A reliable transmission method and system for application layer data processing

Abstract

The present invention provides a low-level reliable transmission method and system for application-layer data processing, belonging to the technical field of application-layer data reliable transmission technology. The reliable transmission method includes: establishing a connection between a security and confidentiality service module and a security and confidentiality device; establishing a TCP connection between application-layer software and the security and confidentiality service module; initializing and configuring a business processing FPGA for the security and confidentiality device; initializing a site protection table and a session block site table using the business processing FPGA; segmenting and numbering the application's business data; sending and processing the business data blocks; returning the calculated business data blocks to the application and sliding a data window. The present invention constructs a low-level reliable transmission method and system based on application-layer data processing between a computer terminal and the security and confidentiality service FPGA, using a logic FPGA to achieve high performance in business processing while simultaneously achieving low power consumption and miniaturization of the security and confidentiality device.

Description

Technical Field

[0001] The present invention belongs to the technical field of application layer data reliability transmission, and more specifically, relates to an underlying reliability transmission method and system for application layer data processing. Background Art

[0002] With the advancement of science and technology, security and confidentiality technologies are gaining increasing attention from businesses, serving to protect their core technologies and trade secrets. Currently, businesses primarily employ network security and confidentiality devices for network-layer encryption and application-layer data source confidentiality protection. These devices primarily employ call-based encryption, typically implementing encryption services using PCIE (Peripheral Component Interface Express) and USB (Universal Serial Bus) interfaces. Data transmission between PCIE- and USB-based security and confidentiality devices and computers utilizes the PCIE and USB bus interfaces, both of which offer reliable transmission. However, these interfaces are tightly coupled to the computer, requiring the deployment of driver software on the computer to provide the corresponding services. However, if the computer is damaged, the operating system crashes, the operating system is upgraded, or the hardware platform differs, requiring an operating system upgrade, or if there are differences between Windows and Linux operating systems, the driver software must be redeployed for the security and confidentiality devices to provide confidentiality services. Once these situations occur, adapting to different hardware platforms and operating systems requires significant human and material resources.

[0003] At present, in order to achieve loose coupling between computers and security and confidentiality devices, the main solution is to use a standard Ethernet interface to implement call-based encryption services. Since data transmission using an Ethernet interface is unreliable, in order to achieve reliable transmission, the TCP protocol (Transmission Control Protocol) is basically used between the security and confidentiality device and the computer, and a CPU (Central Processing Unit) dedicated to TCP protocol processing is deployed on the security and confidentiality device to achieve reliable transmission of business data. However, this brings certain disadvantages. First, in order to achieve high-performance services, a high-processing performance CPU needs to be deployed, which will greatly increase the power consumption of the device and make it impossible to achieve low-power miniaturization of the security and confidentiality device; second, after implementing low-power miniaturization, the encryption performance of the device will be relatively low, which cannot meet the needs of enterprises for processing large amounts of data. Summary of the Invention

[0004] In view of the defects of the prior art, the purpose of the present invention is to provide a bottom-layer reliable transmission method and system for application layer data processing, aiming to solve the problem that the existing security and confidentiality technology adopts the TCP protocol between the security and confidentiality device and the computer. Deploying a CPU specifically for TCP protocol processing on the security and confidentiality device will greatly increase the power consumption of the device, and it is impossible to achieve low-power miniaturization of the security and confidentiality device. If low-power miniaturization is achieved, the encryption performance of the device will be reduced, resulting in incompatibility between the low-power miniaturization and encryption performance of the security and confidentiality device.

[0005] To achieve the above objectives, the present invention provides, on the one hand, a method for transmitting data at the application layer in a reliable manner, comprising the following steps:

[0006] D1: After establishing a connection between the security and confidentiality service module and the security and confidentiality device, the security and confidentiality service module sends initialization data to the security and confidentiality device so that the number of the service data block in the security and confidentiality service module's sending window is consistent with the number of the service data block to be processed in the security and confidentiality device;

[0007] D2: Use one application to correspond to one fixed port, and establish a TCP connection between the application layer software and the security and confidentiality service module;

[0008] D3: Calculate the send window size in the security service module based on the number of TCP connections and the maximum processing capacity of the service processing FPGA (Field Programmable Gate Array) in the security device, and simultaneously set the receive window size in the service processing FPGA.

[0009] D4: Initialize the scene protection table and session block scene table based on the number of receiving windows in the service processing FPGA;

[0010] D5: Transmits the service data packet according to the set sending window. Uses the security and confidentiality service module to block the application's service data into several service data blocks. The blocks are numbered according to the connection sequence and quantity.

[0011] D6: Using a sliding data transmission window, the transmission window sequentially sends each business data block to the receiving window of the security device, and places the business data block into the corresponding site protection table and session block site table according to the block number, and then sends them to the algorithm core for calculation in sequence;

[0012] D7: Return the calculated business data blocks to the security and confidentiality service module; until all business data blocks are processed, the security and confidentiality service module integrates the business data blocks according to their numbers and returns them to the application.

[0013] Further preferably, the method for establishing a connection between the security and confidentiality service module and the security and confidentiality device is: after the security and confidentiality service module and the security and confidentiality device are connected using a fixed IP (Internet Protocol), the security and confidentiality service module sends an authentication data packet to the security and confidentiality device, and the security and confidentiality device sends a receipt confirmation data packet to the security and confidentiality service module.

[0014] Further preferably, D6 comprises the following steps:

[0015] Use a sliding send data window to send the business data blocks in the send data window through the send window, and the send window changes from N to N-1;

[0016] After the business processing FPGA of the security device receives the business data block, the receiving window becomes N-1, and the business data block is placed into the corresponding scene protection table and session block scene table according to the number, and then sent to the algorithm core for calculation in sequence;

[0017] The calculated business data block is returned to the security and confidentiality service module;

[0018] The receiving window is restored to N, and the receiving window value is returned through the block header, and the sending window is reset to N; where N is the number of the sending window before D6.

[0019] Further preferably, after the sending window sends the service data block, the security and confidentiality service module starts a timer. If the sent service data block is lost or the response is lost, the timer times out and the sending window is restored to N.

[0020] If M service data blocks are retransmitted, the sending window becomes NM. When the service processing FPGA receives the retransmitted data blocks, the receiving window is set to N-M+1.

[0021] According to the business data block number, the relevant business data block is found from the scene protection table and the session block scene table and sent to the algorithm core for calculation;

[0022] Return the completed business data block to the security and confidentiality service module;

[0023] The receiving window is restored to N, and the receiving window value is returned through the block header, and the sending window is reset to N.

[0024] On the other hand, the present invention provides an underlying reliability transmission system for application layer data processing, including a security and confidentiality service module and a security and confidentiality device;

[0025] The security and confidentiality service module is connected to the security and confidentiality device; an application layer software is provided with various application programs, each application program corresponds to a fixed port, and is used to establish a TCP connection between the application layer software and the security and confidentiality service module;

[0026] The security and confidentiality device is provided with a business processing FPGA, a storage space setting unit and a receiving window setting unit;

[0027] The security and confidentiality service module is provided with a sending window setting unit, a sending window, a program block unit, a sliding unit and a data block integration unit;

[0028] The storage space setting unit is used to initialize the scene protection table and the session block scene table in the service processing FPGA based on the number of receiving windows in the service processing FPGA; the scene protection table and the session block scene table are used to receive and cache service data blocks and sequentially send the service data to the algorithm core for calculation; the receiving window setting unit is used to synchronize the sending window setting unit with the setting of the receiving window in the service processing FPGA;

[0029] The sending window setting unit is used to send initialization data to the receiving window setting unit so that the number of the business data block in the sending window of the security and confidentiality service module is consistent with the number of the business data block to be processed in the security and confidentiality device; and is used to set the number of sending windows according to the number of TCP connections and the maximum processing capacity of the business processing FPGA; the program blocking unit is used to transmit the packet length of the business data packet according to the set sending window, use the security and confidentiality service module to block the business data of the application to generate a number of business data blocks, and number the business data blocks according to the connection sequence and quantity; the sliding unit is used to use a sliding sending data window to send each business data block into the sending window in sequence; the data block integration unit is used to integrate the business data blocks according to the numbers.

[0030] Further preferably, the method for establishing a connection between the security and confidentiality service module and the security and confidentiality device is:

[0031] After the security service module and the security device are connected using a fixed IP, the security service module sends an authentication data packet to the security device, and the security device sends a receipt confirmation data packet to the security service module.

[0032] Further preferably, the transmission processing method of the sending window and the receiving window for the service data block is:

[0033] Use a sliding send data window to send the business data blocks in the send data window, and the send window changes from N to N-1;

[0034] After the business processing FPGA of the security device receives the business data block, the receiving window changes from N to N-1, and the business data block is placed into the corresponding scene protection table and session block scene table according to the number, and then sent to the algorithm core for calculation in sequence;

[0035] The calculated business data block is returned to the security and confidentiality service module;

[0036] The receiving window is restored to N, and the receiving window value is returned through the block header, and the sending window is reset to N.

[0037] Further preferably, the security and confidentiality service module is also provided with a timer; when the sending window sends the business data block, the security and confidentiality service module starts the timer. If the sent business data block is lost or the response is lost, the timer times out and the sending window is restored to N.

[0038] Further preferably, if packet loss occurs in M service data blocks, the sending window and the receiving window are set as follows:

[0039] If M service data blocks are retransmitted, the sending window becomes NM. When the service processing FPGA receives the retransmitted data blocks, the receiving window is set to N-M+1.

[0040] According to the business data block number, the relevant business data block is found from the scene protection table and the session block scene table, and sent to the algorithm core for calculation;

[0041] Return the completed business data block to the security and confidentiality service module;

[0042] The receiving window is restored to N, and the receiving window value is returned through the block header, and the sending window is reset to N.

[0043] In general, the above technical solutions conceived by the present invention have the following beneficial effects compared with the prior art:

[0044] In the present invention, a fixed IP is used to establish a connection between the security and confidentiality service module and the security and confidentiality device. The security and confidentiality service module sends an authentication data packet to the security and confidentiality device, and the security and confidentiality device sends a reception confirmation data packet to the security and confidentiality service module. It can be seen that an Ethernet interface is used between the security and confidentiality device and the security and confidentiality service module (computer) in the present invention. Compared with USB interface and PCIE interface security and confidentiality devices, the present invention achieves loose coupling between the security and confidentiality device and the computer, avoids providing additional driver software, and does not require manpower and material resources to adapt the security and confidentiality service module to different hardware platforms and various operating systems.

[0045] The security and confidentiality device provided by the present invention is provided with a business processing FPGA, which is provided with a receiving window, a scene protection table and a session block scene table. At the same time, a sending window is provided in the security and confidentiality service module. The number of the receiving windows is the same as that of the sending windows. The sending window is used to send business data blocks, and the receiving window receives business data blocks and puts the business data blocks into the scene protection table and the session block scene table for processing. Compared with the terminal device based on CPU for business processing, the business data blocks are processed in the security and confidentiality device. The use of logic FPGA can achieve high performance of business processing while achieving low power consumption and miniaturization of the security and confidentiality device.

[0046] The FPGA for processing business logic of the security and confidentiality device in the present invention does not need to implement complex transmission protocols such as TCP, so that the FPGA can process larger data volume business with limited logic resources, greatly saving logic resources and reducing the hardware cost of the security and confidentiality device. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] Figure 1 Schematic diagram of a method for reliable transmission of application layer data dedicated processing at the underlying layer provided by an embodiment of the present invention;

[0048] FIG2( a ) is a schematic diagram of the authentication data packet frame format according to an embodiment of the present invention;

[0049] FIG2( b ) is a schematic diagram of a confirmation data packet frame format according to an embodiment of the present invention;

[0050] Figure 3 This is a schematic diagram of establishing a TCP connection between application layer software and a security and confidentiality service program provided by an embodiment of the present invention;

[0051] Figure 4 This is a schematic diagram of the internal field protection table and connection block field representation of the service processing FPGA provided by an embodiment of the present invention;

[0052] Figure 5 This is a schematic diagram of the security and confidentiality service program business blocks provided by an embodiment of the present invention;

[0053] Figure 6 Schematic diagram of data transmission between the security and confidentiality service program and the business processing FPGA provided by an embodiment of the present invention;

[0054] Figure 7 Schematic diagram of sending and receiving sliding windows provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0055] In order to make the purpose, technical solutions and advantages of the present invention more clearly understood, the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0056] like Figure 1 As shown, on the one hand, the present invention provides a method for reliable transmission of application layer data dedicated processing bottom layer, comprising the following steps:

[0057] S1: Establish a connection between the security and confidentiality service module and the security and confidentiality device;

[0058] A fixed IP address is used to establish a connection between the security and confidentiality service module and the security and confidentiality device. The security and confidentiality service module sends an authentication data packet to the security and confidentiality device. The authentication data packet consists of a command word, the sender's MAC (Media Access Control Address), padding bytes, and a CRC (Cyclic Redundancy Check) check field. Its frame format is shown in Figure 2(a). After receiving the authentication data packet, the security and confidentiality device returns an acknowledgment data packet to the security and confidentiality service module. The acknowledgment data packet consists of a command word, the sender's MAC, padding bytes, and a CRC check field. Its frame format is shown in Figure 2(b). After the connection is established, the security and confidentiality service module sends initialization data to the service processing FPGA of the security and confidentiality device, ensuring that the number of the service data block in the security and confidentiality service module's send window is consistent with the number of the service data block to be processed in the security and confidentiality device.

[0059] The security and confidentiality service module refers to a service program installed on a computer for dedicated business data processing. It is used to implement the subpackaging, numbering and reorganization of business data blocks and the establishment of reliable transmission channels. It provides a standard API interface library for different application programs to call, establishes reliable TCP connections with the application programs, and cooperates with security and confidentiality equipment to establish a set of reliable transmission channels specifically for business transmission.

[0060] S2: Establish a TCP connection between the application layer software and the security and confidentiality service program;

[0061] like Figure 3 As shown, the computer runs each application in the application layer software to process business and establishes a TCP connection with the security and confidentiality service module. Each application corresponds to a fixed port. The port number of the fixed port is dynamically established by the security and confidentiality service module. The fixed port is released after the application layer business processing is completed.

[0062] S3: Configure the security and confidentiality service module with a business processing FPGA for security and confidentiality equipment;

[0063] Based on the number of established TCP connections and the preset maximum processing capacity of the business processing FPGA in the security and confidentiality device, the number of send windows required by the security and confidentiality service module is calculated, and the number of receive windows set in the business processing FPGA is synchronized. The number of send windows is the same as the number of receive windows.

[0064] S4: Initialize the scene protection table and the session block scene table using the business processing FPGA. The scene protection table and the session block scene table are table-like storage spaces used for data caching and link building in the business processing FPGA.

[0065] The business processing FPGA initializes its internal scene protection table and session block scene table according to the number of windows issued by the security and confidentiality service module to ensure synchronization with the security and confidentiality service program to achieve maximum performance; the data format of the scene protection table and session block scene table is as follows Figure 4 As shown; the scene protection table is used to establish scene protection of multiple window connections with the security and confidentiality service module; the session block scene table is used to store the scene of all blocks in a connection sending window;

[0066] S5: Divide and number the application;

[0067] like Figure 5 As shown, after the initialization is completed, the security and confidentiality service module divides the business data of the application into blocks according to the packet length of the transmission business data packet set in the sending window. Each block has a unique block number and is numbered according to the order of connection and the number of blocks. For example, the m data block of the nth connection is numbered SnBm. After the numbering is completed, the numbered business data block is placed in the sending window for transmission;

[0068] S6: Sending and processing of business data blocks;

[0069] like Figure 6 As shown, the segmented business data block is placed in the sending window and then sent. After sending a business data block, the sending window becomes N-1. After the business processing FPGA of the security and confidentiality device receives the business data block, its receiving window becomes N-1, and the business data block is placed in the sending window. Figure 4 The scene protection table and the session block scene table shown in the figure enter the algorithm core for calculation processing. After the processing is completed, the business data block is returned, and the receiving window is restored to N. The receiving window value N is returned through the block header. The security and confidentiality service module on the computer receives the returned business data block and sets the sending window to N.

[0070] After the business data block is sent, the security and confidentiality service program will start a timer. If the packet is lost during transmission or response, the timer will time out and the sending window will be restored to N. If M business data blocks are retransmitted, the sending window will become NM. The business processing FPGA will receive the retransmitted business data block, set the receiving window to N-M+1, and find the related business data block from the site protection table and the session block site table according to the business data block number and put it into the algorithm core for calculation. After the calculation is completed, the business data block will be returned, and the receiving window will be restored to N at the same time. The receiving window value N will be returned through the block header. The security and confidentiality service module on the computer will receive the returned block and set the sending window to N. The business data block that has not received a response will time out and be retransmitted.

[0071] S7: Return the calculated business data block to the application and slide the data window;

[0072] After each business block data block operation is completed, the receiving window inside the business processing FPGA is as follows Figure 7 Slide forward as shown, and return the processed business data block to the security and confidentiality service module. After receiving the data, the security and confidentiality service module Figure 7 As shown in the forward sliding window, after all business data blocks are processed, the security and confidentiality service module integrates the business data blocks according to the block labels and returns them to the application to complete the business processing.

[0073] On the other hand, the present invention provides an underlying reliability transmission system for application layer data processing, comprising: a security and confidentiality service module and a security and confidentiality device;

[0074] The security and confidentiality service module is connected to the security and confidentiality device; an application layer software is provided with various application programs, each application program corresponds to a fixed port, and is used to establish a TCP connection between the application layer software and the security and confidentiality service module;

[0075] The security and confidentiality device is provided with a business processing FPGA, a storage space setting unit and a receiving window setting unit;

[0076] The security and confidentiality service module is provided with a sending window setting unit, a sending window, a program block unit, a sliding unit and a data block integration unit;

[0077] The storage space setting unit is used to initialize the scene protection table and the session block scene table in the business processing FPGA based on the number of receiving windows in the business processing FPGA; the scene protection table and the session block scene table are used to receive and perform arithmetic operations on the business data blocks; the receiving window setting unit is used to synchronize the sending window setting unit with the setting of the receiving window in the business processing FPGA;

[0078] The sending window setting unit is used to send initialization data to the receiving window setting unit so that the sending window and the receiving window number are consistent; and is used to set the sending window number according to the number of TCP connections and the maximum processing capacity of the business processing FPGA; the program blocking unit is used to transmit the data packet according to the set sending window, and use the security and confidentiality service module to block the business data of the application to generate a number of business data blocks, and number the business data blocks according to the connection sequence and quantity; the sliding unit is used to use the sliding sending data window to send each business data block to the sending window in sequence; the data block integration unit is used to integrate the business data blocks according to the numbers.

[0079] Further preferably, the transmission processing method of the sending window and the receiving window for the service data block is:

[0080] Use a sliding send data window to send the business data blocks in the send data window through the send window, and the send window changes from N to N-1;

[0081] After the business processing FPGA of the security and confidentiality device receives the business data block, the receiving window changes from N to N-1, and the business data block is placed in the scene protection table and the session block scene table for algorithm core operation;

[0082] The calculated business data block is returned to the security and confidentiality service module;

[0083] The receiving window is restored to N, and the receiving window value is returned through the block header, and the sending window is reset to N.

[0084] Further preferably, the security and confidentiality service module is also provided with a timer; when the sending window sends the business data block, the security and confidentiality service module starts the timer. If the sent business data block is lost or the response is lost, the timer times out and the sending window is restored to N.

[0085] Further preferably, if packet loss occurs in M service data blocks, the sending window and the receiving window are set as follows:

[0086] If M service data blocks are retransmitted, the sending window becomes NM. When the service processing FPGA receives the retransmitted data blocks, the receiving window is set to N-M+1.

[0087] According to the business data block number, the relevant business data block is found from the scene protection table and the session block scene table to perform algorithm core operation;

[0088] Return the completed business data block to the security and confidentiality service module;

[0089] The receiving window is restored to N, and the receiving window value is returned through the block header, and the sending window is reset to N.

[0090] Compared with the prior art, the present invention has the following advantages:

[0091] In the present invention, a fixed IP is used to establish a connection between the security and confidentiality service module and the security and confidentiality device. The security and confidentiality service module sends an authentication data packet to the security and confidentiality device, and the security and confidentiality device sends a reception confirmation data packet to the security and confidentiality service module. It can be seen that the Ethernet interface is used between the security and confidentiality device and the security and confidentiality service module (computer) in the present invention. Compared with USB interface and PCIE interface security and confidentiality devices, loose coupling between the security and confidentiality device and the computer is achieved, avoiding the provision of additional driver software, and eliminating the need to spend manpower and material resources to adapt the security and confidentiality service module to different hardware platforms and various operating systems.

[0092] The security and confidentiality device provided by the present invention is provided with a business processing FPGA, which is provided with a receiving window, a scene protection table and a session block scene table. At the same time, a sending window is provided in the security and confidentiality service module. The number of the receiving windows is the same as that of the sending windows. The sending window is used to send business data blocks, and the receiving window receives business data blocks and puts the business data blocks into the scene protection table and the session block scene table for processing. Compared with the terminal device based on CPU for business processing, the business data blocks are processed in the security and confidentiality device. The use of logic FPGA can achieve high performance of business processing while achieving low power consumption and miniaturization of the security and confidentiality device.

[0093] The FPGA for processing business logic of the security and confidentiality device in the present invention does not need to implement complex transmission protocols such as TCP, so that the FPGA can process larger businesses with limited logic resources, greatly saving logic resources and reducing the hardware cost of the security and confidentiality device.

[0094] It will be easily understood by those skilled in the art that the above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A bottom layer reliability transmission method for application layer data processing, characterized in that: The following steps are involved: D1: After establishing a connection between the security and confidentiality service module and the security and confidentiality device, the security and confidentiality service module sends initialization data to the security and confidentiality device so that the numbers of the service data blocks in the security and confidentiality service module's sending window are consistent with the numbers of the service data blocks to be processed in the security and confidentiality device; D2: Use one application to correspond to one fixed port, and establish a TCP connection between the application layer software and the security and confidentiality service module; D3: Calculate the number of sending windows in the security and confidentiality service module based on the number of TCP connections and the maximum processing capability of the service processing FPGA in the security and confidentiality device, and simultaneously set the receiving window in the service processing FPGA; D4: Initialize the scene protection table and session block scene table based on the number of receiving windows in the service processing FPGA; D5: Transmits the service data packet according to the set sending window. Uses the security and confidentiality service module to block the application's service data into several service data blocks. The blocks are numbered according to the connection sequence and quantity. D6: Using a sliding data transmission window, the transmission window sequentially sends each service data block to the receiving window of the security device, and places the service data block into the corresponding site protection table and session block site table according to the service data block number, and sequentially sends them to the algorithm core for calculation; D7: Return the calculated business data blocks to the security and confidentiality service module until all business data blocks are processed. The security and confidentiality service module integrates the business data blocks according to their numbers and returns them to the application.

2. The bottom layer reliability transmission method according to claim 1, characterized in that: The method for establishing a connection between the security and confidentiality service module and the security and confidentiality device is: After the security service module and the security device are connected using a fixed IP, the security service module sends an authentication data packet to the security device, and the security device sends a receipt confirmation data packet to the security service module.

3. The bottom layer reliability transmission method according to claim 2, characterized in that: D6 includes the following steps: Use a sliding send data window to send the business data blocks in the send data window through the send window, and the send window changes from N to N-1; After the business processing FPGA of the security device receives the business data block, the receiving window becomes N-1, and the business data block is placed into the corresponding scene protection table and session block scene table according to the number, and then sent to the algorithm core for calculation in sequence; The calculated business data block is returned to the security and confidentiality service module; The receiving window is restored to N, and the receiving window value is returned through the block header, and the sending window is reset to N; where N is the number of the sending window before D6.

4. The bottom layer reliability transmission method according to claim 3, characterized in that: After the sending window sends the service data block, the security and confidentiality service module starts the timer. If the sent service data block is lost or the response is lost, the timer times out and the sending window is restored to N. If M service data blocks are retransmitted, the sending window becomes NM. When the service processing FPGA receives the retransmitted data blocks, the receiving window is set to N-M+1. According to the business data block number, the relevant business data block is found from the scene protection table and the session block scene table, and sent to the algorithm core for calculation; Return the completed business data block to the security and confidentiality service module; The receiving window is restored to N, and the receiving window value is returned through the block header, and the sending window is reset to N.

5. An underlying reliability transmission system for application layer data processing, characterized in that: include: Security and confidentiality service modules and security and confidentiality equipment; The security and confidentiality service module is connected to the security and confidentiality equipment; An application layer software is provided with various application programs, each application program corresponds to a fixed port, and is used to establish a TCP connection between the application layer software and the security and confidentiality service module; The security and confidentiality device is provided with a business processing FPGA, a storage space setting unit and a receiving window setting unit; The security and confidentiality service module is provided with a sending window setting unit, a sending window, a program block unit, a sliding unit and a data block integration unit; The storage space setting unit is used to initialize the scene protection table and the session block scene table in the service processing FPGA based on the number of receiving windows in the service processing FPGA; the scene protection table and the session block scene table are used to receive and cache service data blocks and sequentially send the service data to the algorithm core for calculation; the receiving window setting unit is used to synchronize the sending window setting unit with the setting of the receiving window in the service processing FPGA; The sending window setting unit is used to send initialization data to the receiving window setting unit, so that the number of the business data block in the sending window of the security and confidentiality service module is consistent with the number of the business data block to be processed in the security and confidentiality device; and is used to set the number of sending windows according to the number of TCP connections and the maximum processing capacity of the business processing FPGA; the program blocking unit is used to transmit the packet length of the business data packet according to the set sending window, and use the security and confidentiality service module to block the business data of the application to generate a number of business data blocks, and number the business data blocks according to the connection order and quantity; the sliding unit is used to use a sliding sending data window to send each business data block into the sending window in sequence; the data block integration unit is used to integrate the business data blocks according to the numbers.

6. The bottom layer reliability transmission system according to claim 5, characterized in that: The method for establishing a connection between the security and confidentiality service module and the security and confidentiality device is: After the security service module and the security device are connected using a fixed IP, the security service module sends an authentication data packet to the security device, and the security device sends a receipt confirmation data packet to the security service module.

7. The bottom layer reliability transmission system according to claim 6, characterized in that: The transmission processing method of the sending window and the receiving window for the service data block is: Use a sliding send data window to send the business data blocks in the send data window, and the send window changes from N to N-1; After the business processing FPGA of the security device receives the business data block, the receiving window changes from N to N-1, and the business data block is placed into the corresponding scene protection table and session block scene table according to the number, and then sent to the algorithm core for calculation in sequence; The calculated business data block is returned to the security and confidentiality service module; The receiving window is restored to N, and the receiving window value is returned through the block header, and the sending window is reset to N.

8. The bottom layer reliability transmission system according to claim 7, characterized in that: The security and confidentiality service module is also provided with a timer; when the sending window sends a business data block, the security and confidentiality service module starts the timer. If the sent business data block is lost or the response is lost, the timer times out and the sending window is restored to N.

9. The bottom layer reliability transmission system according to claim 8, characterized in that: If M business data blocks are lost, the sending window and receiving window are set as follows: If M service data blocks are retransmitted, the sending window becomes NM. When the service processing FPGA receives the retransmitted data blocks, the receiving window is set to N-M+1. According to the business data block number, the relevant business data block is found from the scene protection table and the session block scene table, and sent to the algorithm core for calculation; Return the completed business data block to the security and confidentiality service module; The receiving window is restored to N, and the receiving window value is returned through the block header, and the sending window is reset to N.

Images