtain the transmission order of each data frame, and each encrypted data frame is transmitted accordingly.

[0010] The transfer matrix is ​​generated as follows:

[0011] If the number of data frames N is less than or equal to the number of bits M of the second key data, the first N bits of the second key data are taken to generate a transmission matrix;

[0012] If the number of data frames N is greater than M, then if N / the number of bits of the second key data = n and mod(N,M) = m, then initially, each M data frames are grouped together to form n groups, and a transmission matrix is ​​generated for each group in the same way as when N is equal to M. Finally, the remaining m data frames generate a transmission matrix in the same way as when N is less than M.

[0013] The process of generating the transmission matrix is ​​as follows:

[0014] If the data on the i-th bit is 0, it means that the i-th data frame is still the i-th transmitted;

[0015] If an odd number of 1 data is found at the jth position, the next 1 data is searched. If no data is found, the order of the transmitted data remains unchanged.

[0016] If the next data with a value of 1 is retrieved, that is, an even number of data with a value of 1 is at the gth position, the jth data frame is exchanged with the gth data frame for transmission;

[0017] Based on this, an N-order transmission matrix is ​​constructed.

[0018] The process of generating the transmission matrix is ​​as follows:

[0019] If the data on the i-th bit is 0, it means that the i-th data frame is still the i-th transmitted;

[0020] If the data at the jth bit is found to be 1, the next data that is not 1 is searched. If no data is found, the order of the transmitted data remains unchanged.

[0021] If the data at the j+1th bit is found to be 1, the data frame at the j+1th bit is swapped with the data at the jth bit for transmission;

[0022] Based on this, an N-order transmission matrix is ​​constructed.

[0023] The transmission line is a PCIE bus, and its effective load is 4KB.

[0024] The receiving end uses the second key data to obtain the transmission order, and uses the first key data to decrypt each data frame.

[0025] The key length is P bytes, and the header information is formed by combining the number of data frames and the key data of the first P1 bytes of the key, which is transmitted together with each data frame; the field of the first key is the key data of the P2 bytes in the middle of the key, and the field of the second key is the key data of the last P-P1-P2 bytes of the key.

[0026] An application of the aforementioned data encryption transmission method in data verification includes:

[0027] Dividing the data to be transmitted into a number of data frames based on the length of the data to be transmitted and the effective load of the transmission line;

[0028] Combining the key data of the determined field, the irreducible polynomial coefficients and the number of transmitted data frames to form header information;

[0029] Encrypting each data frame using first key data of a certain field;

[0030] Generate a transmission matrix according to the number of data frames and the second key data of the determined field to obtain the transmission order of each data frame, and transmit the header information and each encrypted data frame to the hash algorithm module accordingly;

[0031] The hash algorithm module performs a hash operation on the input data according to the key data and irreducible polynomial coefficients in the header information to obtain a hash value;

[0032] Subsequent input data uses the previously generated hash value as the key and combines it with the irreducible polynomial coefficients to perform a hash operation on the input data to obtain the corresponding hash value.

[0033] After the hash algorithm module performs hash operation to obtain the hash value, it uses the key data of the determined field to encrypt the obtained hash value and transmits it to the host computer. The host computer decrypts the input data according to the corresponding key data to obtain the corresponding hash value, which is the verification code.

[0034] Divide the key stored in the host computer into four sections of key data of certain fields;

[0035] Among them, the header information is formed by combining the number of the data frames and the first segment of key data of the key split, and is transmitted together with each of the data frames; the field of the first key is the second segment of key data of the key split, the field of the second key is the third segment of key data of the key split, and the key data encrypted by the hash algorithm module for the hash value is the fourth segment of key data of the key split.

[0036] The hash operation is specifically as follows: converting irreducible polynomial parameters in the input data into polynomials, combining them with the key data in the received header information to generate a Toeplitz matrix, and performing matrix operation on the Toeplitz matrix and the input data to obtain a hash value.

[0037] A system for implementing the above application, comprising:

[0038] The host computer stores the key, the irreducible polynomial coefficients and the address pointer and data length corresponding to the two in advance;

[0039] The driving module is arranged in the upper computer, generates header information according to the key, the irreducible polynomial coefficients and the address pointer and data length corresponding to the two, encrypts each data frame according to the key data, generates a transmission matrix in combination with the key data and the number of data frames, transmits the header information and the encrypted data to be transmitted to the FPGA via the transmission line; and at the same time, uses the key data to decrypt the data encrypted by the hash algorithm module transmitted by the FPGA to obtain a check code;

[0040] FPGA, including storage module and hash algorithm module;

[0041] The storage module is used to store the data transmitted by the driving module and the data after the hash operation by the hash algorithm module;

[0042] The hash algorithm module is connected to the storage module, performs a hash operation on the data transmitted from the driving module to the storage module to obtain a check code, encrypts the check code with key data, and then transmits the check code to the driving module.

[0043] The storage module includes an address space DDR-1 for storing input data and an address space DDR-2 for storing output data;

[0044] The data transmitted by the driving module is stored in DDR-1, and the data after hash operation by the hash algorithm module is stored in DDR-2.

[0045] The driver module obtains the data length of the data to be transmitted by the host computer before the transmission starts, and determines whether it exceeds the maximum capacity of the FPGA that can store input data; if it exceeds, an error is returned and no data transmission task is performed; if it is within the allowable range, header information is generated according to claim 5, and the data is divided into data frames corresponding to the effective load of the transmission line, and the data that is less than the effective load of the corresponding transmission line is supplemented by zero.

[0046] The transmission line is a PCIE bus, the host computer is provided with a PCIE slot, and the FPGA is plugged into the PCIE slot to form a complete PCIE bus path.

[0047] Beneficial effects:

[0048] (1) The present invention is based on PCIE interface transmission (PCIE is a high-speed serial computer expansion bus, and the bit rate of PCIE3.0 can reach 8Gbps), and the PCIE bus solves the problem of slow file traversal speed. The host computer can directly read and write to the FPGA memory through the PCIE bus, and quickly import data into the FPGA. In addition, the ultra-high computing speed of the FPGA's logic operation unit ensures that the algorithm can quickly obtain the hash value, greatly improving the efficiency and application of the encryption process.

[0049] (2) The present invention encrypts and reorders data during the data transmission process, thereby preventing algorithm analysis of the underlying hardware starting from the driver and achieving full system security transmission from the driver to the FPGA.

[0050] (3) The encryption algorithm system described in this system belongs to a hardware encryption system. The entire system is composed only of specific logic circuits. After the data is input, the system gives the result according to the logic structure. Therefore, the data and logic cannot be stolen through external software instructions, which ensures the security of the encryption process.

[0051] (4) The entire system is simple and easy to operate, suitable for various environments and input data of the host computer, and has good compatibility. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] Figure 1 A simplified schematic diagram of the sorting algorithm for data frame transmission.

[0053] Figure 2 It is a flow chart of the data verification application method of the present invention.

[0054] Figure 3 Schematic diagram of the data verification application system of the present invention. DETAILED DESCRIPTION

[0055] The present invention is further explained below in conjunction with the accompanying drawings and specific embodiments.

[0056] The data encryption transmission method of the present invention comprises the following steps:

[0057] (1) The host computer pre-stores a key generated according to the agreed length, an address pointer of the key, and an agreed key length of P bytes, and stores the address pointer and data length of the data to be transmitted according to the data to be transmitted; the present invention increases the key length to facilitate the inheritance of the interface according to the requirements of the length of the verification code to be formed later; in the present invention, the key is divided into four sections of key data of a certain field, and in the present invention, it can be equally divided into four sections of key data; further, the present invention can also divide the key into four sections of key data of a certain field according to the requirements, and the word lengths are P1 bytes, P2 bytes, P3 bytes and (P-P1-P2-P3) bytes respectively; in the present invention, the key length is set to 64 bytes;

[0058] (2) Before the start of transmission, the data length of the data to be transmitted pre-stored in the host computer is obtained, and it is determined whether it exceeds the maximum capacity of the subsequent data processing module that can store input data; if it exceeds, an error is returned and no data transmission task is performed; if it is within the allowed range, the header information of the data packet is formed, and the data to be transmitted is divided into a number of data frames, and the basis for the division is determined according to the data payload of the data transmission line, and the data that is less than the payload is padded with 0; the present invention adopts the PCIE bus for transmission, so the data to be transmitted is divided into a number of 4KB data frames, and the data that is less than 4KB is padded with 0; the reason for the data frame of this size is that in the transaction layer packet (TLP) message of the PCIE bus, the maximum value of the data payload is 4KB, and the data structure transmission divided into 4KB ensures the maximization of the transmission efficiency of the PCIE bus;

[0059] The header information of the data packet includes: the generated identification of the data to be transmitted and the corresponding transmission sequence number, key data and the number of transmission data frames; the subsequent data processing module (the present invention adopts FPGA) only operates on the data with the identification, and the identification provides a judgment basis for the subsequent data module whether to filter out the data; the transmission sequence number is used to distinguish different transmission data, and each transmission will generate a mutually exclusive transmission sequence number; in the present invention, the key data of the header information is the first segment of key data of key segmentation, more specifically, the first 16 bytes of key data;

[0060] (3) encrypting each data frame, specifically: performing an XOR operation on the data in each data frame and the second segment of key data divided by the key;

[0061] (4) Generate a transmission matrix (N-order permutation matrix) based on the third key data segmented from the key segmentation and the number of data frames N. There are two specific ways to generate the matrix:

[0062] a. If N is less than or equal to 128, the first N bits of the third key data of the key segment are taken to generate the transmission matrix;

[0063] b. If it is greater than 128, such as N / 128 = n and mod(N,128) = m, then first, 128 data frames are grouped into n groups, and each group generates a transmission matrix in the same way as when N is equal to 128; finally, the remaining m data frames generate a transmission matrix in the same way as when N is less than 128;

[0064] The specific process of generating the transmission matrix is ​​as follows:

[0065] like Figure 1 As shown, taking 16 bytes of key data as an example, the 16 bytes of key data are retrieved:

[0066] If the data on the i-th bit is 0, it means that the i-th data frame is still the i-th transmitted;

[0067] If an odd number of 1 data is found at the jth position, the next 1 data is searched. If no data is found, the order of the transmitted data remains unchanged.

[0068] If the next data with a value of 1 is retrieved, that is, an even number of data with a value of 1 is at the gth position, the jth data frame is exchanged with the gth data frame for transmission;

[0069] Based on this, a 128-order transmission matrix is ​​constructed;

[0070] In the present invention, other methods may also be set to construct the corresponding transmission matrix, such as:

[0071] If the data on the i-th bit is 0, it means that the i-th data frame is still the i-th transmitted;

[0072] If the data at the jth bit is found to be 1, the next data that is not 1 is searched. If no data is found, the order of the transmitted data remains unchanged.

[0073] If the data at the j+1th bit is found to be 1, the data frame at the j+1th bit is swapped with the data at the jth bit for transmission;

[0074] Based on this, a 128-order transmission matrix is ​​constructed;

[0075] (5) According to the transmission matrix determined in step (4), the data to be transmitted encrypted in step (3) is transmitted to a subsequent data processing module via a transmission line. The subsequent data processing module sequentially uses the third-segment key data to obtain data transmission data and the second-segment key data to decrypt each data frame.

[0076] The present invention also provides an application method of the aforementioned data encryption transmission method in data verification, such as Figure 2 As shown, the steps include:

[0077] (1) In the aforementioned data encryption transmission method, the host computer also pre-stores irreducible polynomial coefficients generated according to the agreed length, the address pointer of the irreducible polynomial coefficients, and the length Q of the irreducible polynomial coefficients, and the subsequent data processing module is FPGA; the header information of the data packet includes the generated identification of the data to be transmitted and the corresponding transmission sequence number, key data, irreducible polynomial coefficients, and the number of transmission data frames; the present invention adds two parameters, namely, the key length and the irreducible polynomial parameter length, in consideration of the convenience of interface inheritance according to the requirements of the length of the check code formed later; in the present invention, the key data length is set to 64 bytes, and the length of the irreducible polynomial coefficient is set to 16 bytes;

[0078] (2) According to step (1), the data is continuously written into the memory of the FPGA via the PCIE bus, that is, 4KB of data is transmitted to the memory of the FPGA again and again. The written data will occupy the 4KB space from the initial address to the back. The number of data frames in the header information will be used to determine the number of data frame transmissions. Because the transmitted data has been encrypted and the transmission order has been changed, it will be extremely difficult to observe the data structure transmitted to the memory of the FPGA by using the driver to transmit the preset data file.

[0079] (3) The PCIE bus controls the FIFO memory to move the written data. The PCIE bus transmits an initial address to the FIFO memory and reads the data of the required word length from the initial address. For example, if 4KB of data is required, 4KB of data will be read according to the clock and counter inside the FIFO memory, and the data will be continuously transmitted to the hash algorithm module.

[0080] (4) The hash algorithm module performs hash operations;

[0081] (41) Convert the irreducible polynomial parameters in the input data into a polynomial, and combine it with the first segment of key data in the received header information to generate a Toeplitz matrix, and perform matrix operations on the Toeplitz matrix and the input data to obtain an intermediate value, which is written into the FIFO memory;

[0082] (42) When the subsequent data is input, the intermediate value generated in the previous time is used as the key and the polynomial to form a new matrix, and the matrix operation is performed with the new input data to obtain the intermediate value, and the fourth segment of the key data divided by the key is used for encryption and written into the FIFO memory;

[0083] (43) Repeat step (42) until all data have been input into the hash algorithm module. At this time, the intermediate value stored in the FIFO memory is the hash value, that is, the check code;

[0084] (5) After the calculation is completed, the FIFO memory writes the check code therein into the memory of the FPGA, and after the result of the check code is transmitted, an interrupt signal is sent to the PCIE bus;

[0085] (6) After receiving the interrupt signal, the PCIE bus will send an interrupt signal to the driver, similar to reminding that the last required data is ready;

[0086] (7) After the driver receives the interrupt signal, it reads the check code stored in the FPGA memory to the driver module according to the required word length. The driver module decrypts the check code based on the fourth segment key data and transmits the decrypted check code to the host computer, thus completing the entire check code generation process.

[0087] The present invention also provides a system based on the aforementioned data verification application method, such as Figure 3 As shown, it includes a host computer, a driver module and an FPGA. The host computer is provided with a PCIE slot for FPGA plugging. The FPGA is plugged into the PCIE slot to form a complete PCIE bus path, so that the host computer and the FPGA circuit can communicate with each other. The PCIE bus provides an AXI bus for data transmission into the FPGA, and controls the data flow written to the FPGA and read to the host computer (DDR read and write control). The main control method is to control the write and read addresses, and interrupt control to switch from write to read; the driver module is set in the host computer, and is used to encrypt and transmit the data to be transmitted by the host computer.

[0088] The host computer pre-stores a key generated according to an agreed length and an irreducible polynomial coefficient generated according to an agreed length, and stores an address pointer of the data to be transmitted, a data length, an address pointer of the key, an agreed key length, an address pointer of the irreducible polynomial coefficient and the length of the irreducible polynomial coefficient; wherein the data to be transmitted refers to all data to be transmitted and subsequently encrypted by a hash algorithm to form a check code, and its pointer is the first address of the data storage to be transmitted; the driver module will continuously fetch data from the host computer according to the address pointer and data length of the data to be transmitted until the provided data length is reached; the transmission of the key and the irreducible polynomial coefficient is also in the same way.

[0089] Before the transmission starts, the driver module obtains the data length of the data to be transmitted pre-stored in the host computer, and determines whether it exceeds the maximum capacity of the subsequent data processing module (the present invention uses FPGA) that can store input data; if it exceeds, an error is returned and no data transmission task is performed; if it is within the allowable range, the header information of the data packet is generated according to the input data, data length and other information, and the data is divided into data frames corresponding to the transmission line effective load (the transmission line of the present invention is PCIE bus, and the effective load is 4KB). For data that is less than the corresponding transmission line effective load, 0 is added to make up.

[0090] The driving module encrypts each data frame according to the key data, and generates a transmission matrix based on the key data and the number of data frames, and transmits the encrypted data to be transmitted to the subsequent data processing module via the transmission line; and the driving module decrypts the check code transmitted by the FPGA after hash operation and encryption by the hash algorithm module according to the key data, obtains the check code and transmits it to the host computer.

[0091] The FPGA includes a storage module and a hash algorithm module. The storage module includes an address space DDR-1 for storing input data and an address space DDR-2 for storing output data, which are independent of each other. The data written into the memory of the FPGA via the PCIE bus is stored in the DDR-1, and the data after the hash operation by the hash algorithm module is stored in the DDR-2. The maximum capacity of the PCIE bus transmission is 4KB. The present invention can meet the data transmission requirements of various lengths. In order to ensure the correctness of the transmission result, for data with a length less than 4KB, it is directly copied into the DDR-1 for transmission without segmentation. For data with a length exceeding 4KB but not exceeding the storage capacity of the FPGA, it is aligned and segmented, and is segmented into several 4KB data frames for transmission. For data exceeding the storage capacity of the FPGA, an error is returned as described above, and no data transmission task is performed.

[0092] The storage module is also provided with a read FIFO memory and a write FIFO memory, which are connected to DDR-1 and DDR-2 respectively, and are used to store data written into the memory of the FPGA via the PCIE bus and data after hash operation by the hash algorithm module respectively.

[0093] The hash algorithm module is connected to the storage module, and performs a hash operation on the data transmitted by DDR-1 from the read FIFO memory through the hash algorithm to generate a hash value (i.e., a check code), and encrypts it using the fourth segment key data and transmits it to DDR-2 via the write FIFO memory.

[0094] In the present invention, the agreed hash value word length is 16Byte (but the present invention is not limited to this, the present invention can also select other lengths according to actual algorithm requirements, for example, the agreed length of the SHA-1 algorithm is 20Byte); and the address space DDR-1 used to store input data occupies more space, and is connected to the address space DDR-2 used to store output data in the storage space. In order to ensure the correctness of the output result, the address space DDR-2 used to store output data must be reserved. Therefore, the size of data written into the FPGA storage module at a time is limited by the storage capacity of the FPGA storage module on the one hand, and the written data cannot occupy the reserved space where DDR-2 is located on the other hand. However, although limited by the limited storage capacity of the FPGA storage module, the speed at which the FPGA processes data can quickly refresh the written data to ensure the efficiency of transmission.

[0095] In the embodiments of the present invention, it should be understood that the disclosed methods and systems can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the modules or module divisions are only a logical function division. There may be other division methods in actual implementation, such as multiple modules or units can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coordination or communication connection shown or discussed can be an indirect connection through some interfaces, devices or units, which can be electrical or other forms.

[0096] Those skilled in the art will appreciate that, although some embodiments herein include certain features included in other embodiments but not other features, the combination of features of different embodiments is meant to be within the scope of the present invention and form different embodiments. For example, in the claims, any one of the claimed embodiments may be used in any combination.

[0097] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A data encryption transmission method, characterized in that: include: The key is divided into four segments of key data for determining fields; Dividing the data to be transmitted into a number of data frames based on the length of the data to be transmitted and the effective load of the transmission line; Encrypting each data frame using first key data of a certain field; Generate a transmission matrix according to the number of data frames and the second key data of the determined field to obtain the transmission order of each data frame, and transmit each encrypted data frame accordingly; wherein the field of the first key is the second segment key data of the key segmentation, and the field of the second key is the third segment key data of the key segmentation; The transfer matrix is ​​generated as follows: If the number of data frames N is less than or equal to the number of bits M of the second key data, the first N bits of the second key data are taken to generate a transmission matrix; If the number of data frames N is greater than M, then if N / the number of bits of the second key data=n and mod(N, M)=m, then initially, each M data frames are grouped into n groups, and each group generates a transmission matrix in the same way that N is equal to M, and finally the remaining m data frames generate a transmission matrix in the same way that N is less than M; The process of generating the transmission matrix is ​​as follows: If the data on the i-th bit is 0, it means that the i-th data frame is still the i-th transmitted; If an odd number of 1 data is found at the jth position, the next 1 data is searched. If no data is found, the order of the transmitted data remains unchanged. If the next data with a value of 1 is retrieved, that is, an even number of data with a value of 1 is at the gth position, the jth data frame is exchanged with the gth data frame for transmission; Based on this, an N-order transmission matrix is ​​constructed.

2. The data encryption transmission method according to claim 1, characterized in that: The transmission line is a PCIE bus, and its effective load is 4KB.

3. The data encryption transmission method according to claim 1, characterized in that: The receiving end uses the second key data to obtain the transmission order, and uses the first key data to decrypt each data frame.

4. A data verification method based on the data encryption transmission method according to any one of claims 1 to 3, characterized in that: include: Dividing the data to be transmitted into a number of data frames based on the length of the data to be transmitted and the effective load of the transmission line; Combining the key data of the determined field, the irreducible polynomial coefficients and the number of transmitted data frames to form header information; Encrypting each data frame using first key data of a certain field; Generate a transmission matrix according to the number of data frames and the second key data of the determined field to obtain the transmission order of each data frame, and transmit the header information and each encrypted data frame to the hash algorithm module accordingly; The hash algorithm module performs a hash operation on the input data according to the key data and irreducible polynomial coefficients in the header information to obtain a hash value; Subsequent input data uses the previously generated hash value as the key and combines it with the irreducible polynomial coefficients to perform a hash operation on the input data to obtain the corresponding hash value.

5. The data verification method according to claim 4, characterized in that: After the hash algorithm module performs hash operation to obtain the hash value, it uses the key data of the determined field to encrypt the obtained hash value and transmits it to the host computer. The host computer decrypts the input data according to the corresponding key data to obtain the corresponding hash value, which is the verification code.

6. The data verification method according to claim 5, characterized in that: Divide the key stored in the host computer into four sections of key data of certain fields; Among them, the header information is formed by combining the number of the data frames and the first segment of key data of the key split, and is transmitted together with each of the data frames; the field of the first key is the second segment of key data of the key split, the field of the second key is the third segment of key data of the key split, and the key data encrypted by the hash algorithm module for the hash value is the fourth segment of key data of the key split.

7. The data verification method according to claim 4, characterized in that: The hash operation is specifically: converting the irreducible polynomial parameters in the input data into a polynomial, combining it with the key data in the received header information to generate a Toeplitz matrix, and performing a matrix operation on the Toeplitz matrix and the input data to obtain a hash value.

8. A system for implementing the data verification method according to any one of claims 5 to 7, characterized in that: include: The host computer stores the key, the irreducible polynomial coefficients and the address pointer and data length corresponding to the two in advance; The driver module is arranged in the host computer, generates header information according to the key, irreducible polynomial coefficients and the address pointer and data length corresponding to the two, encrypts each data frame according to the key data, generates a transmission matrix in combination with the key data and the number of data frames, and transmits the header information and the encrypted data to be transmitted to the FPGA via the transmission line; At the same time, the key data is used to decrypt the data encrypted by the hash algorithm module and transmitted by the FPGA to obtain a verification code; FPGA, including storage module and hash algorithm module; The storage module is used to store the data transmitted by the driving module and the data after the hash operation by the hash algorithm module; The hash algorithm module is connected to the storage module, performs a hash operation on the data transmitted from the driving module to the storage module to obtain a check code, encrypts the check code with key data, and then transmits the check code to the driving module.

9. The system according to claim 8, characterized in that: The storage module includes an address space DDR-1 for storing input data and an address space DDR-2 for storing output data; The data transmitted by the driving module is stored in DDR-1, and the data after hash operation by the hash algorithm module is stored in DDR-2.

10. The system according to claim 8, characterized in that: The driver module obtains the data length of the data to be transmitted by the host computer before the transmission starts, and determines whether it exceeds the maximum capacity of the FPGA that can store input data; If it exceeds, an error is returned and no data transmission task is performed; if it is within the allowable range, header information is generated according to claim 5, and the data is divided into data frames corresponding to the effective load of the transmission line, and the data that is less than the effective load of the transmission line is supplemented by adding 0.

11. The system according to claim 8, characterized in that: The transmission line is a PCIE bus, the host computer is provided with a PCIE slot, and the FPGA is plugged into the PCIE slot to form a complete PCIE bus path.

Images