A data encryption and decryption method and device based on a Soc chip

Abstract

The application discloses a data encryption and decryption method and device based on a Soc chip and belongs to the technical field of network communication. The method comprises the following steps: receiving a message in the incoming direction of a chip port, sending the message needing decryption processing to a decryption engine through a decryption channel for decryption processing after analysis, and uploading the decrypted message information to a CPU; the CPU searches for the message information and determines encryption and decryption parameters, sends the message needing bypass encryption and decryption processing to the encryption and decryption engine through a bypass encryption and decryption channel for encryption and decryption processing, and uploads the message information processed by the encryption and decryption to the CPU; the CPU determines the encryption parameters according to the message information, sends the message needing on-the-way encryption processing to an on-the-way message encryption and decryption engine through an on-the-way encryption channel for encryption processing, and sends the message processed by the encryption to the outgoing direction of the chip port. The data encryption and decryption method reduces the CPU load and reduces the message forwarding delay.

Description

Technical Field

[0001] This invention relates to the field of network communication technology, and in particular to a data encryption and decryption method and apparatus based on a SoC chip. Background Technology

[0002] Because message encryption / decryption and authentication consume significant CPU resources, SoC chips typically offload these operations to the hardware chip. Offloading along the message forwarding path has the advantage of shorter message dwell time in the device, but the encryption / decryption and authentication methods are highly fixed, making multiple encryption / decryption operations more difficult and resource-intensive. Bypass offloading, on the other hand, can utilize CPU assistance and integrate with CPU operations, typically enabling multiple encryption / decryption and authentication operations, and its implementation logic is simple and easy to use. However, it increases message latency and puts greater load on the path between the CPU and the encryption / decryption engine.

[0003] The information disclosed in this background section is intended only to enhance the understanding of the overall background of the invention and should not be construed as an admission or in any way implying that the information constitutes prior art known to those skilled in the art. Summary of the Invention

[0004] The purpose of this invention is to provide a data encryption and decryption method and apparatus based on a SoC chip, which can overcome one or more technical problems raised in the prior art.

[0005] To achieve the above objectives, this invention proposes a data encryption / decryption method based on a SoC chip, comprising:

[0006] When a message is received at the inbound direction of the chip port, it is parsed and the message that needs to be decrypted is sent to the encryption and decryption engine for decryption through the accompanying decryption channel. The first message information of the decrypted message is then sent to the CPU through the accompanying decryption channel.

[0007] The CPU searches for the first message information and determines the encryption / decryption parameters. Based on the encryption / decryption parameters, it determines whether the message needs bypass encryption / decryption processing. Messages that need bypass encryption / decryption processing are sent to the encryption / decryption engine through the bypass encryption / decryption path for encryption / decryption processing. The second message information of the encrypted / decrypted message is sent to the CPU through the bypass encryption / decryption path. Messages that do not need bypass encryption / decryption processing are searched and forwarded by the CPU on the business plane.

[0008] The CPU determines the in-path encryption parameters based on the second message information, and determines whether the message needs bypass encryption / decryption processing based on the encryption / decryption parameters. Messages that need in-path encryption processing are sent to the encryption / decryption engine for encryption processing through the in-path encryption channel, and the encrypted message and message forwarding information are sent to the outgoing direction of the chip port. Messages that do not need in-path encryption are searched and forwarded by the CPU on the business plane.

[0009] Preferably, the CPU determines whether the message needs to be bypassed again based on the second message information. If the message needs to be bypassed again, it sends the message to the encryption and decryption engine again through the bypass encryption and decryption path for secondary encryption and decryption. The second message information after secondary encryption and decryption is then sent to the CPU through the bypass encryption and decryption path.

[0010] Preferably, on the accompanying decryption channel, it is determined whether a message needs to be decrypted based on the information in the message decryption flow table. Messages that need to be decrypted are sent to the encryption / decryption engine for decryption and then uploaded through the data DMA RX module in the DMA. Messages that do not need to be decrypted are uploaded directly or after transcoding through the data DMA RX module.

[0011] Preferably, on the bypass encryption / decryption channel, the encryption / decryption parameters written to memory by the CPU are read by the encryption / decryption DMATX module in the DMA and sent to the bypass encryption / decryption module. After integrating the encryption / decryption input parameters, the bypass encryption / decryption module sends the message to the encryption / decryption engine.

[0012] Preferably, on the in-path encryption channel, the in-path encryption parameters written to memory by the CPU are read by the DMA TX module in the DMA to determine whether the message needs in-path encryption processing. Messages that need encryption processing are sent to the encryption / decryption engine for encryption processing, and messages that do not need encryption processing are sent to the outgoing direction of the chip port through the buffer resource management module.

[0013] Preferably, the encryption / decryption engine performs corresponding encryption / decryption processing on the input message based on the encryption / decryption information and authentication information, and outputs the processed message, status field, and authentication code information.

[0014] Preferably, the encryption / decryption process includes one of encryption, decryption, and authentication, or a combination of encryption, decryption, and authentication.

[0015] Preferably, the first message information includes message service surface source information and decryption information of the message to be decrypted; the second message information includes message status information in the encryption / decryption engine, encrypted / decrypted message data, and authentication code.

[0016] This invention also proposes a data encryption / decryption device based on a SoC chip, comprising:

[0017] The in-path decryption channel is used to receive incoming messages from the chip port, parse them, and send the messages that need to be decrypted to the encryption and decryption engine for decryption processing through the in-path decryption channel. The first message information of the decrypted message is then sent to the CPU through the in-path decryption channel.

[0018] The bypass encryption / decryption channel is used to have the CPU search for the first message information and determine the encryption / decryption parameters, send the message that needs to be bypassed for encryption / decryption processing to the encryption / decryption engine for encryption / decryption processing through the bypass encryption / decryption channel, and send the second message information of the encrypted / decrypted message to the CPU through the bypass encryption / decryption channel.

[0019] The in-path encryption channel is used by the CPU to determine the in-path encryption parameters based on the second message information, send the message that needs to be encrypted to the encryption / decryption engine through the in-path encryption channel for encryption processing, and send the encrypted message and message forwarding information to the outgoing direction of the chip port.

[0020] Preferably, the CPU is used to read the message information sent by the in-path decryption channel and the bypass encryption / decryption channel, and to send the message encryption / decryption and encryption processing parameter information and service plane forwarding information to the bypass encryption / decryption channel and the in-path encryption channel.

[0021] Preferably, the in-path decryption channel includes an in-path message decryption module, a data DMA RX module, and an encryption / decryption engine, wherein...

[0022] The in-path message decryption module includes a first in-path message decryption module and a second in-path message decryption module. The first in-path message decryption module is used to convert the encoding format of the message information sent from the port inbound direction and send it to the encryption / decryption engine, the second in-path message decryption module, or the data DMA RX module respectively. The second in-path message decryption module is used to parse the message output by the encryption / decryption engine, convert and encode it, and then send it to the data DMA RX module.

[0023] The data DMA RX module is used to write received messages into memory via DMA and report the corresponding message information to the CPU.

[0024] The encryption / decryption engine is used to decrypt the message based on the decryption information of the input message, and output the processed message and status field.

[0025] Preferably, the bypass encryption / decryption channel includes an encryption / decryption DMA TX module, a bypass encryption / decryption module, an encryption / decryption DMA RX module, and an encryption / decryption engine, wherein...

[0026] The encryption / decryption DMA TX module is used to read the encryption / decryption parameters written to memory by the CPU and send them to the bypass encryption / decryption module;

[0027] The bypass encryption / decryption module is used to convert the information encoding format of received messages before forwarding them;

[0028] The encryption / decryption DMA RX module is used to write received messages into memory via DMA and report the corresponding message information to the CPU.

[0029] The encryption / decryption engine is used to perform corresponding encryption / decryption processing on the input message based on the encryption / decryption information, and output the processed message and status field.

[0030] Preferably, the in-path encryption channel includes a data DMA TX module, an in-path message encryption module, and an encryption / decryption engine, wherein...

[0031] The data DMA TX module is used to obtain the messages and message information stored in the CPU's memory and send them to the accompanying message encryption module;

[0032] The in-path message encryption module includes a first in-path message encryption module and a second in-path message encryption module. The first in-path message encryption module is used to determine whether the received message needs to be encrypted. Messages that do not need to be encrypted are converted into an information encoding format and then sent to the second in-path message encryption module or directly sent to the buffer resource management module. The second in-path message encryption module is used to convert the received message into an information encoding format and then send it to the buffer resource management module.

[0033] The encryption / decryption engine is used to encrypt the input message according to its encryption information and output the processed message and status field.

[0034] Compared with existing technologies, this invention securely offloads data encryption and decryption processing to the hardware of the SoC chip by combining in-channel encryption and decryption with bypass encryption and decryption when forwarding messages at the chip port. For messages that require single decryption, encryption, or decryption, in-channel message encryption and decryption is used to reduce message latency. For messages that require multiple encryption and decryption processes, a combination of in-channel and bypass encryption and decryption is used. Sequential encryption and decryption processing is provided on the in-channel encryption and decryption channel, while other levels of encryption and decryption are processed by bypass encryption and decryption and can be performed multiple times. The in-channel and bypass encryption and decryption channels are isolated, reducing the CPU load and simplifying the implementation process of the encryption and decryption scheme. Attached Figure Description

[0035] Figure 1 This is a schematic diagram of the architecture of the data encryption and decryption method based on the SoC chip of the present invention;

[0036] Figure 2 This is a schematic diagram of the flowchart of the data encryption and decryption method based on the SoC chip of the present invention;

[0037] Figure 3 This is a flowchart illustrating the data encryption and decryption method based on the SoC chip of this invention. Detailed Implementation

[0038] The specific embodiments of the present invention will now be described in detail with reference to the accompanying drawings, but it should be understood that the scope of protection of the present invention is not limited to the specific embodiments.

[0039] Unless otherwise expressly stated, throughout the specification and claims, the term "comprising" or its variations such as "including" or "comprises" shall be understood to include the stated elements or components without excluding other elements or other components.

[0040] This invention discloses a data encryption / decryption method based on a SoC chip. It securely offloads data encryption / decryption processing to the SoC chip hardware by combining in-channel and bypass encryption / decryption during packet forwarding at the chip port. Figure 1 , Figure 2 , Figure 3 As shown, the data encryption and decryption processing method based on a SoC chip disclosed in this embodiment of the invention includes the following processing steps:

[0041] S11, when a message is received in the inbound direction of the chip port, after parsing, the message that needs to be decrypted is sent to the encryption / decryption engine for decryption through the accompanying decryption channel, and the first message information of the decrypted message is sent to the CPU through the accompanying decryption channel.

[0042] Specifically, when the inbound processing engine of the SoC chip port receives a packet and uploads it to the CPU, it first performs a decryption flow table lookup within the inbound processing engine. If the decryption flow table is matched, it obtains the decryption parameters of the packet and other relevant parameters from the service plane, and then sends the packet to the buffer resource management module to await scheduling processing. The decryption parameters include:

[0043] The in-path decryption framework is used to select the decryption framework in the encryption / decryption engine.

[0044] In-channel decryption switch, indicating whether the data packet needs to be decrypted in-channel;

[0045] Select the appropriate decryption algorithm based on the path.

[0046] Decryption key used in the decryption algorithm;

[0047] Decryption data offset: used to indicate the offset position of the ciphertext in the encrypted message;

[0048] Length of data to be decrypted along the path: This refers to the length of the ciphertext only;

[0049] In-path authentication algorithm: Select the relevant authentication algorithm;

[0050] In-path authentication key: The authentication key used in the authentication algorithm;

[0051] In-path authentication data offset: used to indicate the offset position of the data to be authenticated in the encrypted message;

[0052] Length of encrypted data to be decrypted along the way: Used to indicate the length of data that needs to be authenticated.

[0053] After receiving a message, the buffer resource management module will schedule and process it according to the message's priority. Once the message is scheduled in the buffer resource management module, the message and message information will be sent to the first accompanying message decryption module for processing in the form of encoding format A. The encoding format A includes the message's business plane source information and decryption information, which is the first message information.

[0054] After receiving a message, the first accompanying message decryption module first determines whether the message needs to be decrypted along the path. For messages that do not need to be decrypted along the path, the first accompanying message decryption module will send the message and message information directly into the data DMA RX module in DMA (Direct Memory Access) in encoding format A through the bypass path, or send it into the data DMA RX module after passing through the second accompanying message decryption module.

[0055] For messages that require in-path decryption, the message and its decryption information are converted into an encoding format and sent to the encryption / decryption engine for decryption in encoding format C. The encoding format C includes the message's encryption / decryption information and authentication information.

[0056] After receiving a message that needs to be decrypted, the encryption / decryption engine decrypts the message according to the decryption information in the decryption flow table, and outputs the decryption data, decryption status and / or authentication code of the message as needed, and sends this data information to the CPU through the data DMARX module in DMA.

[0057] In this embodiment, the encryption / decryption engine is a general-purpose encryption / decryption and authentication algorithm engine. It uses a unified input encoding (encoding format C) for selecting the encryption / decryption framework, encryption / decryption algorithm, and authentication algorithm. It also uses a unified output encoding (encoding format D) for outputting the encryption / decryption results. The encryption / decryption methods supported by the engine include:

[0058] 1) Encrypt only

[0059] 2) Decrypt only

[0060] 3) Only authentication

[0061] 4) Authentication before encryption

[0062] 5) Authenticate first, then decrypt

[0063] 6) Decrypt first, then authenticate.

[0064] 7) Encrypt first, then authenticate

[0065] The encryption / decryption engine selects one of the processing methods from 1) to 7) above for encryption / decryption based on different message processing requirements. For example, it outputs the corresponding plaintext for decrypted messages, the corresponding ciphertext for encrypted messages, and the corresponding authentication code for authentication messages. For decrypted data, it extracts the ciphertext portion and combines it with relevant decryption parameters for decryption; for encrypted data, it extracts the plaintext portion and combines it with relevant encryption parameters for encryption; and for authentication messages, it extracts the authentication portion and combines it with relevant authentication algorithms for authentication. The encryption / decryption framework in this engine includes, but is not limited to, GCM (Galois Counter Mode) and CBC (Cipher Block Chaining). Encryption / decryption algorithms include, but are not limited to, GCM and SM4. Authentication algorithms include, but are not limited to, SHA1 (Secure Hash Algorithm 1), SHA256 (Secure Hash Algorithm 256), and SM3.

[0066] After receiving the decryption message sent by the encryption / decryption engine, the second accompanying message decryption module parses the message in encoding format D output by the encryption / decryption engine. The message includes the plaintext corresponding to the ciphertext and / or the authentication result. After re-encoding the information in encoding format D into encoding format A, the message is sent to DMA. Encoding format D includes the encrypted / decrypted message, the authentication code, and the status field of the message in the encryption / decryption engine.

[0067] The DMA stores the message into memory through its data DMARX module and reports the first message information to the CPU in the form of encoding format A. This prompts the CPU to extract the corresponding message and message information, i.e., the first message information. The CPU then performs the subsequent bypass encryption and decryption processing based on the first message information.

[0068] S12, the CPU searches for the first message information and determines the encryption / decryption parameters. Based on the encryption / decryption parameters, it determines whether the message needs bypass encryption / decryption processing. The message that needs bypass encryption / decryption processing is sent to the encryption / decryption engine through the bypass encryption / decryption path for encryption / decryption processing. The second message information of the encrypted / decrypted message is sent to the CPU through the bypass encryption / decryption path.

[0069] Specifically, after receiving the first message information, the CPU performs a service plane forwarding information lookup and determines the message encryption / decryption parameters. Based on these parameters, it determines whether the message requires bypass encryption / decryption processing. For messages requiring bypass encryption / decryption processing, the message is sent to the bypass encryption / decryption module via the encryption / decryption DMATX module in the DMA module. The encryption / decryption DMATX module reads the encryption / decryption parameters written to memory by the CPU and then sends them to the bypass encryption / decryption module in encoding format E. Encoding format E includes the bypass encryption / decryption information and the original message information. The encryption / decryption parameters include:

[0070] Bypass encryption / decryption framework: Used for selecting the encryption / decryption framework in the encryption / decryption engine;

[0071] Bypass encryption / decryption switch: Marks whether the data packet needs to be decrypted along the channel;

[0072] Bypass encryption / decryption algorithm: Select the relevant decryption algorithm;

[0073] Bypass encryption / decryption key: The decryption key used in the decryption algorithm;

[0074] Bypass encryption / decryption data offset: Used to indicate the offset position of the data to be encrypted or decrypted in the message;

[0075] Bypass encryption / decryption data length: Used to indicate the length of data that needs to be encrypted or decrypted;

[0076] Bypass authentication algorithm: Select the relevant authentication algorithm;

[0077] Bypass authentication key: The authentication key used in the authentication algorithm;

[0078] Bypass authentication data offset: used to indicate the offset position of the data to be authenticated in the message;

[0079] Bypass authentication data length: Used to indicate the length of data that needs to be authenticated.

[0080] The bypass encryption / decryption module integrates encryption and decryption input parameters, converts the message's encoding format to encoding format C, and then sends the message to the encryption / decryption engine for CPU-specified encryption / decryption operations. After performing the specified encryption / decryption operations, the encryption / decryption engine outputs the encrypted / decrypted data, message encryption / decryption status, and authentication code to the bypass encryption / decryption module as needed, in encoding format D. The bypass encryption / decryption module further writes the message into memory and sends the second message information to the CPU via the encryption / decryption DMA RX module in the DMA module for subsequent in-circuit encryption processing. The second message information includes the message's status information in the encryption / decryption engine, the encrypted / decrypted message data, and / or the authentication code.

[0081] After receiving the first message information, the CPU performs a business plane forwarding information lookup and determines the message encryption / decryption parameters. Based on the encryption / decryption parameters, it determines whether the message needs bypass encryption / decryption processing. For messages that do not require bypass encryption / decryption processing, the CPU performs further table lookup forwarding and determines the next processing behavior for the message.

[0082] In the bypass encryption / decryption channel, the CPU reads the message encryption / decryption parameters and performs secondary or even multiple encryption / decryption processes as needed, thereby reducing the CPU and the load on the bypass encryption / decryption process.

[0083] S13, the CPU determines the in-path encryption parameters based on the second message information, determines whether the message needs in-path encryption processing based on the in-path encryption parameters, sends the message that needs in-path encryption processing to the encryption / decryption engine through the in-path encryption channel for encryption processing, and sends the encrypted message and message forwarding information to the outgoing direction of the chip port.

[0084] Specifically, the CPU searches for the encryption parameters of the bypass-in-path encryption message based on the second message information of the uploaded message, determines the in-path encryption parameters, judges whether the message needs in-path encryption processing based on the in-path encryption parameters, and sends the message that needs in-path encryption processing to the first in-path encryption module after obtaining the message and related information stored in the CPU's memory through the data DMA TX module in the DMA.

[0085] The first in-path message encryption module first determines whether the received message needs in-path encryption. For data messages that need in-path encryption, the first in-path message encryption module performs encoding format integration, that is, converts the received message information in encoding format B into message information in encoding format C. After completing the re-encoding, the data is sent to the encryption and decryption engine for message encryption processing.

[0086] After encrypting the message, the encryption / decryption engine outputs the encrypted data, message encryption status, and authentication code as needed. The message is then sent to the buffer resource management module for scheduling. The buffer resource management module schedules messages based on priority. Once a message is scheduled, it sends the message and forwarding information to the outgoing processing engine. The outgoing processing engine processes the message according to the forwarding information and then sends it out from the chip port, thus completing the encryption / decryption process during forwarding.

[0087] For data packets that do not require in-path encryption, the CPU performs a lookup and forwarding at the service plane. This means either sending the packet directly to the buffer resource management module via a bypass path, or sending it to the buffer resource management module via a second in-path packet encryption module, where it undergoes the same waiting-for-schedule-out chip port processing as described above. This completes the decryption and / or encryption of the packet, as well as the authentication process.

[0088] This invention also discloses a data encryption / decryption device based on a SoC chip, the device comprising:

[0089] The in-path decryption channel is used to receive incoming messages from the chip port, parse them, and send the messages that need to be decrypted to the encryption and decryption engine for decryption processing through the in-path decryption channel. The first message information of the decrypted message is then sent to the CPU through the in-path decryption channel.

[0090] The bypass encryption / decryption channel is used to have the CPU search for the first message information and determine the encryption / decryption parameters, send the message that needs to be bypassed for encryption / decryption processing to the encryption / decryption engine for encryption / decryption processing through the bypass encryption / decryption channel, and send the second message information of the encrypted / decrypted message to the CPU through the bypass encryption / decryption channel.

[0091] The in-path encryption channel is used by the CPU to determine the in-path encryption parameters based on the second message information, send the message that needs to be encrypted to the encryption / decryption engine through the in-path encryption channel for encryption processing, and send the encrypted message and message forwarding information to the outgoing direction of the chip port.

[0092] The in-path decryption channel includes an in-path message decryption module, a data DMA RX module, and an encryption / decryption engine. The in-path message decryption module includes a first in-path message decryption module and a second in-path message decryption module. The first in-path message decryption module is used to convert the encoded format of the message information sent from the port inbound direction and then send it to the encryption / decryption engine, the second in-path message decryption module, or the data DMA RX module, respectively. The second in-path message decryption module is used to parse the message output by the encryption / decryption engine, convert and encode it, and then send it to the data DMA RX module.

[0093] The bypass encryption / decryption channel includes an encryption / decryption DMATX module, a bypass encryption / decryption module, an encryption / decryption DMARX module, and an encryption / decryption engine.

[0094] The in-path encryption channel includes a data DMA TX module, an in-path message encryption module, and an encryption / decryption engine. The in-path message encryption module includes a first in-path message encryption module and a second in-path message encryption module. The first in-path message encryption module is used to determine whether the received message needs to be encrypted. Messages that do not need to be encrypted are converted into an information encoding format and then sent to the second in-path message encryption module or directly sent to the buffer resource management module. The second in-path message encryption module is used to convert the received message into an information encoding format and then send it to the buffer resource management module.

[0095] In this embodiment of the invention, the CPU is used to receive interrupt information sent by the DMA RX direction, namely the data DMA RX module and the encryption / decryption DMA RX module, read relevant messages and message information from memory, perform service plane and encryption / decryption parameter selection based on the service plane, and write message forwarding information, encryption information, etc. into memory for the data DMARX module and the encryption / decryption DMA RX module in the DMA TX direction to read.

[0096] The specific functions of the other modules and their application in the data encryption and decryption method of this invention have been described in detail above, and will not be repeated here.

[0097] This invention employs a combination of on-path encryption / decryption processing on the SoC chip and off-path encryption / decryption processing on the off-path encryption / decryption channel. Furthermore, it uses a unified encryption / decryption engine for both on-path and off-path encryption / decryption processes. For single-pass encryption / decryption messages, on-path message encryption / decryption is used; for messages requiring multiple encryption / decryption processes, a combination of on-path and off-path encryption / decryption is employed. This reduces message forwarding latency and alleviates the load on the CPU and off-path encryption / decryption channels.

[0098] The foregoing description of specific exemplary embodiments of the invention is for illustrative and explanatory purposes. These descriptions are not intended to limit the invention to the precise forms disclosed, and it will be apparent that many changes and variations can be made in accordance with the foregoing teachings. The exemplary embodiments were chosen and described in order to explain the specific principles of the invention and its practical application, thereby enabling those skilled in the art to implement and utilize various different exemplary embodiments of the invention, as well as various different choices and variations. The scope of the invention is intended to be defined by the claims and their equivalents.

Claims

1. A data encryption / decryption method based on a SoC chip, characterized in that, include: When a message is received at the chip port, it is parsed and the message that needs to be decrypted is sent to the encryption / decryption engine for decryption through the accompanying decryption channel. The first message information of the decrypted message is then sent to the CPU through the accompanying decryption channel. The CPU searches for the first message information and determines the encryption / decryption parameters. Based on the encryption / decryption parameters, it determines whether the message needs bypass encryption / decryption processing. If the message needs bypass encryption / decryption processing, it sends the message to the encryption / decryption engine through the bypass encryption / decryption channel for encryption / decryption processing. The CPU also sends the second message information of the encrypted / decrypted message to the CPU through the bypass encryption / decryption channel. The CPU determines the in-path encryption parameters based on the second message information, determines whether the message needs in-path encryption based on the in-path encryption parameters, sends the message that needs in-path encryption to the encryption / decryption engine for encryption through the in-path encryption channel, and sends the encrypted message and message forwarding information to the outgoing direction of the chip port.

2. A data encryption / decryption method based on a SoC chip according to claim 1, characterized in that, After the second message information of the encrypted and decrypted message is sent to the CPU through the bypass encryption and decryption channel, the CPU determines whether the message needs to be bypassed again based on the second message information. If the message needs to be bypassed again, it is sent to the encryption and decryption engine again through the bypass encryption and decryption channel for secondary encryption and decryption. The second message information after secondary encryption and decryption is then sent to the CPU through the bypass encryption and decryption channel.

3. A data encryption / decryption method based on a SoC chip according to claim 1, characterized in that, On the accompanying decryption channel, the system determines whether a message needs decryption based on the information in the message decryption flow table. Messages that need decryption are sent to the encryption / decryption engine for decryption and then uploaded via the data DMA RX module in the DMA. Messages that do not need decryption are uploaded directly or after transcoding via the data DMA RX module.

4. A data encryption / decryption method based on a SoC chip according to claim 1, characterized in that, On the bypass encryption / decryption channel, the encryption / decryption parameters written to memory by the CPU are read by the encryption / decryption DMA TX module in the DMA and sent to the bypass encryption / decryption module. After integrating the encryption / decryption input parameters, the bypass encryption / decryption module sends the message to the encryption / decryption engine.

5. A data encryption / decryption method based on a SoC chip according to claim 1, characterized in that, On the in-path encryption channel, the in-path encryption parameters written to memory by the CPU are read by the DMA TX module in the DMA to determine whether the message needs in-path encryption processing. Messages that need encryption processing are sent to the encryption / decryption engine for encryption processing, and messages that do not need encryption processing are sent to the outgoing direction of the chip port through the buffer resource management module.

6. A data encryption / decryption method based on a SoC chip according to claim 1, characterized in that, The encryption / decryption engine performs corresponding encryption / decryption processing on the input message based on the encryption / decryption information and authentication information, and outputs the processed message, status field, and authentication code information.

7. A data encryption / decryption method based on a SoC chip according to claim 6, characterized in that, The encryption / decryption process includes one of encryption, decryption, and authentication, or a combination of encryption, decryption, and authentication.

8. A data encryption / decryption method based on a SoC chip according to claim 1, characterized in that, The first message information includes the message service surface source information and the decryption information of the message to be decrypted; the second message information includes the message status information in the encryption / decryption engine, the encrypted / decrypted message data, and the authentication code.

9. A data encryption / decryption device based on a SoC chip, characterized in that, include: The in-path decryption channel is used to receive incoming messages from the chip port, parse them, and send the messages that need to be decrypted to the encryption and decryption engine for decryption processing through the in-path decryption channel. The first message information of the decrypted message is then sent to the CPU through the in-path decryption channel. The bypass encryption / decryption channel is used to have the CPU locate the first message information and determine the encryption / decryption parameters, send the message that needs to be bypassed for encryption / decryption processing to the encryption / decryption engine for encryption / decryption processing through the bypass encryption / decryption channel, and send the second message information of the encrypted / decrypted message to the CPU through the bypass encryption / decryption channel. The in-path encryption channel is used by the CPU to determine the in-path encryption parameters based on the second message information, send the message that needs to be encrypted to the encryption / decryption engine through the in-path encryption channel for encryption processing, and send the encrypted message and message forwarding information to the outgoing direction of the chip port.

10. The data encryption / decryption device based on a SoC chip according to claim 9, characterized in that, The in-path decryption channel includes an in-path message decryption module, a data DMA RX module, and an encryption / decryption engine, wherein... The in-path message decryption module includes a first in-path message decryption module and a second in-path message decryption module. The first in-path message decryption module is used to convert the encoding format of the message information sent from the port inbound direction and send it to the encryption / decryption engine, the second in-path message decryption module, or the data DMA RX module respectively. The second in-path message decryption module is used to parse the message output by the encryption / decryption engine, convert and encode it, and then send it to the data DMA RX module. The data DMARX module is used to write received messages into memory via DMA and report the corresponding message information to the CPU. The encryption / decryption engine is used to decrypt the message based on the decryption information of the input message, and output the processed message and status field.

11. The data encryption / decryption device based on a SoC chip according to claim 9, characterized in that, The bypass encryption / decryption channel includes an encryption / decryption DMA TX module, a bypass encryption / decryption module, an encryption / decryption DMA RX module, and an encryption / decryption engine, wherein... The encryption / decryption DMA TX module is used to read the encryption / decryption parameters written to memory by the CPU and send them to the bypass encryption / decryption module; The bypass encryption / decryption module is used to convert the information encoding format of received messages before forwarding them; The encryption / decryption DMA RX module is used to write received messages into memory via DMA and report the corresponding message information to the CPU. The encryption / decryption engine is used to perform corresponding encryption / decryption processing on the input message based on the encryption / decryption information, and output the processed message and status field.

12. The data encryption / decryption device based on a SoC chip according to claim 9, characterized in that, The in-path encryption channel includes a data DMA TX module, an in-path message encryption module, and an encryption / decryption engine, wherein... The data DMA TX module is used to obtain the messages and message information stored in the CPU's memory and send them to the accompanying message encryption module; The in-path message encryption module includes a first in-path message encryption module and a second in-path message encryption module. The first in-path message encryption module is used to determine whether the received message needs to be encrypted. Messages that do not need to be encrypted are converted into an information encoding format and then sent to the second in-path message encryption module or directly sent to the buffer resource management module. The second in-path message encryption module is used to convert the received message into an information encoding format and then send it to the buffer resource management module. The encryption / decryption engine is used to encrypt the input message according to its encryption information and output the processed message and status field.

Images