A hardware data encryption and decryption method and device
By writing messages into memory through the DMA module, the CPU parses them and the encryption/decryption module handles the data, which solves the problem of high CPU resource consumption in existing technologies, achieves efficient hardware encryption/decryption, and improves system performance.
Patent Information
- Application Number
- CN202211714625.5
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2022-12-29
- Publication Date
- 2026-02-03
- Estimated Expiration
- 2042-12-29
AI Technical Summary
Under the existing switch encryption and decryption algorithm framework, the message encryption and decryption process consumes a lot of CPU resources and cannot realize hardware reading of encryption and decryption parameters, resulting in poor performance.
The message is written to memory through the DMA module. After the CPU parses the encryption and decryption parameters, the encryption/decryption unloading DMA module processes the message and writes it back to the original address, reducing CPU resource consumption.
It improves system performance, reduces encryption and decryption latency, and saves CPU processing time and resources.
Smart Images
Figure CN116070237B_ABST
Abstract
Description
TECHNICAL FIELD
[0001] The present application relates to the field of network communication technology, and in particular to a hardware data encryption and decryption method and device. BACKGROUND
[0002] With the requirement of communication security, the performance and security of data encryption and decryption become more and more important, and the requirement of encryption and decryption delay and performance of the message is also higher and higher. Under the existing switch encryption and decryption algorithm framework, the encryption and decryption of the soft forwarding message is mainly completed through the following architecture: after the transceiving packet module receives the message, the message is sent to the CPU through DMA, the encryption and decryption parameters are obtained through software table lookup, and the encryption and decryption parameters and related information are sent to the encryption and decryption module. After the encryption and decryption module completes the encryption and decryption processing, the message is sent to the CPU for software table lookup forwarding. In this process, the encryption and decryption and authentication of the message consume a large amount of CPU resources, and the hardware reading of the encryption and decryption parameters cannot be implemented.
[0003] The information disclosed in this BACKGROUND section is only for the purpose of increasing the understanding of the background of the present application and should not be taken as admitting that such information in the prior art in any form. SUMMARY
[0004] The purpose of the present application is to provide a hardware data encryption and decryption method and device to overcome one or more technical problems in the prior art.
[0005] To achieve the above purpose, the present application provides a hardware data encryption method, comprising:
[0006] After the transceiving packet module receives the message to be encrypted, the address information in the DMA RX module descriptor in the DMA is used to write the message into the memory when the table is sent to the CPU;
[0007] The CPU parses the message, and sends the encryption parameter address information obtained by parsing and matching the table into the encryption and decryption offload DMA module. The encryption and decryption offload DMA module reads the message and the encryption parameter of the message according to the encryption parameter address information, and sends the message and the encryption parameter of the message into the encryption module for encryption processing;
[0008] The encrypted message is written into the original address of the memory again through the encryption and decryption offload DMA module, and is read by the CPU and forwarded through the DMA TX module in the DMA.
[0009] Preferably, the encryption parameter address information includes a message storage address, an encryption parameter storage address and a data parameter storage address.
[0010] Preferably, the encryption and decryption offload DMA module reads the corresponding message and message parameter from the memory according to the encryption parameter address information through a bus.
[0011] The application further provides a hardware data decryption method, comprising:
[0012] After the transceiving module receives the message needing decryption, the message is written into the memory through the address information in the DMA RX module descriptor when the message is sent to the CPU through table lookup;
[0013] The CPU parses the message and sends the decryption parameter address information obtained by the parsing to the encryption and decryption offload DMA module, the encryption and decryption offload DMA module reads the message and the decryption parameter of the message according to the decryption parameter address information, and sends the message and the decryption parameter of the message to the decryption module for decryption processing;
[0014] The decrypted message is written into the original address of the memory by the encryption and decryption offload DMA module again, and is read by the CPU and forwarded by the DMA TX module.
[0015] Preferably, the decryption parameter address information comprises a message storage address, a decryption parameter storage address and a data parameter storage address.
[0016] Preferably, the encryption and decryption offload DMA TX module reads the corresponding message from the memory according to the decryption parameter address information through a bus.
[0017] The application further provides a hardware data encryption device, comprising:
[0018] The DMA RX module is used for writing the received message sent to the CPU into the memory according to the address information in the descriptor;
[0019] The CPU is used for parsing the message, sending the encryption parameter address information obtained by matching the table to the encryption and decryption offload DMA module, and reading and forwarding the encrypted message;
[0020] The encryption and decryption offload DMA module is used for reading the message and the encryption parameter of the message according to the encryption parameter address information, sending the message and the encryption parameter of the message to the encryption module for encryption processing, and writing the message after the encryption processing into the original address of the memory;
[0021] The encryption module is used for performing encryption processing on the message according to the encryption parameter of the received message.
[0022] Preferably, the encryption parameter address information comprises a message storage address, an encryption parameter storage address and a data parameter storage address.
[0023] The application further provides a hardware data decryption device, comprising:
[0024] a DMA RX module for writing the received message sent to the CPU into the memory according to the address information in the descriptor;
[0025] a CPU for analyzing the message, sending the obtained decryption parameter address information into the encryption and decryption offload DMA module, and reading and forwarding the decrypted message and message parameter;
[0026] an encryption and decryption offload DMA module for reading the message and the decryption parameter of the message according to the decryption parameter address information, sending the message and the decryption parameter of the message into the decryption module for decryption processing, and writing the decrypted message into the original address of the memory;
[0027] a decryption module for decrypting the message according to the decryption parameter of the received message.
[0028] Preferably, the decryption parameter address information comprises a message storage address, a decryption parameter storage address and a data parameter storage address.
[0029] Compared with the prior art, the application is hung on the system bus by DMA and directly reads and writes the memory, so that the CPU only needs to provide the storage address of the parameter and data to the encryption and decryption offload DMA, the hardware completes the operation of reading the DDR or SRAM, and the encryption and decryption processing of the data is completed; after the encryption and decryption processing is completed, the original DMA descriptor is reused to write the data after the encryption and decryption is completed back to the original address; thus, the hardware can accelerate the reading and writing of the encryption and decryption data and the related parameter, the CPU processing time and resources are saved, the copy operation of the message is not needed in the encryption and decryption process, the overall performance of the system is improved, and the performance of the encryption and decryption system of the switch is improved and the Ethernet environment is further optimized. BRIEF DESCRIPTION OF DRAWINGS
[0030] Figure 1 is a logic schematic diagram of the hardware data encryption method and device in the embodiment of the application;
[0031] Figure 2 is a flow schematic diagram of the hardware data encryption method in the embodiment of the application;
[0032] Figure 3 is a logic schematic diagram of the hardware data decryption method and device in the embodiment of the application;
[0033] Figure 4 is a flow schematic diagram of the hardware data decryption method in the embodiment of the application. DETAILED DESCRIPTION
[0034] The specific embodiments of the present application will be described in detail below with reference to the accompanying drawings, but the scope of protection of the present application is not limited by the specific embodiments.
[0035] Unless otherwise clearly indicated, throughout the specification and claims, the term "comprise" or variations such as "comprises" or "comprising" will be understood to imply the inclusion of a stated module, element or component but not the exclusion of any other module, element or component.
[0036] In combination Figure 1 , 2 As shown in the accompanying drawings, the method for data encryption and decryption processing by hardware disclosed by the embodiments of the present application comprises the following processing steps:
[0037] S11, after the transceiving packet module receives the message to be encrypted, the message is sent to the CPU by checking the table, and the message is written into the memory by the DMA RX module in the DMA (Direct Memory Access, direct memory reading and writing), that is, the message is written into the memory by the address information in the DMA RX descriptor in the DMA RX module.
[0038] Specifically, after the transceiving packet module of the switch chip port receives the plaintext message to be encrypted, the message is read by matching the five-tuple information and the forwarding vrf information of the message, and the message is sent to the CPU after the forwarding behavior of the message is found from the AD (Associate Data) table. When the message is sent to the CPU, the message is written into the corresponding memory such as DDR or SRAM by the address information in the DMA RX descriptor in the DMA RX module (RX Ring in the DMA, that is, the ring queue module in the DMA receiving direction) in the DMA, and the storage address is recorded by the descriptor in the DMA RX module, and the address information and the message forwarding information are sent to the CPU. Figure 1
[0039] S12, after the CPU analyzes the message to obtain the message characteristics, the encryption parameter address information is obtained by matching the soft table according to the message characteristics, the encryption parameter address information is sent to the encryption and decryption offloading DMA module, the encryption and decryption offloading DMA module reads the message and the encryption parameter of the message according to the encryption parameter address information, and the message and the encryption parameter of the message are sent to the encryption module for encryption processing.
[0040] Specifically, the CPU reads the packet from the corresponding memory according to the packet address information in the address information of the DMA RX descriptor in the DMARX module, analyzes the characteristics of the packet to match the software table, obtains the encryption parameter address information of the packet through the index, including the packet storage address, encryption parameter address saindex, and data parameter address daindex, and writes the encryption parameter address information, packet length packetLength, packet start position descriptor sop, and packet end position descriptor eop, and the packet length in the descriptor into the descriptor to send to the encryption and decryption offload DMA module, which is a special DMA for the encryption and decryption offload module.
[0041] After receiving the descriptor, the encryption and decryption offload DMA module reads the corresponding packet from the DDR or SRAM according to the packet storage address information in the descriptor through the CPU bus, and reads the corresponding encryption parameters such as encryption Key, authentication Key, encryption and authentication algorithm, ivLength, icvLength, etc. according to the encryption parameter address saindex; reads the start position of the check, the length of the encryption content, the length of the authentication content, the implicit IV, and the total length of the packet, etc. according to the data parameter address daindex, so as to realize complete address-based encryption and decryption offload.
[0042] The encryption and decryption offload DMA module sends the packet and the encryption and data parameters read from the DDR or SRAM memory to the encryption module to encrypt the packet and complete the encryption and authentication operation on the packet according to the required parameter information.
[0043] S13, the encrypted packet is written into the original address in the memory again through the encryption and decryption offload DMA module, read by the CPU, and forwarded by the DMATX module in the DMA.
[0044] The encrypted packet is stored in the original address of the packet through the descriptor in the encryption and decryption offload DMA module, which is the address recorded by the encryption and decryption offload DMA module, where the packet is stored in the DDR or SRAM memory before encryption. After the encrypted packet is written into the original address, the storage address information and other packet information such as encryption and forwarding information are sent to the CPU again through the descriptor in the encryption and decryption offload DMA module. The CPU reads the packet information according to the address in the descriptor, performs corresponding analysis, table lookup, editing, and forwarding, and forwards the packet through the DMATX module in the DMA (i.e. Figure 1The DMA Tx Ring (the send-direction ring queue module in the DMA) sends the descriptor in the DMA to the packet receiving module, thus completing the encryption during message forwarding. Since the encrypted message and the original message share the same descriptor (i.e., the encrypted message is written to the original storage address of the original message before encryption), the encryption / decryption unloading DMA module does not need to copy messages, thereby reducing CPU overhead and encryption / decryption latency, and improving system performance.
[0045] The method for decrypting messages is similar to the method for encryption, such as... Figure 3 , 4 As shown, it includes the following steps:
[0046] S21, after the packet receiving module of the switch chip port receives the message that needs to be decrypted, it looks up the table to send the message to the CPU and writes the message into memory through the address information in the DMARX module descriptor in DMA.
[0047] Specifically, after the chip port's packet transceiver module receives the ciphertext message that needs to be decrypted, it matches the message's five-tuple information and forwarding VRF information, then uses the adindex to read the AD (Associated Data) table. After finding the message's forwarding behavior from the AD table, it sends the message to the CPU. This sending is done through the DMA RX module in the DMA (Distributed Memory Array). Figure 2 In DMA (the RX Ring, i.e., the ring queue module in the DMA receive direction), the address information in the descriptor is used to write the message into memory such as DDR or SRAM, and the address information and message forwarding information are sent to the CPU.
[0048] S22, after the CPU parses the message to obtain the message characteristics, it matches the soft table according to the message characteristics to obtain the decryption parameter address information, and sends the decryption parameter address information to the encryption / decryption unloading DMA module. The encryption / decryption unloading DMA module reads the message and the message's decryption parameters according to the decryption parameter address information, and sends the message and the message's decryption parameters to the decryption module for decryption processing.
[0049] Specifically, the CPU reads the packet from the corresponding memory based on the address information in the DMA RX module descriptor, parses the packet feature information to match the soft table, and obtains the decryption parameter address information of the packet through the index, including the packet's storage address, decryption parameter address saindex, and data parameter address daindex. Then, through the encryption / decryption unloading DMA module descriptor, the encryption / decryption parameter address information, packet length, packet start position descriptor sop, packet end position descriptor eop, and the packet length in the descriptor are sent to the encryption / decryption unloading DMA module, which is a dedicated DMA module for encryption / decryption unloading.
[0050] After receiving the descriptor, the encryption / decryption offloading DMA module reads the corresponding message from DDR or SRAM via the CPU bus according to the message storage address information in the descriptor, and reads the corresponding decryption parameters, such as decryption key, authentication key, decryption authentication algorithm, ivLength, icvLength, etc., according to the parameter storage address saindex in the decryption parameter address information; and reads the start position of the verification, the length of the decrypted content, the length of the authentication content, the implicit IV, the total message length, etc., according to the data parameter address daindex. In this way, encryption / decryption offloading based entirely on addresses is realized.
[0051] The encryption / decryption / unload DMA module reads the message and its decryption parameters from memory. These data parameters are then sent to the decryption module to decrypt the message, completing the decryption and authentication process as needed.
[0052] S23, the decrypted message is written back to the original address in memory by the encryption / decryption unloading DMA module, and then read by the CPU and forwarded by the DMATX module in the DMA.
[0053] The decrypted message is stored in its original address by the encryption / decryption / unloading DMA module descriptor. This original address is the address recorded in the encryption / decryption / unloading DMA module descriptor that the message was stored in memory such as DDR or SRAM before decryption. After the decrypted message is written to the original address, the descriptor in the encryption / decryption / unloading DMA module sends the storage address information and other message information, such as decryption and forwarding information, back to the CPU. The CPU reads the message information according to the address in the descriptor, performs corresponding parsing, table lookup, editing, and forwarding, and then forwards the message through the DMA TX module in the DMA (i.e., Figure 1 The DMA Tx Ring (the send-direction ring queue module in DMA) sends the message to the transceiver module, thus completing the decryption process during message forwarding. Since the decrypted message is written to the original storage address of the original message before decryption, the encryption / decryption unloading DMA module does not need to copy the message, thereby reducing CPU overhead and encryption / decryption latency, and improving system performance.
[0054] This invention provides a method for data encryption and decryption using hardware, including message encryption, decryption, and authentication processing, specifically including:
[0055] 1) Encrypt only
[0056] 2) Decrypt only
[0057] 3) Only authentication
[0058] 4) Authentication before encryption
[0059] 5) Authenticate first, then decrypt
[0060] 6) Decrypt first, then authenticate.
[0061] 7) Encrypt first, then authenticate
[0062] Depending on the different message processing requirements, this invention can select one of the processing methods from 1) to 7) above for encryption and decryption processing. For example, it can output corresponding ciphertext for plaintext that needs to be encrypted, output corresponding plaintext for ciphertext that needs to be decrypted, and output corresponding authentication code for authentication messages. For encrypted data, the plaintext portion is extracted and combined with relevant encryption parameters for encryption; for decrypted data, the ciphertext portion is extracted and combined with relevant decryption parameters for decryption; for authentication messages, the authentication portion is extracted and combined with relevant authentication algorithms for authentication.
[0063] This invention also discloses a hardware data encryption device, which includes a message sending and receiving module, a DMA RX module and a DMA TX module, a CPU, an encryption / decryption offloading DMA module, an encryption module, and DDR or SRAM memory.
[0064] The packet receiving module includes an inbound packet receiving module and an outbound packet sending module. The packet receiving module is used to send the plaintext message that needs to be encrypted to the DMARX module in the DMA after matching the message information and looking up the table. The packet sending module receives the encrypted message and forwards it.
[0065] The DMA RX module is used to write received messages sent to the CPU into memory according to the address information in their descriptors;
[0066] The CPU parses the messages sent via the DMA RX module to obtain the encrypted parameter address information of the messages, and sends the encrypted parameter address information to the encryption / decryption / unloading DMA module. Simultaneously, it reads and forwards the encrypted messages. The encrypted parameter address information includes the message's storage address, decryption parameter address (saindex), and data parameter address (daindex). The encryption / decryption / unloading DMA module uses descriptors to write the encrypted parameter address information, message packet length, message start position descriptor (sop), message end position descriptor (eop), and message length within the descriptors into the descriptors before sending them to the encryption / decryption / unloading DMA module.
[0067] The encryption / decryption unloading DMA module is used to read the message and its encryption parameters according to the encryption parameter address information, record the message's storage address, and send the message and its encryption parameters into the encryption module for encryption processing; at the same time, it writes the encrypted message back to its original storage address in memory.
[0068] The encryption module is used to encrypt the received message according to the encryption parameters.
[0069] The DMA TX module is used to read the encryption and forwarding information of the encrypted message (ciphertext) sent by the CPU, and send the message to the transceiver module for forwarding processing.
[0070] This invention also discloses a hardware data decryption device, similar to the aforementioned data encryption device. The data decryption device includes a message sending / receiving module, a DMA RX module, a DMA TX module, a CPU, an encryption / decryption unloading DMA module, a decryption module, and DDR or SRAM memory. The functions of each module and their application in the data decryption process are basically the same as in the aforementioned data encryption device, except that the encryption processing of plaintext is converted into decryption processing of ciphertext. In practical applications, the data encryption device and the data decryption device can be a single integrated device. For example, the encryption module in the data encryption device and the decryption module in the data decryption device can be combined into a single encryption / decryption module. Based on the encryption / decryption framework and algorithm, this module encrypts the plaintext to be encrypted, decrypts the ciphertext to be decrypted, and outputs the corresponding authentication code for messages requiring authentication, thereby achieving complete encryption, decryption, and authentication processing of the data.
[0071] The foregoing description of specific exemplary embodiments of the invention is for illustrative and explanatory purposes. These descriptions are not intended to limit the invention to the precise forms disclosed, and it will be apparent that many changes and variations can be made in accordance with the foregoing teachings. The exemplary embodiments were chosen and described in order to explain the specific principles of the invention and its practical application, thereby enabling those skilled in the art to implement and utilize various different exemplary embodiments of the invention, as well as various different choices and variations. The scope of the invention is intended to be defined by the claims and their equivalents.
Claims
1. A hardware data encryption method, characterized in that, include: After receiving a message that needs to be encrypted, the packet receiving module looks up the table and sends it to the CPU. It then writes the message into memory using the address information in the DMA RX module descriptor in the DMA module. The CPU parses the message and sends the encryption parameter address information obtained by parsing and matching the table to the encryption / decryption unloading DMA module. The encryption / decryption unloading DMA module reads the message and the message's encryption parameters according to the encryption parameter address information and sends the message and the message's encryption parameters to the encryption module for encryption processing. The encrypted message is then rewritten to its original memory address by the DMA module through encryption / decryption. The CPU reads the message and forwards it via the DMA TX module in the DMA module.
2. A hardware data encryption method according to claim 1, characterized in that, The encryption parameter address information includes the message storage address, the encryption parameter storage address, and the data parameter storage address.
3. A hardware data encryption method according to claim 1, characterized in that, The encryption / decryption unloading DMA module reads the corresponding message and message parameters from the memory via the bus according to the encryption parameter address information.
4. A hardware data decryption method, characterized in that, include: After the packet receiving module receives a message that needs to be decrypted, it looks up the table to send the message to the CPU and writes the message into memory using the address information in the DMA RX module descriptor in the DMA module. The CPU parses the message and sends the decryption parameter address information obtained by parsing and matching the table to the encryption / decryption unloading DMA module. The encryption / decryption unloading DMA module reads the message and the message's decryption parameters according to the decryption parameter address information and sends the message and the message's decryption parameters to the decryption module for decryption processing. The decrypted message is then written back to its original memory address via the encryption / decryption unloading DMA module. The CPU reads the message and forwards it through the DMA TX module in the DMA module.
5. A hardware data decryption method according to claim 4, characterized in that, The decryption parameter address information includes the message storage address, the decryption parameter storage address, and the data parameter storage address.
6. A hardware data decryption method according to claim 4, characterized in that, The encryption / decryption unloading DMA TX module reads the corresponding message and message parameters from the memory via the bus according to the decryption parameter address information.
7. A hardware data encryption device, characterized in that, include: The DMA RX module is used to write the received messages sent to the CPU into memory according to the address information in the descriptor; The CPU is used to parse the message, send the obtained encryption parameter address information to the encryption / decryption offload DMA module, and read and forward the encrypted message. The encryption / decryption unloading DMA module is used to read the message and the encryption parameters of the message according to the encryption parameter address information, and send the message and the encryption parameters of the message into the encryption module for encryption processing. And write the encrypted message to the original address in memory; The encryption module is used to encrypt the received message according to the encryption parameters.
8. The hardware data encryption device according to claim 7, characterized in that, The encryption parameter address information includes the message storage address, the encryption parameter storage address, and the data parameter storage address.
9. A hardware data decryption device, characterized in that, include: The DMA RX module is used to write the received messages sent to the CPU into memory according to the address information in the descriptor; The CPU is used to parse the message and send the obtained decryption parameter address information to the encryption / decryption offload DMA module. And reading and forwarding the decrypted messages; The encryption / decryption unloading DMA module is used to read the message and the message's decryption parameters according to the decryption parameter address information, and send the message and the message's decryption parameters into the decryption module for decryption processing; And write the decrypted message back to its original memory address; The decryption module is used to decrypt the received message based on the decryption parameters.
10. The hardware data decryption device according to claim 9, characterized in that, The decryption parameter address information includes the message storage address, the decryption parameter storage address, and the data parameter storage address.
Citation Information
Patent Citations
Data encryption or decryption method, device and system
CN113836543A