A communication method, apparatus, device, and computer readable storage medium

Abstract

The application discloses a communication method, device, equipment and computer readable storage medium, relates to the technical field of data security, and comprises the following steps: obtaining a key corresponding to a current time according to an initial key; the initial key comprises a first initial key and a second initial key; the first initial key is generated by a server, and the second initial key is generated by an encryption special FPGA accelerator; generating a data packet according to the key and to-be-sent data; sending the data packet to a packet receiving end; generating verification data packet according to a verification key; the verification key comprises a first verification key and a second verification key; the first verification key is obtained by querying the server, and the second verification key is obtained by querying the encryption special FPGA accelerator; and sending the verification data packet to the packet receiving end, so that the packet receiving end verifies the legitimacy of the data packet according to the initial key and the verification data packet. The method can improve data security and be applicable to various network scenes.

Description

Technical Field

[0001] This application relates to the field of data security technology, and in particular to a communication method; it also relates to a communication device, equipment, and computer-readable storage medium. Background Technology

[0002] In recent years, many manufacturers have launched new computing methods that primarily utilize network-connected FPGA (Field Programmable Gate Array) accelerator clusters. This approach involves housing a large number of FPGA accelerators on specially designed low-power servers equipped with PCIe (Peripheral Component Interconnect express) power and without CPU (Central Processing Unit) assistance, connected to a network via a router. This decoupling of FPGA accelerators from servers reduces the number of servers required, necessitating only a small number for task allocation and security management. However, when FPGA accelerator clusters are interconnected via a network, the relatively simple architecture of FPGA accelerators makes cluster security a critical issue that needs to be addressed.

[0003] Existing FPGA cluster security solutions tend to establish a key-based security system (generally generated using symmetric or asymmetric encryption) between the server and FPGA accelerators to ensure the security of the FPGA cluster. However, this approach has the following two security vulnerabilities: 1. The number of servers is limited. As the number of FPGA accelerators in the cluster increases, the key establishment operations between the server and each FPGA accelerator become more frequent, leading to network congestion and reduced security. Adding more servers to address this issue would conversely increase energy consumption. 2. The lack of a corresponding secure communication mechanism within the FPGA accelerator cluster makes data communication between FPGA accelerators vulnerable to various types of network attacks, such as DDoS (Distributed Denial of Service) attacks.

[0004] In view of this, how to ensure secure communication between the server and the FPGA accelerator while ensuring secure communication between the FPGA accelerators has become a technical problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0005] The purpose of this application is to provide a communication method that can ensure secure communication between the server and the FPGA accelerator while also ensuring secure communication between the FPGA accelerators themselves, thereby greatly improving data security and being applicable to various network scenarios. Another purpose of this application is to provide a communication device, apparatus, and computer-readable storage medium, all of which possess the aforementioned technical effects.

[0006] To address the aforementioned technical problems, this application provides a communication method, comprising:

[0007] The key corresponding to the current time is calculated based on the initial key; the initial key includes a first initial key and a second initial key; the first initial key is generated by the server, and the second initial key is generated by a dedicated encryption FPGA accelerator;

[0008] Generate a data message based on the key and the data to be sent;

[0009] Send the data packet to the message receiving end;

[0010] A verification data message is generated based on the verification key; the verification key includes a first verification key and a second verification key; the first verification key is obtained from the server, and the second verification key is obtained from the encryption-dedicated FPGA accelerator;

[0011] The verification data message is sent to the message receiving end so that the message receiving end can verify the legitimacy of the data message based on the initial key and the verification data message.

[0012] Optionally, the first initial key includes: a first-level initial key and a second-level initial key; the first-level initial key is generated by the server for the encryption-dedicated FPGA accelerator and forwarded by the encryption-dedicated FPGA accelerator to the computing-dedicated FPGA accelerator in the interconnected FPGA accelerator group corresponding to the encryption-dedicated FPGA accelerator; the second-level initial key is generated by the server for the computing-dedicated FPGA accelerator and broadcast to all the computing-dedicated FPGA accelerators.

[0013] Optionally, the method by which the encryption-dedicated FPGA accelerator forwards the key generated by the server for the encryption-dedicated FPGA accelerator includes:

[0014] The encryption-dedicated FPGA accelerator transmits the key generated by the server for the encryption-dedicated FPGA accelerator to the computing-dedicated FPGA accelerator interconnected with the encryption-dedicated FPGA accelerator through the inter-kernel data transmission channel, and the computing-dedicated FPGA accelerator interconnected with the encryption-dedicated FPGA accelerator forwards the received key to other computing-dedicated FPGA accelerators under the same router.

[0015] Optionally, the server generates different keys for different encryption-specific FPGA accelerators.

[0016] Optionally, the first verification key includes: a first-level verification key and a second-level verification key; the first-level verification key is calculated by the server based on the first-level initial key, and the second-level verification key is calculated by the server based on the second-level initial key.

[0017] Optionally, the data packet and the verification data packet are sent to the packet receiving end in parallel.

[0018] Optionally, verifying the legitimacy of the data packet based on the initial key and the verification data packet includes:

[0019] Parse the verification data message to obtain the verification key;

[0020] The key to be verified is calculated based on the initial key;

[0021] Compare the verification key with the key to be verified;

[0022] If the verification key is different from the key to be verified, the data packet will not be accepted.

[0023] If the verification key is the same as the key to be verified, then the legality of the data packet is verified according to the verification key;

[0024] If the verification is successful, the data packet is received;

[0025] If the verification fails, the data packet will not be received.

[0026] Optionally, the time interval for the server to update the second-level key chain is greater than the time interval for the server to update the first-level key chain, which is less than the time interval for the encryption-dedicated FPGA accelerator to update the key chain; the first-level key chain is the key chain generated by the server for the encryption-dedicated FPGA accelerator, and the second-level key chain is the key chain generated by the server for the computing-dedicated FPGA accelerator.

[0027] Optionally, the time interval for the server to update the first-level key chain, the time interval for the server to update the second-level key chain, and the time interval for the encryption-dedicated FPGA accelerator to update the key chain satisfy the following:

[0028] Δ2 = n1 * Δ1;

[0029] Δ3 = n2 * Δ2;

[0030] Δ1 represents the time interval for the server to update the first-level key chain, n1 represents the number of keys in the first-level key chain, Δ2 represents the time interval for the server to update the second-level key chain, n2 represents the number of keys in the second-level key chain, and Δ3 represents the time interval for the encryption-dedicated FPGA accelerator to update the key chain.

[0031] Optionally, the step of calculating the key corresponding to the current time based on the initial key includes:

[0032] The time sequence number corresponding to the current time is calculated based on the current time, the initial time, and the key chain update time interval;

[0033] The key corresponding to the current time is calculated based on the time sequence number and the initial key.

[0034] Optionally, the step of calculating the time sequence number corresponding to the current time based on the current time, the initial time, and the key chain update time interval includes:

[0035] in accordance with Calculate the time sequence number corresponding to the current time;

[0036] j represents the time sequence number, T now T0 represents the initial time, Δ represents the key chain update time interval, and n represents the number of keys in the key chain.

[0037] Optionally, calculating the key corresponding to the current time based on the time sequence number and the initial key includes:

[0038] According to S j =S j (S0) Calculate the key corresponding to the current time;

[0039] S j S0 represents the key corresponding to the current time, j represents the time sequence number, and S0 represents the initial key.

[0040] To address the aforementioned technical problems, this application also provides a communication device, comprising:

[0041] The calculation module is used to calculate the key corresponding to the current time based on the initial key; the initial key includes a first initial key and a second initial key; the first initial key is generated by the server, and the second initial key is generated by a dedicated encryption FPGA accelerator;

[0042] The first message generation module is used to generate a data message based on the key and the data to be sent;

[0043] The first message sending module is used to send the data message to the message receiving end;

[0044] The second message generation module is used to generate a verification data message based on the verification key; the verification key includes a first verification key and a second verification key; the first verification key is obtained from the server, and the second verification key is obtained from the encryption-dedicated FPGA accelerator;

[0045] The second message sending module is used to send the verification data message to the message receiving end, so that the message receiving end can verify the legality of the data message according to the initial key and the verification data message.

[0046] To address the aforementioned technical problems, this application also provides a communication device, comprising:

[0047] Memory, used to store computer programs;

[0048] A processor for implementing the communication method as described in any of the preceding claims when executing the computer program.

[0049] To address the aforementioned technical problems, this application also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the communication method described in any of the preceding claims.

[0050] The communication method provided in this application includes: calculating a key corresponding to the current time based on an initial key; the initial key includes a first initial key and a second initial key; the first initial key is generated by the server, and the second initial key is generated by a dedicated encryption FPGA accelerator; generating a data packet based on the key and the data to be sent; sending the data packet to a message receiving end; generating a verification data packet based on a verification key; the verification key includes a first verification key and a second verification key; the first verification key is obtained from the server, and the second verification key is obtained from the dedicated encryption FPGA accelerator; sending the verification data packet to the message receiving end, so that the message receiving end verifies the legality of the data packet based on the initial key and the verification data packet.

[0051] As can be seen, the communication method provided in this application uses keys generated by a server with a complex architecture and high security, and also by a dedicated encryption FPGA accelerator for key generation. The key generation by these two highly secure devices effectively ensures network security and prevents key breaches due to server data leakage. Furthermore, the communication method provided in this application is applicable to various network data forwarding scenarios such as broadcast, multicast, and unicast, and can be used for bidirectional data communication between the server and the dedicated computing FPGA accelerator. When the message sender is the server, the security of message transmission is guaranteed thanks to the server's robust security system. When the message sender is a dedicated computing FPGA accelerator, the message receiver consists of a server with a robust security system and other dedicated computing FPGA accelerators in the interconnected FPGA accelerator group. Data forwarding with other dedicated computing FPGA accelerators in the interconnected FPGA accelerator group does not require router involvement, enabling direct point-to-point communication and ensuring security.

[0052] The communication device, equipment, and computer-readable storage medium provided in this application all have the aforementioned technical effects. Attached Figure Description

[0053] To more clearly illustrate the technical solutions in the embodiments of this application, the drawings used in the prior art and embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0054] Figure 1 A flowchart illustrating a communication method provided in an embodiment of this application;

[0055] Figure 2 This is a schematic diagram of an FPGA accelerator cluster network provided in an embodiment of this application;

[0056] Figure 3 A schematic diagram of a key chain provided in an embodiment of this application;

[0057] Figure 4 This is a schematic diagram of an initial key configuration process provided in an embodiment of this application;

[0058] Figure 5 A communication process provided in an embodiment of this application;

[0059] Figure 6 A schematic diagram of a communication device provided in an embodiment of this application;

[0060] Figure 7 This is a schematic diagram of a communication device provided in an embodiment of this application. Detailed Implementation

[0061] The core of this application is to provide a communication method that ensures secure communication between the server and the FPGA accelerator while also ensuring secure communication between the FPGA accelerators themselves, thereby greatly improving data security and making it applicable to various network scenarios. Another core aspect of this application is to provide a communication device, equipment, and computer-readable storage medium, all of which possess the aforementioned technical effects.

[0062] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0063] Please refer to Figure 1 , Figure 1 This is a flowchart illustrating a communication method provided in an embodiment of this application. (Refer to...) Figure 1 As shown, the method mainly includes:

[0064] S101: Calculate the key corresponding to the current time based on the initial key; the initial key includes a first initial key and a second initial key; the first initial key is generated by the server, and the second initial key is generated by the encryption-dedicated FPGA accelerator;

[0065] S102: Generate a data packet based on the key and the data to be sent;

[0066] S103: Send the data packet to the packet receiving end;

[0067] S104: Generate a verification data message based on the verification key; the verification key includes a first verification key and a second verification key; the first verification key is obtained from the server, and the second verification key is obtained from the encryption-dedicated FPGA accelerator;

[0068] S105: Send the verification data message to the message receiving end so that the message receiving end can verify the legality of the data message based on the initial key and the verification data message.

[0069] The communication method provided in this embodiment is applied to a tree-topology-based FPGA accelerator cluster network. This tree-topology-based FPGA accelerator cluster network mainly includes servers, dedicated encryption FPGA accelerators, dedicated computing FPGA accelerators, and routers. For example, refer to... Figure 2 The diagram illustrates a tree-based FPGA accelerator cluster network with a depth of 4. In this FPGA accelerator cluster network, a compute-specific FPGA accelerator interconnected with a cryptographic FPGA accelerator, along with other compute-specific FPGA accelerators belonging to the same router as the cryptographic FPGA accelerator, constitutes the interconnected FPGA accelerator group of the cryptographic FPGA accelerator.

[0070] The server's main functions include: 1. Collecting and recording information about the dedicated encryption FPGA accelerator and the information about the computational dedicated FPGA accelerators in the interconnected FPGA accelerator group corresponding to the dedicated encryption FPGA accelerator. 2. Generating and sending a key chain using a pseudo-random function. 3. Generating and sending messages.

[0071] To prevent the server-generated key chain from being deciphered due to server data leakage, and to ensure data transmission security and increase the difficulty of key chain decryption, each dedicated encryption FPGA accelerator in this embodiment also uses a pseudo-random function to generate a key chain. The key chain generated by the dedicated encryption FPGA accelerator is updated to the compute-dedicated FPGA accelerators in the interconnected FPGA accelerator group corresponding to the server and the dedicated encryption FPGA accelerator.

[0072] The functions of a dedicated FPGA accelerator for computing include generating and sending messages.

[0073] In other words, in an FPGA accelerator cluster network, the message sender can be a server, and the message receiver can be a dedicated computing FPGA accelerator. Alternatively, the message sender in an FPGA accelerator cluster network can also be a dedicated computing FPGA accelerator, in which case the message receiver can be either a dedicated computing FPGA accelerator or a server.

[0074] When the message sender is the server, that is, when the entity executing the communication method is the server, the server sends messages in the following way:

[0075] The server calculates the key corresponding to the current time based on the initial key; the initial key includes a first initial key and a second initial key; the first initial key is generated by the server, and the second initial key is generated by the encryption-dedicated FPGA accelerator. The server generates a data packet based on the key and the data to be sent, and sends the data packet to the corresponding encryption-dedicated FPGA accelerator. Furthermore, the server generates a verification data packet based on a verification key; the verification key includes a first verification key and a second verification key; the first verification key is obtained from the server itself, and the second verification key is obtained from the encryption-dedicated FPGA accelerator. The server sends the verification data packet to the corresponding encryption-dedicated FPGA accelerator, so that the encryption-dedicated FPGA accelerator verifies the legitimacy of the data packet based on the initial key and the verification data packet.

[0076] The first verification key is the same as the key calculated based on the first initial key, and the second verification key is the same as the key calculated based on the second initial key.

[0077] The first and second verification keys can be calculated by the message sender based on the initial key, or they can be obtained by the message sender from elsewhere.

[0078] For example, when the message sender is a server, the first verification key is a key calculated by the server based on the first initial key. The second verification key is a key obtained by the server from the dedicated encryption FPGA accelerator, and it is the key corresponding to the current time calculated by the dedicated encryption FPGA accelerator based on the second initial key.

[0079] When the message sender is a dedicated computing FPGA accelerator, the first verification key is a key obtained by the dedicated computing FPGA accelerator from the server, and is the key corresponding to the current time calculated by the server based on the first initial key. The second verification key is a key obtained by the dedicated computing FPGA accelerator from the dedicated encryption FPGA accelerator, and is the key corresponding to the current time calculated by the dedicated encryption FPGA accelerator based on the second initial key.

[0080] Specifically, during the FPGA accelerator cluster network initialization phase, each dedicated encryption FPGA accelerator is responsible for uploading its own information and the information of the interconnected FPGA accelerator group corresponding to it to the server. The uploaded information of the dedicated encryption FPGA accelerator and the corresponding interconnected FPGA accelerator group may include information such as its ID (Identity Document), IP (Internet Protocol) address, and MAC (Media Access Control Address).

[0081] The server receives and stores information uploaded by the dedicated encryption FPGA accelerators, and generates a key chain using a pseudo-random function. Additionally, each dedicated encryption FPGA accelerator uses a pseudo-random function to generate a key chain for its corresponding interconnected FPGA accelerator group and the server.

[0082] After the key is generated, the server stores relevant parameters such as the initial key, the key chain update time interval, and the number of keys contained in the key chain into the server and the corresponding FPGA accelerator, thus ending the initialization phase.

[0083] When the server sends a message, it calculates the key corresponding to the current time based on the initial key. Since the initial key includes a first initial key generated by the server and a second initial key generated by the dedicated encryption FPGA accelerator, the server calculates the key corresponding to the current time based on both the first initial key and the second initial key generated by the dedicated encryption FPGA accelerator.

[0084] The key calculated from the initial key to the current time may include:

[0085] The time sequence number corresponding to the current time is calculated based on the current time, the initial time, and the key chain update time interval;

[0086] The key corresponding to the current time is calculated based on the time sequence number and the initial key.

[0087] The relationship between the current time, initial time, keychain update interval, and time sequence number can be:

[0088]

[0089] j represents the time sequence number, T now T0 represents the initial time, Δ represents the key chain update time interval, and n represents the number of keys in the key chain.

[0090] The relationship between the time sequence number, the initial key, and the key corresponding to the current time can be:

[0091] S j =S j (S0); S j S0 represents the key corresponding to the current time, and S0 represents the initial key.

[0092] Based on the calculated keys, the server uses the Message Authentication Code (MAC) function to combine the data to be sent with the keys to form a data packet, and then sends the data packet to the corresponding dedicated FPGA accelerator.

[0093] On the other hand, the server queries the dedicated encryption FPGA accelerator for the second verification key corresponding to the time sequence number, and combines the queried second verification key with the first verification key queried from itself to form a verification data message, which is then sent to the corresponding dedicated computing FPGA accelerator. The dedicated computing FPGA accelerator receives the initial key generated by the server and the dedicated encryption FPGA accelerator, and verifies the legitimacy of the data message with the verification data message.

[0094] In some embodiments, the data packet and the verification data packet are sent to the packet receiver in parallel. If the packet sender is a server, the server sends the data packet and the verification data packet in parallel to the corresponding dedicated computing FPGA accelerator. This effectively improves the efficiency and security of data authentication.

[0095] Additionally, in some embodiments, verifying the legitimacy of the data packet based on the initial key and the verification data packet includes:

[0096] Parse the verification data message to obtain the verification key;

[0097] The key to be verified is calculated based on the initial key;

[0098] Compare the verification key with the key to be verified;

[0099] If the verification key is different from the key to be verified, the data packet will not be accepted.

[0100] If the verification key is the same as the key to be verified, then the legality of the data packet is verified according to the verification key;

[0101] If the verification is successful, the data packet is received;

[0102] If the verification fails, the data packet will not be received.

[0103] Specifically, after receiving the data packet and verification data packet from the server, the dedicated FPGA accelerator first parses the verification data packet to obtain the verification key. Then, the FPGA accelerator calculates the key to be verified based on the initial key and compares it with the parsed key to be verified. If the comparison results are the same, the network security verification passes. Conversely, if the comparison results are different, the network security verification fails, and the network security of the FPGA accelerator is compromised. In the case of a failed network security verification, the FPGA accelerator does not receive the data packet. If the network security verification passes, the FPGA accelerator further uses the parsed verification key to verify the legitimacy of the data packet, i.e., whether the data in the data packet is normal. If the verification passes, indicating that normal data can be obtained, the FPGA accelerator receives the data packet. Otherwise, the FPGA accelerator does not receive the data packet.

[0104] Based on the above embodiments, to further enhance the security of data communication and reduce the difficulty of cracking a single key chain, in some embodiments, the first initial key includes: a first-level initial key and a second-level initial key; the first-level initial key is generated by the server for the encryption-dedicated FPGA accelerator and forwarded by the encryption-dedicated FPGA accelerator to the computing-dedicated FPGA accelerator in the interconnected FPGA accelerator group corresponding to the encryption-dedicated FPGA accelerator; the second-level initial key is generated by the server for the computing-dedicated FPGA accelerator and broadcast to all the computing-dedicated FPGA accelerators.

[0105] In this embodiment, the server generates a two-level key chain. The first-level key chain is the key chain generated by the server for each dedicated encryption FPGA accelerator and the corresponding interconnected FPGA accelerator group, to achieve data encryption authentication for each dedicated encryption FPGA accelerator and the corresponding interconnected FPGA accelerator group. Since the number of dedicated encryption FPGA accelerators in the FPGA accelerator cluster network is much lower than the number of dedicated computing FPGA accelerators, the bandwidth and other network resources occupied by the server when transmitting the generated key chain to each dedicated encryption FPGA accelerator are relatively low.

[0106] The second-level keychain is generated by the server for all compute-dedicated FPGA accelerators, used for supplemental authentication during data forwarding by the compute-dedicated FPGA accelerators. Because the second-level keychain is distributed by the server to all compute-dedicated FPGA accelerators, the number of distributions by routers in the FPGA accelerator cluster network is greater, and the bandwidth consumed is also increased.

[0107] Specifically, the server uses a pseudo-random function. Generate the first-level key chain and the first-level key chain The keys are distributed to dedicated FPGA accelerators for encryption (the FPGA accelerators for encryption are numbered i). The time interval for updating this first-level key chain is denoted as Δ1, and there are a total of n1 keys.

[0108] The encryption-dedicated FPGA accelerator i distributes the received first-level key chain to the compute-dedicated FPGA accelerators in the corresponding interconnected FPGA accelerator group.

[0109] The server uses a pseudo-random function S2 to generate the second-level key chain. And distribute the second-level keychain via broadcast to all compute-dedicated FPGA accelerators in the FPGA accelerator cluster network. The time interval for updating the second-level key chain is denoted as Δ2, and there are a total of n2 keys.

[0110] The first-level key chain and the second-level key chain work together to generate keys, which can further enhance the security of data communication.

[0111] In order to improve data security, in some embodiments, the server generates different keys for different encryption-dedicated FPGA accelerators.

[0112] Specifically, for different encryption-specific FPGA accelerators, the server uses different pseudo-random functions to generate different key chains.

[0113] In addition, to improve data security, in some embodiments, the encryption-dedicated FPGA accelerator forwards the key generated by the server for the encryption-dedicated FPGA accelerator in the following ways:

[0114] The encryption-dedicated FPGA accelerator transmits the key generated by the server for the encryption-dedicated FPGA accelerator to the computing-dedicated FPGA accelerator interconnected with the encryption-dedicated FPGA accelerator through the inter-kernel data transmission channel, and the computing-dedicated FPGA accelerator interconnected with the encryption-dedicated FPGA accelerator forwards the received key to other computing-dedicated FPGA accelerators under the same router.

[0115] In this embodiment, the transmission of the first-level key chain is handled by the high-speed data transmission channel between kernels or by end-to-end transmission between dedicated FPGA accelerators under the same router in the interconnected FPGA accelerator group. No router query or forwarding is required during the entire process, so the transmission rate is fast and it is not easily detected by malicious programs that specifically target router communication, which can effectively improve data security.

[0116] While the server generates the two-level key chain, the dedicated FPGA accelerator for encryption also generates a third-level key chain. The dedicated FPGA accelerator for encryption uses the pseudo-random function Si3 to generate the third-level key chain. The time interval for updating the third-level key chain is denoted as Δ3, and there are a total of n3 intervals.

[0117] Encrypting and authenticating the data to be sent using a three-level key chain can increase the difficulty of decryption and ensure the security of data transmission.

[0118] In accordance with the first initial key comprising a first-level initial key and a second-level initial key, the first verification key comprises a first-level verification key and a second-level verification key; the first-level key to be verified is calculated by the server based on the first-level initial key, and the second-level key to be verified is calculated by the server based on the second-level initial key.

[0119] In this situation, when the server sends data, the server first determines based on... The time indices j1, j2, and j3 corresponding to the current time are calculated. j1 is the time indices of the first-level key chain, j2 is the time indices of the second-level key chain, and j3 is the time indices of the third-level key chain.

[0120]

[0121]

[0122]

[0123] Then, the server uses the time sequence number and the initial key. in accordance with and Calculate the key corresponding to the current time respectively

[0124]

[0125]

[0126]

[0127] Based on the calculated keys, the server, according to each key and the data to be sent, ... Generate a data packet Pkg and send the data packet to the corresponding dedicated FPGA accelerator.

[0128] During the process of the server generating and sending data packets, the server performs the following operations in parallel: Request the key corresponding to the time sequence number j3 from the dedicated encryption server i. That is, the second verification key, and will contain And the results obtained from the server itself Level 1 verification key and The verification data message Chk_pkg for the second-level verification key is sent to the corresponding dedicated FPGA accelerator.

[0129] After receiving the data packet and the verification data packet, the dedicated FPGA accelerator first parses the verification data packet to obtain the verification key. Then, the dedicated FPGA accelerator calculates the key to be verified based on the initial key. The calculated key to be verified is then compared with the parsed verification key. If the comparison results are the same, the network security verification passes. Conversely, if the comparison results are different, the network security verification fails. In the case of a failed network security verification, the dedicated FPGA accelerator does not receive data packets. In the case of a successful network security verification, the dedicated FPGA accelerator further uses the parsed verification key. Verify the validity of the data packet. If the verification passes, accept the data packet. Otherwise, do not accept the data packet.

[0130] Furthermore, based on the above embodiments, as a specific implementation method, the time interval for the server to update the second-level key chain is greater than the time interval for the server to update the first-level key chain and less than the time interval for the encryption-dedicated FPGA accelerator to update the key chain; the first-level key chain is the key chain generated by the server for the encryption-dedicated FPGA accelerator, and the second-level key chain is the key chain generated by the server for the computing-dedicated FPGA accelerator.

[0131] Specifically, the time intervals for the server to update the first-level key chain, the time intervals for the server to update the second-level key chain, and the time intervals for the encryption-dedicated FPGA accelerator to update the key chain can satisfy the following:

[0132] Δ2 = n1 * Δ1;

[0133] Δ3 = n2 * Δ2;

[0134] Δ1 represents the time interval for the server to update the first-level key chain, n1 represents the number of keys in the first-level key chain, Δ2 represents the time interval for the server to update the second-level key chain, n2 represents the number of keys in the second-level key chain, and Δ3 represents the time interval for the encryption-dedicated FPGA accelerator to update the key chain.

[0135] refer to Figure 3As shown, in this embodiment, the time interval for the server to update the first-level key chain is Δ1, the time interval for the server to update the second-level key chain is Δ2 = Δ1 * n1, and the time interval for the encryption-dedicated FPGA accelerator to update the third-level key chain is Δ3 = Δ2 * n2.

[0136] Since the second-level keychain is distributed by the server to all dedicated FPGA accelerators, the routers in the FPGA accelerator cluster network distribute the keychain more frequently and consume more bandwidth. Therefore, in this embodiment, the time granularity for updating the second-level keychain is coarser than that of the first-level keychain. The main function of the third-level keychain is to address the untrustworthiness of the first and second-level keychains due to security risks on the server. In this embodiment, the time interval for updating the third-level keychain by the dedicated FPGA accelerator is set to Δ3 = Δ2 * n2. Under normal network conditions, the introduction of the third-level keychain will further increase the difficulty of cracking the keychain, ensuring the security of data communication in the FPGA accelerator cluster network.

[0137] When the message sender is a dedicated computing FPGA accelerator, that is, when the entity executing the communication method is the dedicated computing FPGA accelerator, the message sending method of the dedicated computing FPGA accelerator is as follows:

[0138] The dedicated computing FPGA accelerator calculates a key corresponding to the current time based on an initial key. This initial key includes a first initial key and a second initial key. The first initial key is generated by the server, and the second initial key is generated by the encryption-specific FPGA accelerator. The dedicated computing FPGA accelerator generates a data packet based on the key and the data to be sent, and sends the data packet to the corresponding dedicated computing FPGA accelerator or server. Furthermore, the dedicated computing FPGA accelerator generates a verification data packet based on a verification key. This verification key includes a first verification key and a second verification key. The first verification key is obtained from the server itself, and the second verification key is obtained from the encryption-specific FPGA accelerator. The dedicated computing FPGA accelerator sends the verification data packet to the corresponding dedicated computing FPGA accelerator or server, so that the dedicated computing FPGA accelerator or server can verify the legitimacy of the data packet based on the initial key and the verification data packet.

[0139] Specifically, when the dedicated FPGA accelerator sends a message, it calculates the key corresponding to the current time based on the initial key. Since the initial key includes a first initial key generated by the server and a second initial key generated by the encryption dedicated FPGA accelerator, the dedicated FPGA accelerator calculates the key corresponding to the current time based on both the first initial key generated by the server and the second initial key generated by the encryption dedicated FPGA accelerator.

[0140] The dedicated FPGA accelerator can first calculate the time sequence number corresponding to the current time based on the current time, the initial time, and the key chain update time interval; then, based on the time sequence number and the initial key, it can calculate the key corresponding to the current time.

[0141] The relationship between the current time, initial time, keychain update interval, and time sequence number can be:

[0142]

[0143] j represents the time sequence number, T now T0 represents the initial time, Δ represents the key chain update time interval, and n represents the number of keys in the key chain.

[0144] The relationship between the time sequence number, the initial key, and the key corresponding to the current time can be:

[0145] S j =S j (S0); S j S0 represents the key corresponding to the current time, and S0 represents the initial key.

[0146] Based on the calculated keys, the dedicated FPGA accelerator uses the Message Authentication Code (MAC) function to combine the data to be sent with the keys into a data message, and then sends the data message to the corresponding dedicated FPGA accelerator or server.

[0147] On the other hand, the dedicated computing FPGA accelerator server queries the first verification key corresponding to the time sequence number, queries the dedicated encryption FPGA accelerator for the second verification key corresponding to the time sequence number, and combines the queried first verification key and the second key to be verified into a verification data message, which is then sent to the corresponding dedicated computing FPGA accelerator or server. The dedicated computing FPGA accelerator or server verifies the legitimacy of the data message based on the initial key generated by the server and the dedicated encryption FPGA accelerator, along with the verification data message.

[0148] The data packet and the verification data packet can be sent to the packet receiver in parallel. If the packet sender is a dedicated FPGA accelerator, the dedicated FPGA accelerator will send the data packet and the verification data packet to the corresponding dedicated FPGA accelerator or server in parallel. This effectively improves the efficiency and security of data authentication.

[0149] Additionally, verifying the legitimacy of the data packet based on the initial key and the verification data packet may include:

[0150] Parse the verification data message to obtain the verification key;

[0151] The key to be verified is calculated based on the initial key;

[0152] Compare the verification key with the key to be verified;

[0153] If the verification key is different from the key to be verified, the data packet will not be accepted.

[0154] If the verification key is the same as the key to be verified, then the legality of the data packet is verified according to the verification key;

[0155] If the verification is successful, the data packet is received;

[0156] If the verification fails, the data packet will not be received.

[0157] Taking the server as the message receiver as an example, after receiving the data packet and verification data packet sent by the server, the server first parses the verification data packet to obtain the verification key. Then, the server calculates the key to be verified based on the initial key and compares the calculated verification key with the parsed key to be verified. If the comparison result is the same, the network security verification passes. Conversely, if the comparison result is different, the network security verification fails, and the server's network security is vulnerable. In the case of network security verification failure, the server does not accept the data packet. In the case of network security verification passing, the server further uses the parsed verification key to verify the legality of the data packet, that is, to verify whether the data in the data packet is normal. If the verification passes, indicating that normal data can be obtained, the server accepts the data packet. Otherwise, the server does not accept the data packet.

[0158] To further enhance data communication security and reduce the difficulty of cracking a single key chain, in some embodiments, the server generates a two-level key chain. The first-level key chain is the key chain generated by the server for each dedicated encryption FPGA accelerator and the corresponding interconnected FPGA accelerator group, to achieve data encryption authentication for each dedicated encryption FPGA accelerator and the corresponding interconnected FPGA accelerator group. Since the number of dedicated encryption FPGA accelerators in the FPGA accelerator cluster network is much lower than the number of dedicated computing FPGA accelerators, the bandwidth and other network resources occupied by the server when transmitting the generated key chain to each dedicated encryption FPGA accelerator are relatively low.

[0159] The second-level keychain is generated by the server for all compute-dedicated FPGA accelerators, used for supplemental authentication during data forwarding by the compute-dedicated FPGA accelerators. Because the second-level keychain is distributed by the server to all compute-dedicated FPGA accelerators, the number of distributions by routers in the FPGA accelerator cluster network is greater, and the bandwidth consumed is also increased.

[0160] Specifically, the server uses a pseudo-random function. Generate the first-level key chain and the first-level key chain The keys are distributed to dedicated FPGA accelerators for encryption (the FPGA accelerators for encryption are numbered i). The time interval for updating this first-level key chain is denoted as Δ1, and there are a total of n1 keys.

[0161] The encryption-dedicated FPGA accelerator i distributes the received first-level key chain to the compute-dedicated FPGA accelerators in the corresponding interconnected FPGA accelerator group.

[0162] The server uses a pseudo-random function S2 to generate the second-level key chain. And distribute the second-level keychain via broadcast to all compute-dedicated FPGA accelerators in the FPGA accelerator cluster network. The time interval for updating the second-level key chain is denoted as Δ2, and there are a total of n2 keys.

[0163] The first-level key chain and the second-level key chain work together to generate keys, which can further enhance the security of data communication.

[0164] In order to improve data security, in some embodiments, the server uses different pseudo-random functions to generate different key chains for different encryption-dedicated FPGA accelerators.

[0165] In addition, to improve data security, in some embodiments, the encryption-dedicated FPGA accelerator forwards the key generated by the server for the encryption-dedicated FPGA accelerator in the following ways:

[0166] The encryption-dedicated FPGA accelerator transmits the key generated by the server for the encryption-dedicated FPGA accelerator to the computing-dedicated FPGA accelerator interconnected with the encryption-dedicated FPGA accelerator through the inter-kernel data transmission channel, and the computing-dedicated FPGA accelerator interconnected with the encryption-dedicated FPGA accelerator forwards the received key to other computing-dedicated FPGA accelerators under the same router.

[0167] In this embodiment, the transmission of the first-level key chain is handled by the high-speed data transmission channel between kernels or by end-to-end transmission between dedicated FPGA accelerators under the same router in the interconnected FPGA accelerator group. No router query or forwarding is required during the entire process, so the transmission rate is fast and it is not easily detected by malicious programs that specifically target router communication, which can effectively improve data security.

[0168] While the server generates the two-level key chain, the dedicated FPGA accelerator for encryption also generates a third-level key chain. The dedicated FPGA accelerator for encryption uses a pseudo-random function. Generate a third-level key chain The time interval for updating the third-level key chain is denoted as Δ3, and there are a total of n3 intervals.

[0169] Encrypting and authenticating the data to be sent using a three-level key chain can increase the difficulty of decryption and ensure the security of data transmission.

[0170] In accordance with the first initial key comprising a first-level initial key and a second-level initial key, the first verification key comprises a first-level verification key and a second-level verification key; the first-level key to be verified is calculated by the server based on the first-level initial key, and the second-level key to be verified is calculated by the server based on the second-level initial key.

[0171] In this scenario, when the dedicated FPGA accelerator sends data, it first bases its response on... The time indices j1, j2, and j3 corresponding to the current time are calculated. j1 is the time indices of the first-level key chain, j2 is the time indices of the second-level key chain, and j3 is the time indices of the third-level key chain.

[0172]

[0173]

[0174]

[0175] Then, the dedicated FPGA accelerator calculates based on the time sequence number and the initial key. in accordance with and Calculate the key corresponding to the current time respectively

[0176]

[0177]

[0178]

[0179] Based on the calculated keys, the dedicated FPGA accelerator calculates the data to be transmitted according to each key and the data to be sent. Generate a data packet Pkg and send the data packet to the corresponding dedicated FPGA accelerator or server.

[0180] During the process of generating and sending data packets using a dedicated FPGA accelerator, the dedicated FPGA accelerator performs the following operations in parallel: Requesting the key corresponding to the time sequence number j3 from the dedicated encryption server i. That is, the second verification key, and will contain and what is obtained from the server That is, the first-level verification key and That is, the verification data message Chk_pkg of the second-level verification key is sent to the corresponding dedicated computing FPGA accelerator or server.

[0181] After receiving the data packet and the verification data packet, the dedicated FPGA accelerator or server first parses the verification data packet to obtain the verification key. Then, the dedicated FPGA accelerator calculates the key to be verified based on the initial key. The calculated key to be verified is then compared with the parsed verification key. If the comparison results are the same, the network security verification passes. Conversely, if the comparison results are different, the network security verification fails. In the case of a failed network security verification, the dedicated FPGA accelerator does not receive data packets. In the case of a successful network security verification, the dedicated FPGA accelerator further uses the parsed verification key. Verify the validity of the data packet. If the verification passes, accept the data packet. Otherwise, do not accept the data packet.

[0182] Furthermore, the time intervals for the server to update the first-level keychain, the time intervals for the server to update the second-level keychain, and the time intervals for the encryption-dedicated FPGA accelerator to update the keychain can specifically satisfy the following:

[0183] Δ2 = n1 * Δ1;

[0184] Δ3 = n2 * Δ2;

[0185] Δ1 represents the time interval for the server to update the first-level key chain, n1 represents the number of keys in the first-level key chain, Δ2 represents the time interval for the server to update the second-level key chain, n2 represents the number of keys in the second-level key chain, and Δ3 represents the time interval for the encryption-dedicated FPGA accelerator to update the key chain.

[0186] refer to Figure 3 As shown, in this embodiment, the time interval for the server to update the first-level key chain is Δ1, the time interval for the server to update the second-level key chain is Δ2 = Δ1 * n1, and the time interval for the encryption-dedicated FPGA accelerator to update the third-level key chain is Δ3 = Δ2 * n2.

[0187] Since the second-level keychain is distributed by the server to all dedicated FPGA accelerators, the routers in the FPGA accelerator cluster network distribute the keychain more frequently and consume more bandwidth. Therefore, in this embodiment, the time granularity for updating the second-level keychain is coarser than that of the first-level keychain. The main function of the third-level keychain is to address the untrustworthiness of the first and second-level keychains due to security risks on the server. In this embodiment, the time interval for updating the third-level keychain by the dedicated FPGA accelerator is set to Δ3 = Δ2 * n2. Under normal network conditions, the introduction of the third-level keychain will further increase the difficulty of cracking the keychain, ensuring the security of data communication in the FPGA accelerator cluster network.

[0188] The following describes a communication implementation example using server-side and computing-specific FPGA accelerators and encryption-specific FPGA accelerators:

[0189] refer to Figure 4 The initial configuration diagram shows that during initial configuration, the server generates the first-level key chain. Transmit initial key Service generates second-level keychain Transmit initial key S 2,0 The encryption-specific FPGA accelerator, numbered 0, generates the third-level key chain and transmits the initial key. The server receives and stores the initial key. S 2,0 as well as The encryption-dedicated FPGA accelerator, numbered 0, receives the initial key. The initial key is then forwarded to the compute-dedicated FPGA accelerator within its corresponding interconnected FPGA accelerator group. The compute-dedicated FPGA accelerator within the interconnected FPGA accelerator group receives and stores the initial key. S 2,0 as well as

[0190] refer to Figure 5 As shown, the data packet transmission time of the compute-dedicated FPGA accelerator in the interconnected FPGA accelerator group is the current time T. now The corresponding time numbers j1, j2, and j3, combined with the initial key. S 2,0 as well as Calculate the key corresponding to the current time. and Data to be sent and key and Combine and generate data messages and send them to the server.

[0191] In addition, the compute-dedicated FPGA accelerator in the interconnected FPGA accelerator group requests a key with time sequence number j3 from the encryption-dedicated FPGA accelerator numbered 0. Request the key with time sequence numbers j1 and j2 from the server. and the requested verification key and The generated verification data message is sent to the server.

[0192] The server receives data packets and verification data packets, and parses the verification data packets to obtain the verification key. and In addition, the server uses the initial key S 2,0 as well as Calculate the key to be verified and Compare the verification key with the key to be verified. If they are different, do not receive the data packet. If they are the same, use the verification key. and Verify the validity of the data packet. If the verification passes, the data packet is accepted. If the verification fails, the data packet is not accepted.

[0193] Assuming Δ1 = 10ms, n1 = 100, Δ2 = 1s, n2 = 60, Δ3 = 1min, and n3 = 60, the three-level key chain proposed in this embodiment has an effective duration of 1 hour. However, if only the key chain generated by the encryption-dedicated FPGA accelerator is used as a single-level authentication key chain, the effective duration of the single-level authentication key chain is 1 second. Therefore, the security efficiency of the scheme proposed in this embodiment is improved by 3600 times.

[0194] In summary, the communication method provided in this application uses keys generated by a server with a complex architecture and high security, and also by a dedicated encryption FPGA accelerator for key generation. The key generation by these two highly secure devices effectively ensures network security and prevents key breaches due to server data leakage. Furthermore, the communication method provided in this application is applicable to various network data forwarding scenarios, including broadcast, multicast, and unicast, and can be used for bidirectional data communication between the server and the dedicated computing FPGA accelerator. When the message sender is the server, the security of message transmission is guaranteed thanks to the server's robust security system. When the message sender is a dedicated computing FPGA accelerator, the message receiver consists of a secure server and other dedicated computing FPGA accelerators in the interconnected FPGA accelerator group. Data forwarding with other dedicated computing FPGA accelerators in the interconnected FPGA accelerator group does not require router involvement, enabling direct point-to-point communication and ensuring security.

[0195] This application also provides a communication device, which is described below and can be referred to in conjunction with the method described above. Please refer to... Figure 6 , Figure 6 This is a schematic diagram of a communication device provided in an embodiment of this application, in conjunction with... Figure 6 As shown, the device includes:

[0196] Calculation module 10 is used to calculate the key corresponding to the current time based on the initial key; the initial key includes a first initial key and a second initial key; the first initial key is generated by the server, and the second initial key is generated by a dedicated encryption FPGA accelerator;

[0197] The first message generation module 20 is used to generate a data message based on the key and the data to be sent;

[0198] The first message sending module 30 is used to send the data message to the message receiving end;

[0199] The second message generation module 40 is used to generate a verification data message based on the verification key; the verification key includes a first verification key and a second verification key; the first verification key is obtained from the server, and the second verification key is obtained from the encryption-dedicated FPGA accelerator;

[0200] The second message sending module 50 is used to send the verification data message to the message receiving end, so that the message receiving end can verify the legality of the data message according to the initial key and the verification data message.

[0201] Based on the above embodiments, as a specific implementation method, the first initial key includes: a first-level initial key and a second-level initial key; the first-level initial key is generated by the server for the encryption-dedicated FPGA accelerator and forwarded by the encryption-dedicated FPGA accelerator to the computing-dedicated FPGA accelerator in the interconnected FPGA accelerator group corresponding to the encryption-dedicated FPGA accelerator; the second-level initial key is generated by the server for the computing-dedicated FPGA accelerator and broadcast to all the computing-dedicated FPGA accelerators.

[0202] Based on the above embodiments, as a specific implementation method, the method by which the encryption-dedicated FPGA accelerator forwards the key generated by the server for the encryption-dedicated FPGA accelerator includes:

[0203] The encryption-dedicated FPGA accelerator transmits the key generated by the server for the encryption-dedicated FPGA accelerator to the computing-dedicated FPGA accelerator interconnected with the encryption-dedicated FPGA accelerator through the inter-kernel data transmission channel, and the computing-dedicated FPGA accelerator interconnected with the encryption-dedicated FPGA accelerator forwards the received key to other computing-dedicated FPGA accelerators under the same router.

[0204] Based on the above embodiments, as a specific implementation method, the server generates different keys for different encryption-specific FPGA accelerators.

[0205] Based on the above embodiments, as a specific implementation method, the first verification key includes: a first-level verification key and a second-level verification key; the first-level verification key is calculated by the server based on the first-level initial key, and the second-level verification key is calculated by the server based on the second-level initial key.

[0206] Based on the above embodiments, as a specific implementation method, the data packet and the verification data packet are sent to the packet receiving end in parallel.

[0207] Based on the above embodiments, as a specific implementation method, the step of verifying the legality of the data packet according to the initial key and the verification data packet includes:

[0208] Parse the verification data message to obtain the verification key;

[0209] The key to be verified is calculated based on the initial key;

[0210] Compare the verification key with the key to be verified;

[0211] If the verification key is different from the key to be verified, the data packet will not be accepted.

[0212] If the verification key is the same as the key to be verified, then the legality of the data packet is verified according to the verification key;

[0213] If the verification is successful, the data packet is received;

[0214] If the verification fails, the data packet will not be received.

[0215] Based on the above embodiments, as a specific implementation method, the time interval for the server to update the second-level key chain is greater than the time interval for the server to update the first-level key chain and less than the time interval for the encryption-dedicated FPGA accelerator to update the key chain; the first-level key chain is the key chain generated by the server for the encryption-dedicated FPGA accelerator, and the second-level key chain is the key chain generated by the server for the computing-dedicated FPGA accelerator.

[0216] Based on the above embodiments, as a specific implementation, the time interval for the server to update the first-level key chain, the time interval for the server to update the second-level key chain, and the time interval for the encryption-dedicated FPGA accelerator to update the key chain satisfy the following:

[0217] Δ2 = n1 * Δ1;

[0218] Δ3 = n2 * Δ2;

[0219] Δ1 represents the time interval for the server to update the first-level key chain, n1 represents the number of keys in the first-level key chain, Δ2 represents the time interval for the server to update the second-level key chain, n2 represents the number of keys in the second-level key chain, and Δ3 represents the time interval for the encryption-dedicated FPGA accelerator to update the key chain.

[0220] Based on the above embodiments, as a specific implementation method, the computing module 10 includes:

[0221] The time sequence number calculation unit is used to calculate the time sequence number corresponding to the current time based on the current time, the initial time, and the key chain update time interval;

[0222] A key calculation unit is used to calculate the key corresponding to the current time based on the time sequence number and the initial key.

[0223] Based on the above embodiments, as a specific implementation method, the time sequence number calculation unit is specifically used for:

[0224] in accordance with Calculate the time sequence number corresponding to the current time;

[0225] j represents the time sequence number, T now T0 represents the initial time, Δ represents the key chain update time interval, and n represents the number of keys in the key chain.

[0226] Based on the above embodiments, as a specific implementation method, the key calculation unit is specifically used for:

[0227] According to S j =S j (S0) Calculate the key corresponding to the current time;

[0228] S j S0 represents the key corresponding to the current time, j represents the time sequence number, and S0 represents the initial key.

[0229] The communication device provided in this application uses keys generated by a server with a complex architecture and high security, and also by a dedicated encryption FPGA accelerator for key generation. The key generation by these two highly secure devices effectively ensures network security and prevents key breaches due to server data leakage. Furthermore, the communication method provided in this application is applicable to various network data forwarding scenarios, including broadcast, multicast, and unicast, and can be used for bidirectional data communication between the server and the dedicated computing FPGA accelerator. When the message sender is the server, the security of message transmission is guaranteed thanks to the server's robust security system. When the message sender is a dedicated computing FPGA accelerator, the message receiver consists of a secure server and other dedicated computing FPGA accelerators in the interconnected FPGA accelerator group. Data forwarding with other dedicated computing FPGA accelerators in the interconnected FPGA accelerator group does not require router involvement, enabling direct point-to-point communication and ensuring security.

[0230] This application also provides a communication device, referenced... Figure 7 As shown, the device includes a memory 1 and a processor 2.

[0231] Memory 1 is used to store computer programs;

[0232] Processor 2 is used to execute computer programs to perform the following steps:

[0233] A key corresponding to the current time is calculated based on an initial key; the initial key includes a first initial key and a second initial key; the first initial key is generated by the server, and the second initial key is generated by a dedicated encryption FPGA accelerator; a data packet is generated based on the key and the data to be sent; the data packet is sent to a message receiving end; a verification data packet is generated based on a verification key; the verification key includes a first verification key and a second verification key; the first verification key is obtained from the server, and the second verification key is obtained from the dedicated encryption FPGA accelerator; the verification data packet is sent to the message receiving end so that the message receiving end can verify the legitimacy of the data packet based on the initial key and the verification data packet.

[0234] For a description of the equipment provided in this application, please refer to the above method embodiments; further details will not be provided here.

[0235] This application also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, can perform the following steps:

[0236] A key corresponding to the current time is calculated based on an initial key; the initial key includes a first initial key and a second initial key; the first initial key is generated by the server, and the second initial key is generated by a dedicated encryption FPGA accelerator; a data packet is generated based on the key and the data to be sent; the data packet is sent to a message receiving end; a verification data packet is generated based on a verification key; the verification key includes a first verification key and a second verification key; the first verification key is obtained from the server, and the second verification key is obtained from the dedicated encryption FPGA accelerator; the verification data packet is sent to the message receiving end so that the message receiving end can verify the legitimacy of the data packet based on the initial key and the verification data packet.

[0237] The computer-readable storage medium may include various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0238] For a description of the computer-readable storage medium provided in this application, please refer to the above method embodiments; further details will not be repeated here.

[0239] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatuses, devices, and computer-readable storage media disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the descriptions are relatively simple; relevant details can be found in the method section.

[0240] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0241] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein can be implemented directly by hardware, a software module executed by a processor, or a combination of both. The software module can be located in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art.

[0242] The communication methods, apparatus, devices, and computer-readable storage media provided in this application have been described in detail above. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the embodiments above are merely for the purpose of helping to understand the methods and core ideas of this application. It should be noted that those skilled in the art can make various improvements and modifications to this application without departing from its principles, and these improvements and modifications also fall within the protection scope of the claims of this application.

Claims

1. A communication method, characterized in that, include: The key corresponding to the current time is calculated based on the initial key; The initial key includes a first initial key and a second initial key; The first initial key is generated by the server, and the second initial key is generated by a dedicated encryption FPGA accelerator; Generate a data message based on the key and the data to be sent; Send the data packet to the message receiving end; A verification data message is generated based on the verification key; the verification key includes a first verification key and a second verification key; the first verification key is obtained from the server, and the second verification key is obtained from the encryption-dedicated FPGA accelerator; The verification data message is sent to the message receiving end so that the message receiving end can verify the legality of the data message based on the initial key and the verification data message; The first initial key includes: a first-level initial key and a second-level initial key; The first-level initial key is generated by the server for the encryption-dedicated FPGA accelerator and forwarded by the encryption-dedicated FPGA accelerator to the computing-dedicated FPGA accelerator in the interconnected FPGA accelerator group corresponding to the encryption-dedicated FPGA accelerator; the second-level initial key is generated by the server for the computing-dedicated FPGA accelerator and broadcast to all the computing-dedicated FPGA accelerators.

2. The communication method according to claim 1, characterized in that, The methods by which the encryption-dedicated FPGA accelerator forwards the key generated by the server for the encryption-dedicated FPGA accelerator include: The encryption-dedicated FPGA accelerator transmits the key generated by the server for the encryption-dedicated FPGA accelerator to the computing-dedicated FPGA accelerator interconnected with the encryption-dedicated FPGA accelerator through the inter-kernel data transmission channel, and the computing-dedicated FPGA accelerator interconnected with the encryption-dedicated FPGA accelerator forwards the received key to other computing-dedicated FPGA accelerators under the same router.

3. The communication method according to claim 1, characterized in that, The server generates different keys for different encryption-specific FPGA accelerators.

4. The communication method according to claim 1, characterized in that, The first verification key includes a first-level verification key and a second-level verification key; the first-level verification key is calculated by the server based on the first-level initial key, and the second-level verification key is calculated by the server based on the second-level initial key.

5. The communication method according to claim 1, characterized in that, The data message and the verification data message are sent to the message receiving end in parallel.

6. The communication method according to claim 1, characterized in that, The step of verifying the legitimacy of the data packet based on the initial key and the verification data packet includes: Parse the verification data message to obtain the verification key; The key to be verified is calculated based on the initial key; Compare the verification key with the key to be verified; If the verification key is different from the key to be verified, the data packet will not be accepted. If the verification key is the same as the key to be verified, then the legality of the data packet is verified according to the verification key; If the verification is successful, the data packet is received; If the verification fails, the data packet will not be received.

7. The communication method according to claim 1, characterized in that, The time interval for the server to update the second-level key chain is greater than the time interval for the server to update the first-level key chain, which is less than the time interval for the encryption-dedicated FPGA accelerator to update the key chain; the first-level key chain is the key chain generated by the server for the encryption-dedicated FPGA accelerator, and the second-level key chain is the key chain generated by the server for the computing-dedicated FPGA accelerator.

8. The communication method according to claim 7, characterized in that, The time intervals for the server to update the first-level keychain, the time intervals for the server to update the second-level keychain, and the time intervals for the encryption-dedicated FPGA accelerator to update the keychain satisfy the following: ∆2= *∆1； ∆3= *∆2； ∆1 represents the time interval during which the server updates the first-level key chain. ∆2 represents the number of keys in the first-level key chain, and ∆2 represents the time interval for the server to update the second-level key chain. ∆3 represents the number of keys in the second-level key chain, and ∆3 represents the time interval for the encryption-dedicated FPGA accelerator to update the key chain.

9. The communication method according to claim 1, characterized in that, The key corresponding to the current time calculated based on the initial key includes: The time sequence number corresponding to the current time is calculated based on the current time, the initial time, and the key chain update time interval; The key corresponding to the current time is calculated based on the time sequence number and the initial key.

10. The communication method according to claim 9, characterized in that, The calculation of the time sequence number corresponding to the current time based on the current time, the initial time, and the key chain update time interval includes: in accordance with Calculate the time sequence number corresponding to the current time; Indicates the time sequence number. Indicates the current time. Indicates the initial time, and ∆ represents the keychain update time interval. This indicates the number of keys in the key chain.

11. The communication method according to claim 9, characterized in that, The step of calculating the key corresponding to the current time based on the time sequence number and the initial key includes: in accordance with Calculate the key corresponding to the current time; This indicates the key corresponding to the current time. Indicates the time sequence number. This represents the initial key.

12. A communication device, characterized in that, include: The calculation module is used to calculate the key corresponding to the current time based on the initial key; The initial key includes a first initial key and a second initial key; The first initial key is generated by the server, and the second initial key is generated by a dedicated encryption FPGA accelerator; The first message generation module is used to generate a data message based on the key and the data to be sent; The first message sending module is used to send the data message to the message receiving end; The second message generation module is used to generate a verification data message based on the verification key; the verification key includes a first verification key and a second verification key; the first verification key is obtained from the server, and the second verification key is obtained from the encryption-dedicated FPGA accelerator; The second message sending module is used to send the verification data message to the message receiving end, so that the message receiving end can verify the legality of the data message according to the initial key and the verification data message; The first initial key includes: a first-level initial key and a second-level initial key; The first-level initial key is generated by the server for the encryption-dedicated FPGA accelerator and forwarded by the encryption-dedicated FPGA accelerator to the computing-dedicated FPGA accelerator in the interconnected FPGA accelerator group corresponding to the encryption-dedicated FPGA accelerator; the second-level initial key is generated by the server for the computing-dedicated FPGA accelerator and broadcast to all the computing-dedicated FPGA accelerators.

13. A communication device, characterized in that, include: Memory, used to store computer programs; A processor for executing the computer program to implement the steps of the communication method as described in any one of claims 1 to 11.

14. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the steps of the communication method as described in any one of claims 1 to 11.

Images