A USB packet data password communication method and system

Abstract

The present invention belongs to the technical field of cryptographic communication, and provides a USB packet data cryptographic communication method and system. The method includes a server service program of a host computer accepting socket data processing requests from various applications and centrally scheduling data to be processed; after the centralized scheduling is completed, the server service program uses a USB asynchronous communication mechanism to interact with a USB interface cryptographic device; the USB asynchronous communication mechanism centrally transmits all data to be processed to the USB buffer stack of the host computer hardware to wait for interaction with the USB interface cryptographic device. After processing the previous set of data, the USB interface cryptographic device does not need to wait, and can directly read the prepared data to be processed from the host computer hardware layer to perform the next operation. The cryptographic operation capability of the cryptographic chip is utilized to the maximum extent in the time dimension, and the cryptographic operation rate can be effectively improved in this way.

Description

Technical Field

[0001] The present invention belongs to the technical field of cryptographic communication, and in particular relates to a USB packet data cryptographic communication method and system. Background Art

[0002] The statements in this section merely provide background information related to the present invention and do not necessarily constitute prior art.

[0003] With the popularity of cryptographic application scenarios, one of the design goals of cryptographic devices is to provide cryptographic services and achieve higher operation rates. Currently, bulk endpoint transmission using the USB3.0 protocol (or higher USB rate standards) can achieve higher cryptographic operation rates. However, in this application scenario, the rate of cryptographic operations on large packets of data is much higher than the rate of cryptographic processing on small packets of data.

[0004] Cryptographic operations for small packet data are of practical significance. This scenario is irreplaceable, such as cryptographic operations for network data. The current Ethernet maximum transmission unit MTU is 1500 bytes. When network data is cryptographically processed, it belongs to the scenario of small packet cryptographic operations. The current USB interface cryptographic device cannot even meet the cryptographic operation requirements of 100M network (100Mbps) when applied to small packet scenarios. The current technical solution has low performance for small packets due to the waiting loss time during the USB protocol communication process. This waiting time is similar in large packet scenarios and small packet scenarios. In large packet scenarios, because the data transmission time and cryptographic operations take up more time, this waiting time accounts for a small proportion. Therefore, the effective utilization of time for cryptographic operations is higher, so the large packet cryptographic operation rate is very high.

[0005] However, the inventors found that the data transmission and cryptographic operation time is very short in the small packet scenario, and the waiting loss time of the USB protocol is similar to that of the large packet, resulting in a very low effective time for cryptographic operation, and the inability to fully utilize the cryptographic operation capabilities in the cryptographic chip, resulting in a very low cryptographic operation rate in the small packet case. Summary of the invention

[0006] In order to solve the technical problems existing in the above-mentioned background technology, the present invention provides a USB packet data cryptographic communication method and system, which maximizes the cryptographic operation capability of the cryptographic chip in the time dimension, and can effectively improve the cryptographic operation rate in this way.

[0007] In order to achieve the above object, the present invention adopts the following technical solution:

[0008] A first aspect of the present invention provides a USB packet data password communication method, comprising:

[0009] The server service program of the host computer accepts the socket data processing requests of various applications and centrally schedules the data to be processed;

[0010] After the centralized scheduling is completed, the Server service program interacts with the USB interface password device using the USB asynchronous communication mechanism;

[0011] The USB asynchronous communication mechanism centrally transmits all the data to be processed to the USB buffer stack of the host computer hardware to wait for the interaction with the USB interface password device.

[0012] As an implementation method, the USB packet data password communication method further includes: based on a customized USB device type and a customized data format mechanism of a USB interface password device, enabling a host computer application to implement a buffer overflow threshold test of a hardware stack in command interaction.

[0013] The above solution can avoid data overflow caused by untimely data processing at the hardware level and improve data communication efficiency.

[0014] As an implementation method, during the buffer overflow threshold test of the hardware stack, a test data command is issued before the test starts, and a threshold test is completed only after packet loss is found in the returned test data response.

[0015] As an implementation method, during the buffer overflow threshold test of the hardware stack, parameter calibration is completed through multiple rounds of testing and adding preset redundancy, and the calibrated test parameters are used as the anti-overflow threshold of the communication scheme.

[0016] As an implementation method, the USB asynchronous communication mechanism effectively divides the three phases of USB packet data transmission, namely, the token phase, the data transmission phase and the handshake phase, and moves the handshake phase backward.

[0017] This solution can effectively reduce the waiting time during USB protocol communication and improve the time utilization during small packet password calculation.

[0018] The second aspect of the present invention provides a USB packet data password communication system, which includes: a server service program module, an application program module and a USB interface password device; the server service program module and the application program module are both arranged in a host computer; the USB interface password device communicates with the host computer;

[0019] The Server service program module is used to accept the socket data processing requests of each application program module and centrally schedule the data to be processed; after the centralized scheduling is completed, the USB asynchronous communication mechanism is used to interact with the USB interface password device;

[0020] The USB asynchronous communication mechanism centrally transmits all the data to be processed to the USB buffer stack of the host computer hardware to wait for the interaction with the USB interface password device.

[0021] As an implementation mode, the USB packet data cryptographic communication system further includes:

[0022] The buffer overflow threshold test module is arranged in the USB interface password device, and based on the customized USB device type and customized data format mechanism of the USB interface password device, enables the host computer application to implement the buffer overflow threshold test of the hardware stack in the command interaction.

[0023] As an implementation mode, in the buffer overflow threshold test module, during the buffer overflow threshold test of the hardware stack, a test data command is issued before the test starts, and a threshold test is completed after packet loss is found in the returned test data response.

[0024] As an implementation mode, in the buffer overflow threshold test module, during the buffer overflow threshold test of the hardware stack, parameter calibration is completed through multiple rounds of testing and adding preset redundancy, and the calibrated test parameters are used as the communication scheme anti-overflow threshold.

[0025] As an implementation method, the USB asynchronous communication mechanism effectively divides the three phases of USB packet data transmission, namely, the token phase, the data transmission phase and the handshake phase, and moves the handshake phase backward.

[0026] Compared with the prior art, the present invention has the following beneficial effects:

[0027] (1) The Server service program of the present invention uses the USB asynchronous communication mechanism to interact with the USB interface cryptographic device, and utilizes the USB asynchronous communication mechanism to centrally transmit all the data to be processed to the USB buffer stack of the host computer hardware to wait for the interaction with the USB interface cryptographic device. This can effectively solve the time loss problem of the USB protocol during the transmission of USB protocol packets, and maximize the cryptographic computing capability in the cryptographic chip in the time dimension, so that the cryptographic computing rate in the USB packet data scenario can support the network data encryption and decryption requests of the Gigabit network.

[0028] (2) The server service program of the upper computer uses the solution of accepting socket data processing requests from various applications and centrally scheduling the data to be processed to solve the problem of multi-process and multi-threaded calls to cryptographic devices. Multiple calling applications are equivalent to multiple sockets. It only needs to define the corresponding data format specifications in the interactive data to solve the effective separation of multiple socket data. All cryptographic service requests are ultimately managed by the server service. This method solves the problem of increasing the rate of small packets and also solves the problem of multi-process applications competing for cryptographic devices.

[0029] Advantages of additional aspects of the present invention will be given in part in the following description, and in part will become obvious from the following description, or will be learned through practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] The accompanying drawings in the specification, which constitute a part of the present invention, are used to provide a further understanding of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute improper limitations on the present invention.

[0031] Figure 1 It is the application level diagram of USB interface password device;

[0032] Figure 2 It is a traditional USB interface password device application solution;

[0033] Figure 3 This is a schematic diagram of the cryptographic operation queue inside the cryptographic chip;

[0034] Figure 4 This is the time-consuming diagram of the password calculation of the small packet of the USB interface password device;

[0035] Figure 5 This is a USB packet data password communication principle diagram of an embodiment of the present invention;

[0036] Figure 6 Schematic diagram of the rate of USB packet data cryptographic communication using an embodiment of the present invention;

[0037] Figure 7 This is a diagram showing the effect of USB packet data password communication according to an embodiment of the present invention. DETAILED DESCRIPTION

[0038] The present invention will be further described below in conjunction with the accompanying drawings and embodiments.

[0039] It should be noted that the following detailed descriptions are all illustrative and intended to provide further explanation of the present invention. Unless otherwise specified, all technical and scientific terms used herein have the same meanings as those commonly understood by those skilled in the art to which the present invention belongs.

[0040] It should be noted that the terms used herein are only for describing specific embodiments and are not intended to limit exemplary embodiments according to the present invention. As used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form. In addition, it should be understood that when the terms "comprising" and / or "including" are used in this specification, it indicates the presence of features, steps, operations, devices, components and / or combinations thereof.

[0041] Embodiment 1

[0042] This embodiment provides a USB packet data password communication method, which is based on the application of USB interface password equipment. Existing USB interface password equipment is mostly USB device equipment, which is connected to the USB Host port of the host computer and provides password operation services to the host computer. The application level of USB interface password equipment is as follows: Figure 1 .

[0043] The application of the host computer calls the dll or so format driver of the USB cryptographic device, and uses the interface API implemented in the driver to call the cryptographic operation function. The data to be processed in the application is sent to the USB hardware for processing through the cryptographic interface API. Because cryptographic operations generally require corresponding input (plain text) and output (ciphertext), the communication process is always carried out in pairs. When applied to USB data communication, a group of OUT data (sent data to be processed) and a group of IN data (returned processed data) appear in pairs. This communication process can complete a cryptographic processing interaction.

[0044] The application scheme of USB interface password device providing password operation function to the host computer is as follows: Figure 2 As shown:

[0045] The USB interface cryptographic device is implemented as a cryptographic chip with a USB interface. The USB endpoints in the USB interface include control endpoints, interrupt endpoints, bulk endpoints, and isochronous endpoints. Because bit errors are not allowed during the data transmission process of cryptographic operations, the bulk endpoint is a high-speed communication endpoint that meets the requirements of cryptographic operations (a certain bit error rate will occur in synchronous transmission, and the control and interrupt transmission efficiency is low). Therefore, in order to obtain a higher cryptographic operation rate, the USB interface cryptographic device will use the bulk endpoint method. Figure 3As shown, the cryptographic operation engine inside the cryptographic chip provides a blocking service type of cryptographic operation, that is, after one group of data is processed, the next group of data can be processed, and the data groups to be processed can only be processed in the order of arrangement. At the same time, the cryptographic engine inside the cryptographic chip currently has a high-speed stream processing mode, and its processing speed (such as SM4 grouping algorithm) is higher than 5Gbps. This rate is higher than the theoretical transmission rate of USB3.0 5Gbps. It can be seen that the queue-based cryptographic processing in the cryptographic chip is no longer a bottleneck for improving the operation rate of cryptographic devices.

[0046] It is obvious that the operation rate of the cryptographic service implemented by hardware in the application is directly related to the communication rate of the USB cryptographic device. The faster the data is transmitted from the application to the cryptographic engine, the higher the cryptographic operation rate can be obtained. For example, the cryptographic operation rate provided by the cryptographic device supporting the USB3.0 protocol is significantly higher than that of the cryptographic device supporting only the USB2.0 protocol, or the transmission rate using the high-speed Bulk endpoint in the USB protocol is significantly higher than the transmission rate using the low-speed Control endpoint. Therefore, the bottleneck of improving the cryptographic operation rate of the USB cryptographic device lies in how to provide the actual communication rate of the USB interface cryptographic device.

[0047] The reason for the above bottleneck is the USB communication protocol. The data volume of each packet of the bulk endpoint of USB3.0 is 1KByte. Bulk transmission is divided into three stages: token stage, data transmission stage, and handshake stage. Here, large packets are defined as 64KByte data packets, 32K Byte data packets, 16K Byte data packets, etc., which need to be divided into multiple packets for transmission by the bulk endpoint. Small packets are defined as 1KByte or 2K Byte data. Assuming that the large packet is 64K Byte, a token stage, a 64KByte data transmission stage, and a handshake stage are required to complete a transmission. If a 1K small packet is used to complete a 64KByte transmission, 64 complete token, transmission, and handshake processes are required. Therefore, the application rate of small packets will be lower than that of large packets.

[0048] The USB interface cryptographic device has a maximum difference of about 10 times in the performance of large and small packets due to the loss of USB protocol in the transmission of small packets. That is, if a group of 64M data is processed for cryptographic operation, if it is transmitted as a 64K packet, it needs to call the cryptographic API interface 1024 times for operation (0.36 seconds to complete); if it is transmitted as a 1K packet, it needs to execute 64*1024 cryptographic API interfaces for operation (3.7 seconds to complete). In this scenario, the maximum difference in time consumption is 10 times.

[0049] The time consumption ratio of small packet cryptographic operations under the current technical solution is shown in the figure below. Figure 4 As shown. Figure 4 It can be concluded that in the small packet cryptographic operation scenario, the cryptographic chip is only in working state for a short period of time, and most of the time is idle, which is the loss time of the USB protocol. The current technical solution has low performance of small packets due to the waiting loss time during the USB protocol communication process. This waiting time is similar in large and small packet scenarios. In large packet scenarios, because the data transmission time and cryptographic operation take up more time, this waiting time accounts for a small proportion, so the effective utilization rate of time for cryptographic operation is higher, so the large packet cryptographic operation rate is very high. However, the data transmission and cryptographic operation time in the small packet scenario is very short, but the waiting loss time of the USB protocol is similar to that of the large packet, resulting in a very low effective time for cryptographic operation, and the cryptographic operation capability in the cryptographic chip cannot be fully utilized, resulting in a very low cryptographic operation rate in the small packet case.

[0050] The USB packet data password communication method proposed in this embodiment no longer directly operates the hardware by calling the driver interface library of the USB password device, but adopts Socket, Server service and USB asynchronous communication mechanism to solve the problem of excessive packet interaction loss of the USB protocol.

[0051] Reference Figure 5 , this embodiment provides a USB packet data password communication method, which includes:

[0052] Step 1: The server service program of the host computer accepts the socket data processing requests of various applications and centrally schedules the data to be processed;

[0053] Step 2: After the centralized scheduling is completed, the Server service program interacts with the USB interface password device using the USB asynchronous communication mechanism.

[0054] The USB asynchronous communication mechanism centrally transmits all the data to be processed to the USB buffer stack of the host computer hardware to wait for the interaction with the USB interface password device.

[0055] In the original solution, the application establishes a communication relationship with the USB interface password device by calling the driver interface library of the USB password device, resulting in the accumulation of application processing data in the application stage, and the USB password device spends time waiting for interactive commands from the password operation OUT end.

[0056] In this solution, the application program adopts the Socket mode, and no longer interacts directly with the USB interface password device, but interacts with the Server service program. The Server service of this embodiment accepts the Socket data processing request, and centrally schedules the pending data for the USB password device, and uses the USB asynchronous communication mechanism to interact with the USB password device. Among them, the asynchronous mechanism effectively divides the three stages of Bulk transmission, the token stage, the data transmission stage, and the handshake stage, and moves the handshake stage back. In this way, all pending data can be released to the host computer hardware level, and the data will be concentrated into the USB buffer stack of the host computer hardware to wait for interaction with the USB interface password device.

[0057] After processing the previous set of data, the USB interface password device does not need to wait, and can directly read the prepared data to be processed from the host computer hardware layer for the next operation. In the time dimension, the password operation capability of the password chip is utilized to the greatest extent, and this method can effectively improve the password operation rate.

[0058] In the above process communication scheme, the data processing in the application stage (Server service program) has a relatively high processing rate. Data can be continuously thrown to the USB buffer stack of the host computer through the token stage and data transmission stage of the application. At this time, the data interaction rate between the USB interface device and the USB buffer stack of the host computer is actually a relatively low rate. Therefore, if the application continuously performs operations in the token stage and data transmission stage, the data processing at the hardware level will not be timely, resulting in data overflow. See the data rate diagram Figure 6 .

[0059] In order to solve the above problem that if the application continuously performs the token phase and the data transmission phase operations, the data processing at the hardware level will not be timely, resulting in data overflow, in one or more embodiments, the USB packet data password communication method also includes:

[0060] Based on the customized USB device type and customized data format mechanism of the USB interface password device, the host computer application can implement the buffer overflow threshold test of the hardware stack in the command interaction. This solution can avoid data overflow caused by untimely data processing at the hardware level and improve data communication efficiency.

[0061] In the process of buffer overflow threshold test of the hardware stack, a test data command is issued before the test starts, and a threshold test is completed after it is found that packet loss occurs in the returned test data response.

[0062] During the buffer overflow threshold test of the hardware stack, parameter calibration is completed through multiple rounds of testing and adding preset redundancy. The calibrated test parameters are used as the anti-overflow threshold of the communication solution.

[0063] The communication effect achieved by the USB packet data password communication scheme of this embodiment is as follows: Figure 7 This solution effectively reduces the waiting time during USB protocol communication and improves the time utilization during small packet password calculation.

[0064] Embodiment 2

[0065] like Figure 5 As shown, this embodiment provides a USB packet data password communication system, which includes a Server service program module, an application program module and a USB interface password device; the Server service program module and the application program module are both set in the host computer; the USB interface password device communicates with the host computer;

[0066] The Server service program module is used to accept the socket data processing requests of each application program module and centrally schedule the data to be processed; after the centralized scheduling is completed, the USB asynchronous communication mechanism is used to interact with the USB interface password device;

[0067] The USB asynchronous communication mechanism centrally transmits all the data to be processed to the USB buffer stack of the host computer hardware to wait for the interaction with the USB interface password device.

[0068] The USB asynchronous communication mechanism effectively divides the three phases of USB packet data transmission, namely, the token phase, the data transmission phase and the handshake phase, and moves the handshake phase backward.

[0069] In one or more embodiments, the USB packet data password communication system further includes:

[0070] The buffer overflow threshold test module is arranged in the USB interface password device, and based on the customized USB device type and customized data format mechanism of the USB interface password device, enables the host computer application to implement the buffer overflow threshold test of the hardware stack in the command interaction.

[0071] Specifically, in the buffer overflow threshold test module, during the buffer overflow threshold test of the hardware stack, a test data command is issued before the test starts, and a threshold test is completed only after packet loss is found in the returned test data response.

[0072] In the buffer overflow threshold test module, during the buffer overflow threshold test of the hardware stack, parameter calibration is completed through multiple rounds of testing and adding preset redundancy, and the calibrated test parameters are used as the communication scheme anti-overflow threshold.

[0073] The Server service program module of this embodiment uses the USB asynchronous communication mechanism to interact with the USB interface cryptographic device, and utilizes the USB asynchronous communication mechanism to centrally transmit all the data to be processed to the USB buffer stack of the host computer hardware to wait for interaction with the USB interface cryptographic device. This can effectively solve the time loss problem of the USB protocol during the transmission of USB protocol packets, and maximize the cryptographic computing capabilities in the cryptographic chip in the time dimension, so that the cryptographic computing rate in the USB packet data scenario can support the network data encryption and decryption requests of the Gigabit network.

[0074] The Server service program module of the upper computer in this embodiment uses the solution of accepting Socket data processing requests from various application modules and centrally scheduling the data to be processed to solve the problem of multi-process and multi-threaded calls to cryptographic devices. Multiple calling applications are equivalent to multiple Sockets. It is only necessary to define the corresponding data format specifications in the interactive data to effectively separate multiple Socket data. All cryptographic service requests are ultimately managed uniformly by the Server service. This method solves the problem of increasing the rate of small packets and also solves the problem of multi-process applications competing for cryptographic devices.

[0075] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A USB packet data password communication method, characterized in that: include: The server service program of the host computer accepts the socket data processing requests of various applications and centrally schedules the data to be processed; After the centralized scheduling is completed, the Server service program interacts with the USB interface password device using the USB asynchronous communication mechanism; The USB asynchronous communication mechanism centrally transmits all the data to be processed to the USB buffer stack of the host computer hardware to wait for interaction with the USB interface password device; The Server service accepts Socket data processing requests, and centrally schedules the data to be processed for the USB cryptographic device, and uses the USB asynchronous communication mechanism to interact with the USB cryptographic device; wherein, the asynchronous communication mechanism effectively divides the three stages of Bulk transmission, the token stage, the data transmission stage, and the handshake stage, and moves the handshake stage backward; in this way, all the data to be processed are released to the upper computer hardware level, and the data will be concentrated into the USB buffer stack of the upper computer hardware to wait for interaction with the USB interface cryptographic device.

2. The USB packet data password communication method according to claim 1, characterized in that: The USB packet data password communication method also includes: based on the customized USB device type and customized data format mechanism of the USB interface password device, the host computer application program implements the buffer overflow threshold test of the hardware stack in the command interaction.

3. The USB packet data password communication method as claimed in claim 2, characterized in that: During the buffer overflow threshold test of the hardware stack, a test data command is issued before the test starts, and a threshold test is completed after it is found that packet loss occurs in the returned test data response.

4. The USB packet data password communication method according to claim 2, characterized in that: During the buffer overflow threshold test of the hardware stack, parameter calibration is completed through multiple rounds of testing and adding preset redundancy. The calibrated test parameters are used as the anti-overflow threshold of the communication solution.

5. A USB packet data password communication system, characterized in that: include: Server service program module, application program module and USB interface password device; the Server service program module and application program module are both arranged in the host computer; the USB interface password device communicates with the host computer; The Server service program module is used to accept the Socket data processing requests of various application modules and centrally schedule the data to be processed; After the centralized scheduling is completed, the USB asynchronous communication mechanism is used to interact with the USB interface password device; The USB asynchronous communication mechanism centrally transmits all the data to be processed to the USB buffer stack of the host computer hardware to wait for interaction with the USB interface cryptographic device; The Server service accepts Socket data processing requests, and centrally schedules the data to be processed for the USB cryptographic device, and uses the USB asynchronous communication mechanism to interact with the USB cryptographic device; wherein, the asynchronous communication mechanism effectively divides the three stages of Bulk transmission, the token stage, the data transmission stage, and the handshake stage, and moves the handshake stage backward; in this way, all the data to be processed are released to the upper computer hardware level, and the data will be concentrated into the USB buffer stack of the upper computer hardware to wait for interaction with the USB interface cryptographic device.

6. The USB packet data cryptographic communication system as claimed in claim 5, characterized in that: The USB packet data password communication system further includes: The buffer overflow threshold test module is arranged in the USB interface password device, and based on the customized USB device type and customized data format mechanism of the USB interface password device, enables the host computer application to implement the buffer overflow threshold test of the hardware stack in the command interaction.

7. The USB packet data cryptographic communication system as claimed in claim 6, characterized in that: In the buffer overflow threshold test module, during the buffer overflow threshold test of the hardware stack, a test data command is issued before the test starts, and a threshold test is completed only after packet loss is found in the returned test data response.

8. The USB packet data cryptographic communication system as claimed in claim 6, characterized in that: In the buffer overflow threshold test module, during the buffer overflow threshold test of the hardware stack, parameter calibration is completed through multiple rounds of testing and adding preset redundancy, and the calibrated test parameters are used as the communication scheme anti-overflow threshold.

Images