A data packet processing method, chip and forwarding device

Abstract

The application provides a data message processing method, a chip and a forwarding device, the method is applied to the chip of the forwarding device; a loopback channel is formed between a forwarding core module, a resource management module and a ciphering and deciphering engine in the chip, and the method comprises the following steps: S1, the forwarding core module obtains a data message, searches for corresponding ciphering and deciphering parameters of the data message from a ciphering and deciphering flow table, and sends the data message and the ciphering and deciphering parameters to the resource management module; S2, the resource management module sends the data message and the ciphering and deciphering parameters to the ciphering and deciphering engine; S3, the ciphering and deciphering engine performs ciphering and deciphering on the data message by using the ciphering and deciphering parameters, and sends the ciphered and deciphered data message to the resource management module; and S4, the resource management module sends the ciphered and deciphered data message to the forwarding core module; the steps of S1 to S4 are repeatedly executed until the ciphering and deciphering engine determines that multi-layer ciphering and deciphering on the data message is completed. The application greatly reduces the data channel load between the CPU and the chip and the CPU resource occupancy rate.

Description

Technical Field

[0001] This invention relates to the field of network communication technology, and more specifically, to a data packet processing method, a chip, and a forwarding device. Background Technology

[0002] In live networks, the requirements for data security are increasing, and encryption and decryption of data packets have become a basic requirement for data forwarding equipment. Single-layer and even multi-layer encryption of data packets has become a new challenge in the design of data forwarding equipment.

[0003] Since encrypting and decrypting data packets is CPU-intensive, encryption and decryption offloading is a common approach in practical data forwarding devices. This means offloading the encryption and decryption operations to the hardware chip.

[0004] However, the above solution requires the chip to send data packets to the CPU multiple times for encryption / decryption parameter lookup and business plane forwarding operations. This results in multiple occupancy of the data path between the chip and the CPU, which seriously affects the utilization rate of the data path between the chip and the CPU. It also causes unnecessary consumption of the CPU's own resources, thus seriously affecting the performance of the entire data forwarding device. Summary of the Invention

[0005] One of the objectives of this invention is to provide a data packet processing method, chip, and forwarding device, which are used to significantly reduce the data path load between the CPU and the chip and reduce the utilization rate of CPU resources.

[0006] In a first aspect, the present invention provides a data packet processing method applied to a chip in a forwarding device; the chip includes a forwarding core module, an encryption / decryption engine, and a resource management module; a loopback path is formed between the forwarding core module, the resource management module, and the encryption / decryption engine; the method includes: S1: After obtaining a data packet, the forwarding core module searches for encryption / decryption parameters corresponding to the data packet in an encryption / decryption flow table, and sends the data packet and the encryption / decryption parameters to the resource management module; S2: The resource management module sends the data packet and the encryption / decryption parameters to the encryption / decryption engine; S3: The encryption / decryption engine uses the encryption / decryption parameters to encrypt and decrypt the data packet, and sends the encrypted / decrypted data packet to the resource management module; S4: The resource management module sends the encrypted / decrypted data packet to the forwarding core module; S1 to S4 are repeated until the encryption / decryption engine determines that multi-layer encryption / decryption of the data packet has been completed.

[0007] Secondly, the present invention provides a chip applied to a forwarding device, the chip comprising a forwarding core module, an encryption / decryption engine, and a resource management module; the forwarding core module, the resource management module, and the encryption / decryption engine form a loopback path; the forwarding core module is configured to execute S1: after obtaining a data packet, search for the encryption / decryption parameters corresponding to the data packet in the encryption / decryption flow table, and send the data packet and the encryption / decryption parameters to the resource management module; the resource management module is configured to execute S2: send the data packet and the encryption / decryption parameters to the encryption / decryption engine; the encryption / decryption engine is configured to execute S3: encrypt and decrypt the data packet using the encryption / decryption parameters, and send the encrypted / decrypted data packet to the resource management module; the resource management module is configured to execute S4: send the encrypted / decrypted data packet to the forwarding core module; repeating S1 to S4 until the encryption / decryption engine determines that multi-layer encryption / decryption of the data packet has been completed.

[0008] Thirdly, the present invention provides a forwarding device, including a chip and a CPU, wherein the chip and the CPU are communicatively connected; the chip includes a forwarding core module, an encryption / decryption engine, and a resource management module; the forwarding core module, the resource management module, and the encryption / decryption engine form a loopback path, and the chip is used to execute the data packet processing method as described in the first aspect.

[0009] This invention provides a data packet processing method, chip, and forwarding device. Upon receiving a data packet, the forwarding core module within the chip searches for encryption / decryption parameters. Then, the encryption / decryption parameters and the data packet are sent to the encryption / decryption engine via a resource management module. The encryption / decryption engine uses the parameters to encrypt and decrypt the data packet, and then sends the encrypted / decrypted data packet back to the forwarding core module via a loopback path. This process is repeated until multi-layer encryption / decryption is completed. By combining the loopback mechanism of the chip's forwarding core, the encryption / decryption information search, which originally required CPU processing, is significantly offloaded to the hardware chip. This greatly reduces the data path load between the CPU and the chip, and also reduces the utilization rate of CPU resources. Attached Figure Description

[0010] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of the present invention and should not be regarded as a limitation on the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0011] Figure 1 Example diagram of VxLAN message;

[0012] Figure 2 This is a schematic diagram illustrating how a double-encrypted data packet enters a forwarding device for double-decryption and forwarding in the existing technology.

[0013] Figure 3 An architecture diagram of a chip provided for an embodiment of the present invention;

[0014] Figure 4 A schematic flowchart illustrating a data packet processing method provided in an embodiment of the present invention;

[0015] Figure 5 A schematic diagram of a two-layer encryption / decryption method for data packets provided in an embodiment of the present invention;

[0016] Figure 6 This is a structural block diagram of a forwarding device provided in an embodiment of the present invention.

[0017] Icons: 100-Chip; 200-CPU; 300-Forwarding device; 101-Forwarding core module; 102-Encryption / decryption engine; 103-Resource management module; 101-1-Inbound processing engine; 101-2-Outbound processing engine. Detailed Implementation

[0018] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. The components of the embodiments of the present invention described and shown in the accompanying drawings can generally be arranged and designed in various different configurations.

[0019] Therefore, the following detailed description of the embodiments of the invention provided in the accompanying drawings is not intended to limit the scope of the claimed invention, but merely to illustrate selected embodiments of the invention. All other embodiments obtained by those skilled in the art based on the embodiments of the invention without inventive effort are within the scope of protection of the invention.

[0020] It should be noted that similar labels and letters in the following figures indicate similar items. Therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures.

[0021] In the description of this invention, it should be noted that if terms such as "upper," "lower," "inner," or "outer" are used to indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings, or the orientation or positional relationship in which the product of this invention is usually placed, they are only for the convenience of describing this invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation, and therefore should not be construed as a limitation of this invention.

[0022] Furthermore, the terms "first" and "second" are used only to distinguish descriptions and should not be interpreted as indicating or implying relative importance.

[0023] It should be noted that, where there is no conflict, the features in the embodiments of the present invention can be combined with each other.

[0024] Currently, single-layer and even multi-layer encryption of data packets has become a new challenge in the design of data forwarding equipment. Taking Virtual Extensible Local Area Network (VxLAN) services as an example... Figure 1 This is an example diagram of a VxLAN packet. A VxLAN packet requires inner-layer encryption based on the service packet. After the inner-layer encryption is complete, it is forwarded based on the outer-layer packet. Because there are multiple encryption or decryption operations, and each subsequent encryption method depends on the data encrypted or decrypted in the previous operation, these multiple operations are also divided into multiple parts on the timeline.

[0025] Because encrypting and decrypting messages is CPU-intensive, SoC solutions typically employ an off-processing approach, offloading the encryption and decryption operations to the hardware chip. This is a common approach. A typical solution is as follows: Figure 2 As shown, Figure 2 This diagram illustrates a double-encrypted data packet entering a forwarding device for double decryption and forwarding in the existing technology. Simultaneously, after double encryption in the outgoing direction, the packet is sent out from the forwarding device. The specific steps are as follows:

[0026] S01: A double-encrypted message enters the chip, which then sends the message to the CPU. The CPU searches for the outer ciphertext decryption parameters, determines the outer ciphertext decryption parameters, and sends the outer ciphertext decryption parameters to the chip's encryption / decryption engine for decryption of the outer message.

[0027] S02: The chip's encryption and decryption engine decrypts the outer message, and the decrypted message is sent back to the CPU.

[0028] S03: The CPU searches for the inner ciphertext decryption parameters, determines the inner ciphertext decryption parameters, and sends the inner ciphertext decryption parameters to the chip's encryption / decryption engine for inner message decryption;

[0029] S04: The chip's encryption / decryption engine decrypts the inner message and sends the plaintext back to the CPU.

[0030] S05: After the CPU performs business plane forwarding and editing based on the plaintext, it searches for the inner encryption parameters of the outgoing packets, determines the inner packet encryption parameters, and sends them back to the chip's encryption / decryption engine for inner packet encryption.

[0031] S06: The chip's encryption / decryption engine encrypts the inner message and sends the ciphertext to the CPU.

[0032] S07: The CPU performs an outer layer encryption parameter lookup, determines the outer layer message encryption parameters, and sends the message to the chip's encryption / decryption engine.

[0033] S08: The chip's encryption / decryption engine performs outer layer encryption, and the ciphertext is sent out by the chip's forwarding core module.

[0034] From the above Figure 2 As shown in the diagram, a single message in the above scenario needs to be sent to the CPU multiple times (occurring in steps S01, S02, and S04 respectively) for looking up encryption / decryption parameters and forwarding operations on the service plane. This unnecessarily consumes CPU resources and causes multiple occupations of the data path between the chip and the CPU, severely impacting the utilization rate of the data path between the chip and the CPU. Since the CPU's processing performance often determines the forwarding performance of the forwarding device, therefore... Figure 2 The proposed solution also has a severe impact on the performance of the entire forwarding device.

[0035] In view of the multiple occupation of the path resources between the chip and the CPU and the multiple consumption of CPU resources in the above-mentioned solutions, the present invention provides a chip and a data packet processing method based on the chip, which aims to reduce the occupation of the path resources between the chip and the CPU, reduce the consumption of CPU resources, and improve the effective utilization of the CPU.

[0036] Please see Figure 3 , Figure 3This invention provides an architecture diagram of a chip that can be applied in a forwarding device. The chip 100 can communicate with the CPU 200 in the forwarding device. The chip 100 includes a forwarding core module 101, an encryption / decryption engine 102, and a resource management module 103. The forwarding core module 101 may include an inbound processing engine 101-1 and an outbound processing engine 101-2. A loopback path is formed between the forwarding core module 101, the resource management module 103, and the encryption / decryption engine 102. The various functional modules in the chip 100 are described in detail below.

[0037] The forwarding core module 101 includes an inbound processing engine 101-1 and an outbound processing engine 101-2. The inbound processing engine 101-1 mainly performs encryption and decryption parameter lookup on the data packets entering the chip and the data packets looping back through the loopback path. The outbound processing engine 101-2 sends the multi-layer encrypted data packets out of the chip 100.

[0038] The resource management module 103 is mainly responsible for resource scheduling of data packets entering the module and outputting them according to their priority. The data packets entering the resource management module 103 mainly come from the inbound processing engine 101-1 and the encryption / decryption engine 102. The data packets output from the resource management module 103 are sent to the encryption / decryption engine 102, the inbound processing engine 101-1, and the outbound processing engine 101-2.

[0039] The chip encryption / decryption engine 102 is used to encrypt, decrypt, and authenticate the acquired data packets. The chip encryption / decryption engine 102 supports encryption / decryption algorithms including, but not limited to, GCM-AES, GCM-SM4, CBC-AES, and CBC-SM4, and authentication algorithms including, but not limited to, SHA1, SHA256, and SM3.

[0040] From the above chip structure, it can be concluded that in the loopback path, the data packets entering the loopback path mainly come from two directions:

[0041] 1. Data messages enter the chip from the entry point of chip 100.

[0042] 2. Data packets sent from CPU200 to encryption / decryption engine 102.

[0043] Data packets output from the loopback path are sent in two directions:

[0044] 1. The encryption / decryption engine 102 sends the multi-layer decrypted data packets to the CPU 200.

[0045] 2. The resource management module 103 sends the multi-layer decrypted data packets to the outgoing processing engine 101-2.

[0046] In combination with the above Figure 3 The following is a detailed description of the relationships between the various modules in chip 100:

[0047] Path 0: The path between the inbound processing engine 101-1 and the resource management module 103. In this embodiment of the invention, data packets and encryption / decryption parameters are transmitted between the paths. Specifically, the inbound processing engine 101-1 sends packets carrying encryption / decryption parameters and data packet-related information to the resource management module 103 for storage and waiting for scheduling.

[0048] Path 1: The path between the resource management module 103 and the inbound processing engine 101-1. In this embodiment of the invention, the data packets transmitted between the paths have undergone at least one encryption / decryption process.

[0049] Path 2: The path between the resource management module 103 and the outgoing processing engine 101-2. In this embodiment of the invention, the main purpose is to send the multi-layer encrypted data packets out of the forwarding core model 101.

[0050] Path 3: The path between the resource management module 103 and the encryption / decryption engine 102. In this embodiment of the invention, the data packets to be encrypted / decrypted and the encryption / decryption parameters are transmitted.

[0051] Path 4: The path between the encryption / decryption engine 102 and the resource management module 103. In this embodiment of the invention, the transmitted data packets have undergone at least one encryption / decryption process.

[0052] Pathway 5: Bidirectional message passing path between chip 100 and CPU 200.

[0053] Path 6: This is the loopback path provided in the embodiments of the present invention. The embodiments of the present invention use the hardware loopback architecture of chip 100 to realize multi-layer message encryption and decryption, authentication, and single-layer message encryption and decryption before authentication or authentication before encryption.

[0054] The data transfer methods between the above-mentioned channels include, but are not limited to: Direct Memory Access (DMA) data transfer, BUS transfer, etc.

[0055] Based on the aforementioned chip 100, this embodiment of the invention provides a data packet processing method, such as... Figure 4 As shown, Figure 4 A schematic flowchart of the data packet processing method provided in the embodiments of the present invention may include the following steps:

[0056] S1: After the forwarding core module obtains the data packet, it looks up the encryption and decryption parameters corresponding to the data packet in the encryption and decryption flow table, and sends the data packet and encryption and decryption parameters to the resource management module;

[0057] The data packets involved in the embodiments of the present invention are all multi-layered packets, that is, multiple data packets need to be encrypted and decrypted in multiple layers.

[0058] Understandably, in an encryption scenario, the forwarding core module can look up encryption parameters from the encryption flow table based on the data packet information. The encryption flow table is used to maintain encryption parameters, which may include, but are not limited to, encryption type, encryption algorithm, key, and key length. In a decryption scenario, the forwarding core module can look up decryption parameters from the decryption flow table based on the data packet information. The decryption flow table is used to maintain decryption parameters, which may include, but are not limited to, decryption type, decryption algorithm, key, and key length.

[0059] As can be seen from the above loopback path, the data packets obtained by the inbound processing engine may be data packets that have been looped back through the loopback path and have undergone at least one encryption and decryption, or they may be data packets that have entered the chip.

[0060] S2: The resource management module sends data packets and encryption / decryption parameters to the encryption / decryption engine.

[0061] S3: The encryption / decryption engine uses encryption / decryption parameters to encrypt and decrypt data packets, and then sends the encrypted / decrypted data packets to the resource management module.

[0062] Understandably, in an encryption scenario, the encryption / decryption engine receives encryption parameters and then uses them to encrypt the data packet; in a decryption scenario, the encryption / decryption engine receives decryption parameters and then uses them to decrypt the data packet.

[0063] S4: The resource management module sends encrypted and decrypted data packets to the forwarding core module.

[0064] Understandably, after the forwarding core module receives the encrypted and decrypted data packet, it searches for the encryption and decryption parameters again. Then, it sends the searched encryption and decryption parameters and the data packet to the encryption and decryption engine through the resource management module for encryption and decryption. This process is repeated from S1 to S4 until the encryption and decryption engine determines that the data packet has been encrypted and decrypted in multiple layers.

[0065] As can be seen, in the above data packet processing method, upon receiving a data packet, the forwarding core module within the chip searches for encryption / decryption parameters. Then, the encryption / decryption parameters and the data packet are sent to the encryption / decryption engine via the resource management module. The encryption / decryption engine uses the parameters to encrypt / decrypt the data packet and then sends the encrypted / decrypted data packet back to the forwarding core module via a loopback path. This process is repeated until multi-layer encryption / decryption is completed. By combining this with the loopback mechanism of the chip's forwarding core, the encryption / decryption information search, which originally required CPU processing, is significantly offloaded to the hardware chip. This greatly reduces the data path load between the CPU and the chip, and also reduces the utilization rate of CPU resources.

[0066] In combination with the above Figure 3 As can be seen from the chip architecture shown, step S1 is executed by the inbound processing engine of the forwarding core module during the specific implementation process.

[0067] Optionally, the resource management module mainly performs resource scheduling tasks entering the module and outputs them from the output end according to the corresponding priorities. Therefore, in steps S2 and S4, when there are multiple data packets, the resource management module determines the priority of each data packet and sends multiple data packets and encryption / decryption parameters to the encryption / decryption engine according to the priorities.

[0068] During implementation, the resource management module can determine the priority of each data packet based on information such as packet type, packet information, and preset priority strategy.

[0069] Optionally, after the chip completes multi-layer decryption of the data packet, it can also perform the following steps:

[0070] Step a1: The encryption / decryption engine sends the multi-layer decrypted data packet to the CPU, so that the CPU can edit the business information of the data packet to obtain the target data packet, and send the target data packet, the corresponding inner encryption parameters of the target data packet, and the forwarding information down to the encryption / decryption engine.

[0071] Step a2: After receiving the target data packet, the corresponding inner encryption parameters of the target data packet, and the forwarding information, the encryption / decryption engine performs multi-layer encryption on the target data packet.

[0072] In this embodiment of the invention, after the CPU receives the multi-layer decrypted data packet, it performs a packet service plane forwarding lookup to confirm the forwarding exit and execute related packet editing actions to complete the service plane operation and obtain the target data packet. At the same time, it performs a lookup for the inner layer packet encryption parameters based on the service plane to determine the inner layer encryption parameters. Then, it sends the target data packet, the inner layer encryption parameters, and the forwarding information to the encryption / decryption engine. The above information enters the loopback path from the encryption / decryption engine until the multi-layer encryption of the target data packet is completed. Then, the resource management module sends the multi-layer encrypted target data packet to the outgoing processing engine, and the outgoing processing engine sends the multi-layer encrypted target data packet out of the chip.

[0073] During implementation, forwarding information may include, but is not limited to, source IP address, destination IP address, port number, and outgoing interface information. This forwarding information is used by the core forwarding module to look up the encryption parameters corresponding to the target data packet from the encryption flow table during multi-layer encryption.

[0074] Optionally, after the chip completes multi-layer encryption of the data packet, it can also perform the following steps:

[0075] Step b1: The encryption / decryption engine sends the multi-layered encrypted data packets to the resource management module;

[0076] Step b2: The resource management module sends the multi-layered encrypted data packets to the forwarding core module;

[0077] Step b3: The forwarding core module sends the multi-layered encrypted data packets out of the chip.

[0078] Combination Figure 3 During implementation, the resource management module sends multi-layered encrypted data packets to the outgoing processing engine; the forwarding core module sends multi-layered encrypted data packets out of the chip, including: the outgoing processing engine sending multi-layered encrypted data packets out of the chip.

[0079] To better understand the complete implementation process of the above data packet processing method, please refer to [link / reference]. Figure 5 , Figure 5 This is a schematic diagram of a two-layer encryption / decryption method for data packets provided in an embodiment of the present invention. It should be noted that... Figure 5 The resource management module 103 in the chip 100 is omitted, and may include the following steps:

[0080] S11: The forwarding core module parses the data packet, looks up the decryption flow table, obtains the outer packet decryption parameters, and sends the data packet and the outer packet decryption parameters to the encryption / decryption engine.

[0081] S12: The encryption / decryption engine decrypts the data packet according to the outer packet decryption parameters and sends the decrypted data packet to the forwarding core module.

[0082] S13: The forwarding core module searches the decryption flow table, obtains the inner packet decryption flow table lookup, confirms the inner packet decryption parameters, and sends the inner packet decryption parameters to the chip encryption / decryption engine.

[0083] S14: The encryption / decryption engine decrypts the data packet according to the inner message decryption parameters, and then sends the decrypted data packet to the CPU.

[0084] S15: The CPU performs a packet service plane forwarding lookup, confirms the forwarding exit, and executes related packet editing actions to obtain the target data packet. At the same time, it performs a lookup of the inner packet encryption parameters based on the service plane, determines the inner encryption parameters, and sends the target data packet, inner packet encryption parameters, and forwarding information to the encryption / decryption engine.

[0085] S16: The encryption / decryption engine performs inner-layer encryption on the target data packet according to the inner-layer encryption parameters. After completing the inner-layer encryption, the encrypted target data packet forwarding information is sent to the forwarding core module.

[0086] S17: The forwarding core module enters the encryption flow table according to the forwarding information, obtains the encryption parameters of the outer packet, and sends the encryption parameters of the outer packet to the encryption / decryption engine.

[0087] S18: The encryption / decryption engine performs outer layer encryption on the target data packet according to the outer layer encryption parameters. After the outer layer encryption is completed, the target data packet, which is encrypted by both the inner and outer layers, is sent to the forwarding core module. The forwarding core module then sends the target data packet directly out of the chip.

[0088] Will Figure 5 The processing procedure shown is the same as Figure 2 As can be clearly seen from the comparison of the processing procedures shown, the data packet processing method provided in this embodiment of the invention significantly reduces the number of times data is sent to the CPU during the encryption and decryption process of data packets, avoids multiple occupation of the path resources between the chip and the CPU, reduces the consumption of CPU resources, and improves the effective utilization rate of the CPU.

[0089] Optionally, the above method may further include: authenticating multi-layer encrypted and decrypted data packets using a preset authentication algorithm; or, authenticating data packets using a preset authentication algorithm before performing multi-layer encryption and decryption on the data packets.

[0090] In the specific implementation process, the authentication process can be any of the following: inner message encryption / decryption, outer message authentication; inner message authentication, outer message encryption / decryption; inner message authentication, outer message authentication.

[0091] As can be seen from the above embodiments, the data packet processing method provided by the present invention can be applied to the following scenarios: in a forwarding device, the CPU needs to perform inner packet encryption and decryption and outer packet authentication; the CPU needs to perform inner packet authentication and outer packet encryption and decryption; the CPU needs to perform inner packet encryption and decryption and outer packet encryption and decryption; the CPU needs to perform inner packet authentication and outer packet authentication.

[0092] Based on the same inventive concept, the chip 100 provided in this embodiment of the invention includes a resource management module for executing S2: sending a data packet and encryption / decryption parameters to the encryption / decryption engine; the encryption / decryption engine for executing S3: encrypting and decrypting the data packet using the encryption / decryption parameters, and sending the encrypted / decrypted data packet to the resource management module; the resource management module for executing S4: sending the encrypted / decrypted data packet to the forwarding core module; repeating S1 to S4 until the encryption / decryption engine determines that the data packet has completed multi-layer encryption and decryption.

[0093] In an optional implementation, the encryption / decryption engine is further configured to send multi-layer decrypted data packets to the CPU, enabling the CPU to edit the data packets for business information, obtain the target data packet, and then send the target data packet, its corresponding inner encryption parameters, and forwarding information back to the encryption / decryption engine. The encryption / decryption engine is also configured to perform multi-layer encryption on the target data packet upon receiving it, along with the corresponding inner encryption parameters and forwarding information. The forwarding information is used by the forwarding core module to retrieve the corresponding encryption parameters from the encryption flow table during the multi-layer encryption process.

[0094] In an optional implementation, the encryption / decryption engine is also used to send multi-layer encrypted data packets to the resource management module; the resource management module is also used to send multi-layer encrypted data packets to the forwarding core module; and the forwarding core module is also used to send multi-layer encrypted data packets out of the chip.

[0095] In an optional implementation, the resource management module is specifically used to: when there are multiple data packets, determine the priority of each data packet, and send multiple data packets and encryption / decryption parameters to the encryption / decryption engine according to the priority.

[0096] In an optional implementation, the encryption / decryption engine is also used to authenticate multi-layer encrypted / decrypted data packets using a preset authentication algorithm; or, before performing multi-layer encryption / decryption on the data packets, the preset authentication algorithm is used to authenticate the data packets.

[0097] This invention also provides a forwarding device; please refer to [link to relevant documentation]. Figure 6 , Figure 6 The present invention provides a structural block diagram of a forwarding device 300, which includes a chip 100 and a CPU 200. The chip 100 can be used to execute any of the data packet processing methods provided in the present invention.

[0098] The above are merely specific embodiments of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A data packet processing method, characterized in that, A chip used in forwarding devices; the chip includes a forwarding core module, an encryption / decryption engine, and a resource management module; The forwarding core module, resource management module and encryption / decryption engine form a loop path, and the forwarding core module includes an inbound processing engine and an outbound processing engine. The inbound processing engine and the outbound processing engine are respectively communicatively connected to the resource management module; the method includes: S1: After the inbound processing engine obtains the data packet, it looks up the encryption and decryption parameters corresponding to the data packet in the encryption and decryption flow table, and sends the data packet and the encryption and decryption parameters to the resource management module. S2: The resource management module sends the data packet and the encryption / decryption parameters to the encryption / decryption engine; S3: The encryption / decryption engine uses the encryption / decryption parameters to encrypt and decrypt the data packet, and sends the encrypted and decrypted data packet to the resource management module; S4: The resource management module sends the encrypted and decrypted data packet to the forwarding core module; Repeat steps S1 to S4 until the encryption / decryption engine determines that the data packet has been encrypted and decrypted in multiple layers.

2. The method according to claim 1, characterized in that, The forwarding device further includes a CPU, which is communicatively connected to the chip, and the method further includes: The encryption / decryption engine sends the multi-layer decrypted data packet to the CPU, so that the CPU can edit the business information of the data packet to obtain the target data packet, and send the target data packet, the inner encryption parameters corresponding to the target data packet, and the forwarding information down to the encryption / decryption engine. After receiving the target data packet, the inner encryption parameters corresponding to the target data packet, and the forwarding information, the encryption / decryption engine performs multi-layer encryption on the target data packet. The forwarding information is used by the forwarding core module to look up the encryption parameters corresponding to the target data packet from the encryption flow table during the multi-layer encryption process.

3. The method according to claim 1, characterized in that, The method further includes: The encryption / decryption engine sends the multi-layered encrypted data packets to the resource management module; The resource management module sends the multi-layered encrypted data packets to the forwarding core module; The forwarding core module sends the multi-layered encrypted data packet out of the chip.

4. The method according to claim 1, characterized in that, In step S2, the resource management module sends the data packet and the encryption / decryption parameters to the encryption / decryption engine, including: When multiple data packets exist, the priority of each data packet is determined, and the multiple data packets and the encryption / decryption parameters are sent to the encryption / decryption engine according to the priority.

5. The method according to claim 1, characterized in that, The resource management module sends the multi-layered encrypted data packets to the forwarding core module, including: The resource management module sends the multi-layered encrypted data packets to the outgoing processing engine; The forwarding core module sends the multi-layered encrypted data packet out of the chip, including: The outgoing processing engine sends the multi-layered encrypted data packet out of the chip.

6. The method according to claim 1, characterized in that, The method further includes: The data packet is authenticated using a preset authentication algorithm after multi-layer encryption and decryption; or, the data packet is authenticated using a preset authentication algorithm before multi-layer encryption and decryption.

7. A chip, characterized in that, The chip, applied to a forwarding device, includes a forwarding core module, an encryption / decryption engine, and a resource management module; a loopback path is formed between the forwarding core module, the resource management module, and the encryption / decryption engine; the forwarding core module includes an inbound processing engine and an outbound processing engine; the inbound processing engine and the outbound processing engine are respectively communicatively connected to the resource management module; The forwarding core module is used to execute S1: After the inbound processing engine obtains the data packet, it searches for the encryption and decryption parameters corresponding to the data packet in the encryption and decryption flow table, and sends the data packet and the encryption and decryption parameters to the resource management module. The resource management module is used to execute S2: send the data packet and the encryption / decryption parameters to the encryption / decryption engine; The encryption / decryption engine is used to execute S3: encrypting and decrypting the data packet using the encryption / decryption parameters, and sending the encrypted and decrypted data packet to the resource management module; The resource management module is used in S4 to send the encrypted and decrypted data packet to the forwarding core module; Repeat steps S1 to S4 until the encryption / decryption engine determines that the data packet has been encrypted and decrypted in multiple layers.

8. The chip according to claim 7, characterized in that, The forwarding device also includes a CPU, and the CPU is communicatively connected to the chip. The encryption / decryption engine is also used to send the multi-layer decrypted data packet to the CPU, so that the CPU can edit the business information of the data packet to obtain the target data packet, and send the target data packet, the inner encryption parameters corresponding to the target data packet, and the forwarding information down to the encryption / decryption engine; The encryption / decryption engine is also used to perform multi-layer encryption on the target data packet after receiving the target data packet, the inner encryption parameters corresponding to the target data packet, and the forwarding information; the forwarding information is used by the forwarding core module to look up the encryption parameters corresponding to the target data packet from the encryption flow table according to the forwarding information during the multi-layer encryption process.

9. A relay device, characterized in that, The device includes a chip and a CPU, which are communicatively connected; the chip includes a forwarding core module, an encryption / decryption engine, and a resource management module; the forwarding core module, the resource management module, and the encryption / decryption engine form a loopback path; the chip is used to execute the data packet processing method as described in any one of claims 1-6.

Images