A server, a digital chip and a symmetric encryption and decryption device thereof

Abstract

The present invention discloses a server, a digital chip and a symmetric encryption and decryption device thereof, which belong to the field of hardware encryption and decryption and are used for hardware encryption and decryption of data to be processed. Considering that the data frame used to transmit the data to be processed can also realize the transmission of other data by customizing the communication protocol, the present application can carry encryption and decryption configuration data in the data frame used to transmit the data to be processed by customizing the communication protocol, and the data frame processing unit can directly extract the encryption and decryption configuration data from the data frame to be processed, so that the algorithm core module can perform encryption and decryption processing on the received data to be processed based on the symmetric cryptographic algorithm and the encryption and decryption configuration data, which improves the transmission speed of the encryption and decryption configuration data compared to the transmission mode of the CPU bus, thereby improving the data processing speed, and cuts off the communication between the CPU and the symmetric encryption and decryption device, thereby improving security.

Description

Technical Field

[0001] The present invention relates to the field of hardware encryption and decryption, and in particular to a symmetric encryption and decryption device. The present invention also relates to a server and a digital chip thereof. Background Art

[0002] There are two ways to encrypt information data: software encryption and hardware encryption. However, with the rapid development of microelectronics technology, the transmission of network information has also developed from Gigabit Ethernet to multi-gigabit fiber optic networks. The information transmission rate is getting faster and faster. Software encryption is far from meeting the speed requirements of large-scale information transmission. Hardware encryption has become the mainstream trend of encryption at this stage.

[0003] Modern cryptography mainly includes asymmetric cryptographic algorithms and symmetric cryptographic algorithms. In the prior art, in hardware encryption and decryption devices based on symmetric cryptographic algorithms, the data to be encrypted and decrypted can be directly sent by the data source. However, some configuration data used to constrain the encryption and decryption process needs to be implemented by the CPU modifying the registers in the hardware encryption and decryption device. However, the data transmission rate of the CPU is low, which directly affects the data processing speed, and the involvement of the CPU in the hardware encryption and decryption device will also reduce security.

[0004] Therefore, how to provide a solution to the above technical problems is a problem that those skilled in the art need to solve at present. Summary of the invention

[0005] The object of the present invention is to provide a symmetric encryption and decryption device, which improves the transmission speed of encryption and decryption configuration data compared to the transmission method of the CPU bus, thereby improving the data processing speed, and cuts off the communication between the CPU and the symmetric encryption and decryption device, thereby improving security; another object of the present invention is to provide a server and a digital chip thereof including the above-mentioned symmetric encryption and decryption device, which improves the transmission speed of encryption and decryption configuration data compared to the transmission method of the CPU bus, thereby improving the data processing speed, and cuts off the communication between the CPU and the symmetric encryption and decryption device, thereby improving security.

[0006] In order to solve the above technical problems, the present invention provides a symmetric encryption and decryption device, comprising:

[0007] A data frame processing unit, used to send the data to be processed and the encryption and decryption configuration data parsed from the received data frame to be processed to the algorithm core module, and read the encrypted and decrypted data from the algorithm core module and output it;

[0008] The algorithm core module is used to perform encryption and decryption processing on the received data to be processed based on the symmetric cryptographic algorithm and the encryption and decryption configuration data;

[0009] The encryption and decryption configuration data includes the speed mode, the key and the initial vector.

[0010] Preferably, there are multiple algorithm core modules;

[0011] The symmetric encryption and decryption device also includes:

[0012] A control module, configured to determine an idle algorithm core module as the target algorithm core module according to the speed mode in the encryption and decryption configuration data and the order of the remaining cache space of each algorithm core module;

[0013] The data frame processing unit is specifically used for:

[0014] The data to be processed and the encryption and decryption configuration data parsed from the received data frame to be processed are sent to the target algorithm core module, and the encrypted and decrypted data are read and output from each algorithm core module in the order in which the data to be processed are sent.

[0015] Preferably, the data frame processing unit is further used for:

[0016] Extracting the algorithm mode from the received data frame to be processed, and indicating the algorithm mode error to the sender of the data frame to be processed after receiving the control module indicating the algorithm mode error;

[0017] The control module is also used to indicate an algorithm mode error to the data frame processing unit when the algorithm mode does not belong to the algorithm mode supported by the symmetric encryption algorithm.

[0018] Preferably, the data frame processing unit is further used for:

[0019] Determine whether the received data frame to be processed needs to be pre-calculated according to the data frame header; if pre-calculation is required, send the key in the data frame to be processed to the target algorithm core module when receiving the target algorithm core module, so that the target algorithm core module pre-calculates the key;

[0020] Determine whether the received data frame to be processed is a pre-calculated data frame. If it is a pre-calculated data frame, send the data to be processed of the current data frame to be processed to its corresponding target algorithm core module, so that the target algorithm core module performs encryption and decryption operations on the data to be processed according to the pre-calculated key;

[0021] The control module is also used to, when the data frame to be processed needs to be pre-calculated, if there is an algorithm core module dedicated to pre-calculation, use the algorithm core module dedicated to pre-calculation as the target algorithm core module; if there is no algorithm core module dedicated to pre-calculation, determine an algorithm core module in an idle state as the target algorithm core module based on the speed mode in the encryption and decryption configuration data and the order of the remaining cache space of each algorithm core module.

[0022] Preferably, the control module comprises:

[0023] A state machine module, used to send the remaining cache space of each algorithm core module to the credit update module, and determine an algorithm core module in an idle state as the target algorithm core module according to the speed mode in the encryption and decryption configuration data and the credit value of each algorithm core module;

[0024] The credit updating module is used to determine the corresponding credit value according to the remaining cache space of each algorithm core module in accordance with the proportional relationship between the remaining cache space and the credit.

[0025] Preferably, determining an algorithm core module in an idle state as the target algorithm core module according to the speed mode in the encryption and decryption configuration data and the credit value of each algorithm core module is specifically:

[0026] If the speed mode in the encryption / decryption configuration data is a low-speed mode, determine whether there is an algorithm core module dedicated to the low-speed mode, if so, use the algorithm core module dedicated to the low-speed mode as the target algorithm core module, if not, select the one with the highest credit value among the idle algorithm core modules as the target algorithm core module;

[0027] If the speed mode in the encryption / decryption configuration data is the high-speed mode, one of the idle algorithm core modules with the highest credit value is selected as the target algorithm core module.

[0028] Preferably, the state machine module is also used for:

[0029] Send the latest identifier of the algorithm core module written into the data to be processed as a write identifier to the queue cache control module, send the latest identifier of the algorithm core module read out of the data as a read identifier to the queue cache control module, and send the identifier at the front end of the data processing queue to the data frame processing unit, so that it can read the encrypted and decrypted data from the algorithm core module corresponding to the identifier at the front end of the data processing queue and output it;

[0030] The control module also includes:

[0031] The queue cache control module is used to add the write identifier to the end of the data processing queue, and delete the first bit of the identifier of the data processing queue when receiving the read identifier.

[0032] Preferably, the data frame processing unit includes:

[0033] The data frame processing subunit is used to extract encryption and decryption configuration data from the data frame to be processed received through the synchronous static random access memory SSRAM input interface, send the data to be processed of the data frame to be processed to the target algorithm core module, and read the encrypted and decrypted data from each algorithm core module in the order of sending the data to be processed and output it through the SSRAM output interface;

[0034] The SSRAM input interface;

[0035] The SSRAM output interface.

[0036] In order to solve the above technical problem, the present invention also provides a digital chip, including the symmetric encryption and decryption device as described above.

[0037] In order to solve the above technical problem, the present invention further provides a server, comprising the digital chip as described above and a server body connected to the digital chip.

[0038] The present invention provides a symmetric encryption and decryption device. Considering that the data frame used to transmit the data to be processed can also realize the transmission of other data by customizing the communication protocol, the present application can carry encryption and decryption configuration data in the data frame used to transmit the data to be processed by customizing the communication protocol. The data frame processing unit can directly extract the encryption and decryption configuration data from the data frame to be processed, so that the algorithm core module can perform encryption and decryption processing on the received data to be processed based on the symmetric cryptographic algorithm and the encryption and decryption configuration data. Compared with the transmission method of the CPU bus, the transmission speed of the encryption and decryption configuration data is improved, thereby improving the data processing speed, and the communication between the CPU and the symmetric encryption and decryption device is cut off, thereby improving security.

[0039] The present invention also provides a server and a digital chip thereof, which have the same beneficial effects as the above symmetric encryption and decryption device. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the prior art and the drawings required for use in the embodiments are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0041] Figure 1 A schematic diagram of the structure of a symmetric encryption and decryption device provided by the present invention;

[0042] Figure 2 A schematic diagram of the structure of another symmetric encryption and decryption device provided by the present invention;

[0043] Figure 3 A schematic diagram of the structure of an algorithm-controlled main state machine provided by the present invention;

[0044] Figure 4 A schematic diagram of the structure of a pre-calculation state machine provided by the present invention. DETAILED DESCRIPTION

[0045] The core of the present invention is to provide a symmetric encryption and decryption device, which improves the transmission speed of encryption and decryption configuration data compared to the transmission method of the CPU bus, thereby improving the data processing speed, and cuts off the communication between the CPU and the symmetric encryption and decryption device, thereby improving security; another core of the present invention is to provide a server including the above-mentioned symmetric encryption and decryption device and its digital chip, which improves the transmission speed of encryption and decryption configuration data compared to the transmission method of the CPU bus, thereby improving the data processing speed, and cuts off the communication between the CPU and the symmetric encryption and decryption device, thereby improving security.

[0046] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0047] Please refer to Figure 1 , Figure 1 A schematic diagram of the structure of a symmetric encryption and decryption device provided by the present invention, the symmetric encryption and decryption device comprises:

[0048] The data frame processing unit 1 is used to send the data to be processed and the encryption and decryption configuration data parsed from the received data frame to the algorithm core module 2, and read the encrypted and decrypted data from the algorithm core module 2 and output it;

[0049] Algorithm core module 2, used for encrypting and decrypting the received data to be processed based on the symmetric cryptographic algorithm and encryption and decryption configuration data;

[0050] The encryption and decryption configuration data includes speed mode, key and initial vector.

[0051] Specifically, taking into account the technical problems in the above background technology, in order to improve the transmission efficiency of the encryption and decryption configuration data and cut off the data communication between the CPU and the hardware encryption and decryption device, the sending method of the encryption and decryption configuration data of the "configuration register" can be changed to other transmission methods. Considering that the data frame used to transmit the data to be processed can also realize the transmission of other data by customizing the communication protocol, the present application envisions that by customizing the communication protocol, the encryption and decryption configuration data can be carried in the data frame used to transmit the data to be processed. In this way, the transmission speed of the encryption and decryption configuration data can be guaranteed to be consistent with the transmission speed of the data frame to be processed, and there is no need for the CPU to communicate with the hardware encryption and decryption device, which improves both the data processing efficiency and the security of the hardware encryption and decryption device.

[0052] Among them, the data communication protocol can be customized in advance, so when the data source sends the data to be processed, it can encapsulate the data to be processed and the encryption and decryption configuration data in the same frame of data for transmission, and the data frame processing unit 1 can extract the encryption and decryption configuration data from the received data frame to be processed, and send the data to be processed and the encryption and decryption configuration data of the data frame to be processed to the algorithm core module 2, and read the encrypted and decrypted data from the algorithm core module 2 and output it. The algorithm core module 2 is only responsible for encrypting and decrypting the received data to be processed based on the symmetric encryption algorithm and the encryption and decryption configuration data.

[0053] Specifically, the speed mode, key and initial vector are encryption and decryption configuration data in the symmetric cryptographic algorithm, wherein the speed mode may include a high-speed mode and a low-speed mode.

[0054] Specifically, it is worth mentioning that the symmetric encryption and decryption device in the embodiment of the present invention can be implemented by various types of hardware circuits, such as by FPGA (Field Programmable Gate Array) or ASIC (Application Specific Integrated Circuit), etc., and the embodiment of the present invention is not limited here.

[0055] Among them, the symmetric encryption algorithm can be of various types, for example, it can be the national secret SM4 block encryption algorithm, etc., and the embodiment of the present invention is not limited here.

[0056] The present invention provides a symmetric encryption and decryption device. Considering that the data frame used to transmit the data to be processed can also realize the transmission of other data by customizing the communication protocol, the present application can carry encryption and decryption configuration data in the data frame used to transmit the data to be processed by customizing the communication protocol. The data frame processing unit can directly extract the encryption and decryption configuration data from the data frame to be processed, so that the algorithm core module can perform encryption and decryption processing on the received data to be processed based on the symmetric cryptographic algorithm and the encryption and decryption configuration data. Compared with the transmission method of the CPU bus, the transmission speed of the encryption and decryption configuration data is improved, thereby improving the data processing speed, and the communication between the CPU and the symmetric encryption and decryption device is cut off, thereby improving security.

[0057] Based on the above embodiments:

[0058] As a preferred embodiment, there are multiple algorithm core modules 2;

[0059] The symmetric encryption and decryption device also includes:

[0060] The control module 3 is used to determine an algorithm core module 2 in an idle state as a target algorithm core module 2 according to the speed mode in the encryption and decryption configuration data and the order of the remaining cache space of each algorithm core module 2;

[0061] The data frame processing unit 1 is specifically used for:

[0062] The data to be processed and the encryption and decryption configuration data parsed from the received data frame to be processed are sent to the target algorithm core module 2, and the encrypted and decrypted data are read and output from each algorithm core module 2 in the order in which the data to be processed are sent.

[0063] Specifically, in order to improve the efficiency of data encryption and decryption through data parallel processing, the embodiment of the present invention involves multiple algorithm core modules 2, each algorithm core module 2 can perform encryption and decryption, thereby having the hardware foundation for realizing data parallel processing. However, due to the presence of multiple algorithm core modules 2, the problem of how to coordinate multiple algorithm core modules 2 to work efficiently naturally arises. For this reason, a control module 3 is set in the embodiment of the present invention, which can determine an idle algorithm core module 2 as the target algorithm core module 2 according to the speed mode in the encryption and decryption configuration data and the sorting of the remaining cache space of each algorithm core module 2, thereby facilitating the task arrangement of the algorithm core module 2 and its remaining cache space to be linked together, facilitating the balanced task execution of each algorithm core module 2, and facilitating the improvement of the utilization rate of each algorithm core module 2 and the improvement of work efficiency.

[0064] Among them, in order to ensure that the order of "outputting encrypted and decrypted data" is consistent with the order of "receiving data frames to be processed", that is, to ensure that the data to be processed sent by a data source is accurately returned to the data source after processing, the data frame processing case source in the embodiment of the present invention can read and output the encrypted and decrypted data from each algorithm core module 2 in the order of sending the data to be processed, thereby ensuring the accuracy of data reception and output.

[0065] As a preferred embodiment, the data frame processing unit 1 is further used for:

[0066] Extracting the algorithm mode from the received data frame to be processed, and indicating the algorithm mode error to the sender of the data frame to be processed after receiving the control module 3 indicating the algorithm mode error;

[0067] The control module 3 is further configured to indicate an algorithm mode error to the data frame processing unit 1 when the algorithm mode does not belong to an algorithm mode supported by the symmetric encryption algorithm.

[0068] Specifically, considering that the algorithm mode of each data frame must be specified when it is sent, and the types of algorithm modes supported by the symmetric encryption algorithm in the present symmetric encryption and decryption device are limited, the control module 3 in the embodiment of the present invention can check the algorithm mode, and when the algorithm mode does not belong to the algorithm mode supported by the symmetric encryption algorithm, indicate an algorithm mode error to the data frame processing unit 1, and the data frame processing unit 1 can also indicate the algorithm mode error to the sender of the data frame to be processed after receiving the indication of the algorithm mode error from the control module 3, thereby ensuring that the workflow of the symmetric encryption and decryption device will not stagnate or fail when the algorithm mode is not supported.

[0069] In order to better illustrate the embodiments of the present invention, please refer to the following Tables 1, 2, 3 and 4, where Table 1 is an input data frame format table, Table 2 is a control bit field definition table, Table 3 is a result data frame format table, and Table 4 is an output status information field definition table.

[0070] Table 1

[0071]

[0072] Specifically, the serial number in Table 1 represents the number of 16 bytes of data in the frame. The key and the initial vector are determined based on the control bit information whether to be included with the frame. When the length of the data to be calculated is not 0, it indicates that the data to be encrypted and decrypted exists, otherwise, it does not exist. It can be seen from Table 1 that the data frame includes encryption and decryption configuration data, and the speed mode is in the control bit of the frame header.

[0073] Table 2

[0074]

[0075]

[0076] Table 3

[0077]

[0078] Table 4

[0079]

[0080] As a preferred embodiment, the data frame processing unit 1 is further used for:

[0081] Determine whether the received data frame to be processed needs to be pre-calculated according to the data frame header. If pre-calculation is required, send the key in the data frame to be processed to the target algorithm core module 2 when receiving the target algorithm core module 2, so that the target algorithm core module 2 can pre-calculate the key;

[0082] Determine whether the received data frame to be processed is a pre-calculated data frame. If it is a pre-calculated data frame, send the data to be processed of the current data frame to be processed to its corresponding target algorithm core module 2, so that the target algorithm core module 2 performs encryption and decryption operations on the data to be processed according to the pre-calculated key;

[0083] The control module 3 is also used for, when the data frame to be processed needs to be pre-calculated, if there is an algorithm core module 2 dedicated to pre-calculation, then the algorithm core module 2 dedicated to pre-calculation will be used as the target algorithm core module 2; if there is no algorithm core module 2 dedicated to pre-calculation, then according to the speed mode in the encryption and decryption configuration data and the order of the remaining cache space of each algorithm core module 2, an algorithm core module 2 in an idle state is determined as the target algorithm core module 2.

[0084] Specifically, considering that there may be a certain delay in reading the data to be processed, that is, the data source may first send the key through a data frame for pre-calculation (key expansion), therefore, in an embodiment of the present invention, the key can be expanded in advance when pre-calculation is required, and the expanded key is locked internally. After the data to be processed is read, encryption and decryption operations can be performed directly, and the instruction to execute the pre-calculation can be given by the frame header.

[0085] Among them, an algorithm core module 2 dedicated to pre-calculation can be pre-specified among multiple algorithm core modules 2. In this way, when pre-calculation is needed, the algorithm core module 2 dedicated to pre-calculation can be used as the target algorithm core module 2. If the algorithm core module 2 dedicated to pre-calculation is not pre-specified, an algorithm core module 2 in an idle state can be determined as the target algorithm core module 2 based on the speed mode in the encryption and decryption configuration data and the order of the remaining cache space of each algorithm core module 2.

[0086] As a preferred embodiment, the control module 3 includes:

[0087] The state machine module 31 is used to send the remaining cache space of each algorithm core module 2 to the credit update module 32, and determine an algorithm core module 2 in an idle state as a target algorithm core module 2 according to the speed mode in the encryption and decryption configuration data and the credit value of each algorithm core module 2;

[0088] The credit updating module 32 is used to determine the corresponding credit value according to the remaining cache space of each algorithm core module 2, based on the relationship that the remaining cache space is proportional to the credit.

[0089] To better illustrate the embodiments of the present invention, please refer to Figure 3 , Figure 4 , Table 5 and Table 6, Figure 3 A schematic diagram of the structure of an algorithm-controlled main state machine provided by the present invention, Figure 4 A structural diagram of a pre-calculation state machine provided by the present invention, Table 5 is a flow control logic state machine description table, and Table 6 is a pre-calculation state machine description table.

[0090] Specifically, in the embodiment of the present invention, the structure of the control module 3 is further divided, and a credit update module 32 dedicated to credit value calculation is divided out, thereby realizing the functional modularization of the control module 3, which is beneficial to the design and maintenance of the control module 3, and the credit value can accurately and efficiently express the size of the remaining cache space of each algorithm core module 2.

[0091] Table 5

[0092]

[0093]

[0094]

[0095]

[0096] Table 6

[0097]

[0098]

[0099]

[0100] As a preferred embodiment, according to the speed mode in the encryption and decryption configuration data and the credit value of each algorithm core module 2, determining an algorithm core module 2 in an idle state as the target algorithm core module 2 is specifically as follows:

[0101] If the speed mode in the encryption and decryption configuration data is the low speed mode, determine whether there is an algorithm core module 2 dedicated to the low speed mode, if so, use the algorithm core module 2 dedicated to the low speed mode as the target algorithm core module 2, if not, select the one with the highest credit value among the idle algorithm core modules 2 as the target algorithm core module 2;

[0102] If the speed mode in the encryption and decryption configuration data is the high-speed mode, the one with the highest credit value among the idle algorithm core modules 2 is selected as the target algorithm core module 2 .

[0103] Specifically, first of all, the high-speed mode and the low-speed mode are briefly introduced. The data frame of the high-speed module can be moved through the external DMA (Direct Memory Access), and the data transmission speed is relatively high, corresponding to the high-speed mode, while the data frame of the low-speed mode can be the data sent by the CPU through the bus write method, and the data transmission speed is relatively low, corresponding to the low-speed mode.

[0104] Among them, the data frame processing unit 1 can include two FIFO (First Input First Output) memories, which are used as caches for data frames to be calculated and result data frames respectively; when the input fifo is not empty, a 16-byte frame header is read and latched and then parsed to obtain the algorithm mode, high / low speed working mode, length of data to be encrypted and decrypted, and the first address of the result return, and the operation mode is determined according to the information parsed from the frame header and the signal driven by the state machine, which can be: pre-calculation, high-speed mode, low-speed mode, and for the algorithm working mode, it can be: ECB (Electronic Codebook) mode, CBC (Cipher Block Chaining) mode, OFB (Output-FeedBack) mode, CFB (Cipher FeedBack) mode and CTR (Counter mode) mode.

[0105] Specifically, considering that the application demand for the low-speed mode is relatively small, a dedicated algorithm core module 2 can be specified for the low-speed mode, which is beneficial to improving work efficiency. Even if a dedicated algorithm core module 2 is not specified for the low-speed mode, the one with the highest credit value among the idle algorithm core modules 2 can be selected as the target algorithm core module 2. For the data frames to be processed in the high-speed mode, the one with the highest credit value among the idle algorithm core modules 2 can be directly selected as the target algorithm core module 2.

[0106] Among them, the one with the highest credit value among the idle algorithm core modules 2 is selected as the target algorithm core module 2, and the data to be processed can be sent to the algorithm core module 2 with the least tasks at present for task execution, which is beneficial to balancing the workload of each algorithm core module 2 and improving data processing efficiency.

[0107] As a preferred embodiment, the state machine module 31 is further used for:

[0108] The identifier of the latest algorithm core module 2 written into the data to be processed is sent as a write identifier to the queue cache control module 33, the identifier of the latest algorithm core module 2 read out of the data is sent as a read identifier to the queue cache control module 33, and the identifier at the front end of the data processing queue is sent to the data frame processing unit 1, so that it can read the encrypted and decrypted data from the algorithm core module 2 corresponding to the identifier at the front end of the data processing queue and output it;

[0109] The control module 3 also includes:

[0110] The queue buffer control module 33 is used to add the write identifier to the end of the data processing queue, and delete the first bit of the identifier at the front of the data processing queue when receiving the read identifier.

[0111] Specifically, in order to ensure that the output order of data is consistent with the receiving order of the data frames to be processed, a queue cache control module 33 dedicated to data processing queue maintenance is set in the control module 3 in the embodiment of the present invention. The basis of its queue maintenance is "the identifier of the latest algorithm core module 2 written to the data to be processed" and "the identifier of the latest algorithm core module 2 read out of the data". Through this simple method, the data processing queue can be maintained efficiently and accurately, thereby improving work efficiency.

[0112] The identifier may be of various types, such as a serial number, etc., which is not limited in the embodiment of the present invention.

[0113] Of course, in addition to this method, the method of maintaining the data processing queue may also be in many other forms, which are not limited in the embodiment of the present invention.

[0114] As a preferred embodiment, the data frame processing unit 1 includes:

[0115] The data frame processing subunit is used to extract encryption and decryption configuration data from the data frame to be processed received through the SSRAM (Synchronous Static Random Access Memory) input interface, send the data to be processed of the data frame to be processed to the target algorithm core module 2, and read the encrypted and decrypted data from each algorithm core module 2 in the order of sending the data to be processed and output it through the SSRAM output interface;

[0116] SSRAM input interface;

[0117] SSRAM output interface.

[0118] Specifically, a hardware encryption and decryption device such as a symmetric encryption and decryption device needs to be connected to a data source device through a data interface. Considering that the interface timing of the SSRAM interface is simple and can be integrated into any standard bus interface for easy transplantation, the SSRAM interface is selected as the data input and output interface in the embodiment of the present invention.

[0119] Among them, the SSRAM interface in the embodiment of the present invention can be a 128-bit SSRAM interface, in which the symmetric encryption algorithm can be operated in integer multiples of 16 bytes. There is no bandwidth loss caused by splicing data bit width inside the 128-bit interface, and the maximum bandwidth can be exerted.

[0120] The present invention also provides a digital chip, comprising the symmetric encryption and decryption device as in the above-mentioned embodiment.

[0121] For an introduction to the digital chip provided in the embodiment of the present invention, please refer to the aforementioned embodiment of the symmetric encryption and decryption device, and the embodiment of the present invention is not limited here.

[0122] The present invention further provides a server, comprising the digital chip as described in the above embodiment and a server body connected to the digital chip.

[0123] For an introduction to the server provided in the embodiment of the present invention, please refer to the aforementioned embodiment of the symmetric encryption and decryption device, and the embodiment of the present invention is not limited here.

[0124] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments, and the same and similar parts between the embodiments can be referred to each other. It should also be noted that in this specification, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises a..." does not exclude the presence of other identical elements in the process, method, article or device including the element.

[0125] The above description of the disclosed embodiments enables those skilled in the art to implement or use the present invention. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but rather to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A symmetric encryption and decryption device, characterized in that: include: A data frame processing unit, used to send the data to be processed and the encryption and decryption configuration data parsed from the received data frame to be processed to the algorithm core module, and read the encrypted and decrypted data from the algorithm core module and output it; The algorithm core module is used to perform encryption and decryption processing on the received data to be processed based on the symmetric cryptographic algorithm and the encryption and decryption configuration data; Wherein, the encryption and decryption configuration data includes a speed mode, a key and an initial vector; The speed mode includes a high-speed mode and a low-speed mode. The to-be-processed data frames corresponding to the high-speed mode are transferred by directly accessing the DMA memory register, and the to-be-processed data frames corresponding to the low-speed mode are sent by the CPU through bus writing. There are multiple algorithm core modules; The symmetric encryption and decryption device also includes: A control module, configured to determine an idle algorithm core module as a target algorithm core module according to the speed mode in the encryption and decryption configuration data and the order of the remaining cache space of each algorithm core module; The data frame processing unit is specifically used for: The data to be processed and the encryption and decryption configuration data parsed from the received data frame to be processed are sent to the target algorithm core module, and the encrypted and decrypted data are read and output from each algorithm core module in the order in which the data to be processed are sent.

2. The symmetric encryption and decryption device according to claim 1, characterized in that: The data frame processing unit is also used for: Extracting the algorithm mode from the received data frame to be processed, and indicating the algorithm mode error to the sender of the data frame to be processed after receiving the control module indicating the algorithm mode error; The control module is further configured to indicate an algorithm mode error to the data frame processing unit when the algorithm mode does not belong to an algorithm mode supported by the symmetric encryption algorithm.

3. The symmetric encryption and decryption device according to claim 2, characterized in that: The data frame processing unit is also used for: Determine whether the received data frame to be processed needs to be pre-calculated according to the data frame header; if pre-calculation is required, send the key in the data frame to be processed to the target algorithm core module when receiving the target algorithm core module, so that the target algorithm core module pre-calculates the key; Determine whether the received data frame to be processed is a pre-calculated data frame. If it is a pre-calculated data frame, send the data to be processed of the current data frame to be processed to its corresponding target algorithm core module, so that the target algorithm core module performs encryption and decryption operations on the data to be processed according to the pre-calculated key; The control module is also used to, when the data frame to be processed needs to be pre-calculated, if there is an algorithm core module dedicated to pre-calculation, use the algorithm core module dedicated to pre-calculation as the target algorithm core module; if there is no algorithm core module dedicated to pre-calculation, determine an algorithm core module in an idle state as the target algorithm core module based on the speed mode in the encryption and decryption configuration data and the order of the remaining cache space of each algorithm core module.

4. The symmetric encryption and decryption device according to claim 1, characterized in that: The control module comprises: A state machine module, used to send the remaining cache space of each algorithm core module to the credit update module, and determine an algorithm core module in an idle state as the target algorithm core module according to the speed mode in the encryption and decryption configuration data and the credit value of each algorithm core module; The credit updating module is used to determine the corresponding credit value according to the remaining cache space of each algorithm core module in accordance with the proportional relationship between the remaining cache space and the credit.

5. The symmetric encryption and decryption device according to claim 4, characterized in that: The method of determining an algorithm core module in an idle state as the target algorithm core module according to the speed mode in the encryption and decryption configuration data and the credit value of each algorithm core module is specifically as follows: If the speed mode in the encryption / decryption configuration data is a low-speed mode, determine whether there is an algorithm core module dedicated to the low-speed mode, if so, use the algorithm core module dedicated to the low-speed mode as the target algorithm core module, if not, select the one with the highest credit value among the idle algorithm core modules as the target algorithm core module; If the speed mode in the encryption / decryption configuration data is the high-speed mode, one of the idle algorithm core modules with the highest credit value is selected as the target algorithm core module.

6. The symmetric encryption and decryption device according to claim 4, characterized in that: The state machine module is also used for: Send the latest identifier of the algorithm core module written into the data to be processed as a write identifier to the queue cache control module, send the latest identifier of the algorithm core module read out of the data as a read identifier to the queue cache control module, and send the identifier at the front end of the data processing queue to the data frame processing unit, so that it can read the encrypted and decrypted data from the algorithm core module corresponding to the identifier at the front end of the data processing queue and output it; The control module also includes: The queue cache control module is used to add the write identifier to the end of the data processing queue, and delete the first bit of the identifier of the data processing queue when receiving the read identifier.

7. The symmetric encryption and decryption device according to any one of claims 1 to 6, characterized in that: The data frame processing unit comprises: The data frame processing subunit is used to extract encryption and decryption configuration data from the data frame to be processed received through the synchronous static random access memory SSRAM input interface, send the data to be processed of the data frame to be processed to the target algorithm core module, and read the encrypted and decrypted data from each algorithm core module in the order of sending the data to be processed and output it through the SSRAM output interface; The SSRAM input interface; The SSRAM output interface.

8. A digital chip, characterized in that: It comprises the symmetric encryption and decryption device as described in any one of claims 1 to 7.

9. A server, characterized in that: It comprises the digital chip as claimed in claim 8 and a server body connected to the digital chip.

Images