Method and device for encryption and decryption of SDP gateway traffic data packets

Abstract

The present invention relates to a method and device for encrypting and decrypting SDP gateway traffic data packets. It includes: constructing an SDP gateway architecture, the gateway architecture includes a pipeline mode and an RTC mode; wherein the pipeline mode is used to concurrently encrypt and decrypt data packets received by multiple data plane processes in the gateway architecture when the traffic is high, and write the processed data packets back to the corresponding data plane processes; the RTC mode is used to perform single-threaded encryption and decryption processing on data packets received by each data plane process in the gateway architecture when the traffic is low; obtaining the real-time traffic of the SDP gateway; switching the gateway architecture between the pipeline mode and the RTC mode based on the real-time traffic. The present application can be applicable to both high-speed traffic and low-speed traffic, while ensuring processing efficiency, saving computing resources and energy consumption.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of deep learning technology, and in particular to a method and device for encrypting and decrypting SDP gateway traffic data packets. Background Art

[0002] Based on the zero-trust architecture of SDP (Software Defined Perimeter), the access traffic data packets need to be encrypted and decrypted through VPN (virtual private network) technology between the SDP client and the SDP gateway.

[0003] At present, under the high-speed data plane processing architecture based on DPDK (Intel Data Plane Development Kit), many gateway architectures are implemented using the RTC (run to completed) mode, which has the advantages of saving computing resources and low energy consumption at low-speed traffic. However, at high-speed traffic, since about 30-60% of the computing resources are consumed in the encryption and decryption of the accessed traffic data packets, the processing efficiency is seriously affected and it is easy to cause gateway jams.

[0004] Therefore, there is an urgent need for an encryption and decryption processing method and device for SDP gateway traffic data packets. Summary of the invention

[0005] The embodiment of the present invention provides a method and device for encrypting and decrypting SDP gateway traffic data packets, which can be applicable to both high-speed traffic and low-speed traffic needs, while ensuring processing efficiency and saving computing resources and energy consumption.

[0006] On the one hand, an embodiment of the present invention provides a method for encrypting and decrypting a SDP gateway traffic data packet, comprising:

[0007] Construct an SDP gateway architecture, which includes a pipeline mode and an RTC mode; wherein the pipeline mode is used to concurrently encrypt and decrypt data packets received by multiple data plane processes in the gateway architecture when the traffic is high, and write the processed data packets back to the corresponding data plane processes; the RTC mode is used to perform single-threaded encryption and decryption processing on data packets received by each data plane process in the gateway architecture when the traffic is low;

[0008] Obtaining real-time traffic of the SDP gateway;

[0009] The gateway architecture is switched between the pipeline mode and the RTC mode based on the real-time traffic.

[0010] On the other hand, a device for encrypting and decrypting a SDP gateway traffic data packet is provided, comprising:

[0011] A construction unit is used to construct an SDP gateway architecture, wherein the gateway architecture includes a pipeline mode and an RTC mode; wherein the pipeline mode is used to concurrently encrypt and decrypt data packets received by multiple data plane processes in the gateway architecture when the traffic is high, and write the processed data packets back to the corresponding data plane processes; and the RTC mode is used to perform single-threaded encryption and decryption processing on data packets received by each data plane process in the gateway architecture when the traffic is low;

[0012] An acquisition unit, used to acquire the real-time traffic of the SDP gateway;

[0013] A switching unit is used to switch the gateway architecture between the pipeline mode and the RTC mode based on the real-time traffic.

[0014] On the other hand, a computing device is provided, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the method described in any embodiment of the present specification is implemented.

[0015] On the other hand, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed in a computer, the computer is caused to execute the method described in any embodiment of the present specification.

[0016] On the other hand, a computer program product is provided, comprising a computer program, wherein the computer program implements the steps of the above method when executed by a processor.

[0017] The embodiment of the present invention provides a method and device for encrypting and decrypting SDP gateway traffic data packets. By constructing a gateway architecture with two modes, it is possible to switch between the two modes according to the real-time traffic of the SDP gateway. For example, in the case of high-speed traffic, the pipeline mode is used to concurrently encrypt and decrypt data packets received by multiple data plane processes, thereby improving the encryption and decryption speed, ensuring that encryption and decryption no longer serves as a bottleneck in the overall packet processing flow, and improving the data processing speed. In the case of low-speed traffic, the RTC mode is used to encrypt and decrypt data packets, which can save computing resources and energy consumption. It can be seen that the present application can be applicable to both high-speed traffic and low-speed traffic needs, while ensuring processing efficiency, saving computing resources and energy consumption. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0019] Figure 1 It is a flow chart of a method for encrypting and decrypting a SDP gateway traffic data packet provided by an embodiment of the present invention;

[0020] Figure 2 is a hardware architecture diagram of an electronic device provided by an embodiment of the present invention;

[0021] Figure 3 It is a structural diagram of an encryption and decryption processing device for SDP gateway traffic data packets provided by an embodiment of the present invention;

[0022] Figure 4 It is an overall schematic diagram of the SDP gateway architecture provided by an embodiment of the present invention;

[0023] Figure 5 It is a structural diagram of an SDP gateway architecture in pipeline mode provided by an embodiment of the present invention;

[0024] Figure 6 It is a structural diagram of the SDP gateway architecture in PTC mode provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0025] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0026] The specific implementation of the above concept is described below.

[0027] Please refer to Figure 1 The embodiment of the present invention provides a method for encrypting and decrypting a SDP gateway traffic data packet, the method comprising:

[0028] Step 100, construct an SDP gateway architecture, which includes a pipeline mode and an RTC mode; wherein the pipeline mode is used to concurrently encrypt and decrypt data packets received by multiple data plane processes in the gateway architecture when the traffic is high, and write the processed data packets back to the corresponding data plane processes; the RTC mode is used to perform single-threaded encryption and decryption processing on data packets received by each data plane process in the gateway architecture when the traffic is low;

[0029] Step 102, obtaining the real-time traffic of the SDP gateway;

[0030] Step 104 , switching the gateway architecture between pipeline mode and RTC mode based on real-time traffic.

[0031] In an embodiment of the present invention, by constructing a gateway architecture with two modes, it is possible to switch between the two modes according to the real-time traffic of the SDP gateway. For example, in high-speed traffic, the pipeline mode is used to concurrently encrypt and decrypt data packets received by multiple data plane processes, thereby improving the encryption and decryption speed, ensuring that encryption and decryption are no longer a bottleneck in the overall packet processing flow, and improving the data processing speed. In low-speed traffic, the RTC mode is used to encrypt and decrypt data packets, which can save computing resources and energy consumption. It can be seen that the present application can be applicable to both high-speed traffic and low-speed traffic, while ensuring processing efficiency, saving computing resources and energy consumption.

[0032] Described below Figure 1 How the various steps are performed.

[0033] Regarding step 100: constructing the SDP gateway architecture, the gateway architecture includes a pipeline mode and an RTC mode.

[0034] like Figure 4 The figure shows the overall schematic diagram of the SDP gateway architecture. As can be seen from the figure, the gateway architecture includes multiple data plane processes, pipeline processing shared memory queues corresponding to each data plane process, encryption and decryption shared memory queues, and pipeline processes. In the figure, a data plane process is a worker process, in which the worker0 process is the parent process, and the parent process is used to control the creation and destruction of the pipeline process and other data plane processes (worker1~workern).

[0035] like Figure 5 As shown in the figure, it is a schematic diagram of the structure of the gateway architecture in pipeline mode. It can be seen from the figure that each data plane process includes a packet receiving module and multiple business processing modules;

[0036] The pipeline mode concurrently encrypts and decrypts data packets received by multiple data plane processes in the following way:

[0037] The data packets received by each data plane process are written into the encryption and decryption shared memory queue through shared memory; the pipeline process creates a packet retrieval thread and multiple encryption and decryption threads in the form of a task thread pool; the packet retrieval thread is used to distribute the data packets in the encryption and decryption shared memory queue to each encryption and decryption thread, and each encryption and decryption thread encrypts and decrypts its own data packets respectively, and writes the encrypted and decrypted data packets back to the pipeline processing shared memory queue corresponding to the corresponding data plane process according to the context information in the data packet message.

[0038] In this embodiment, the number of data plane processes can be reduced by adopting pipeline processes, thereby releasing redundant cores. The independent cores are used for packet fetching and encryption and decryption. The packet fetching thread and the encryption and decryption thread are separately bound to the core and independently use the computing core resources to cyclically process the data packets in the task queue (complete data encryption and decryption and verification and other operations). According to actual measurements, when the number of data plane processes exceeds 8, the use of RTC mode will cause a sharp drop in computing performance, and the gateway architecture needs to be switched to pipeline mode. In pipeline mode, although the packet fetching thread and the encryption and decryption thread may require 17 cores, the number of cores for receiving packets can be reduced to 2 to 4 (including the parent process). In addition, since the packet fetching thread and the encryption and decryption thread can share the global variables in the encryption and decryption shared memory queue, the encryption and decryption speed of the data packet can be greatly improved, thereby effectively ensuring that encryption and decryption are no longer a bottleneck in the overall packet processing flow.

[0039] like Figure 6 As shown in FIG. 1 , it is a schematic diagram of the structure of the gateway architecture in the PTC mode. As can be seen from the figure, each data plane process includes a packet receiving module, an encryption and decryption module and multiple business processing modules.

[0040] In RTC mode, for each data plane process, execute the following:

[0041] The encryption and decryption module of the data plane process is used to encrypt and decrypt the received data packets, and the encrypted and decrypted data packets are sent to the subsequent business processing module.

[0042] In this embodiment, when the real-time traffic is low, the single-thread mode is used for encryption and decryption processing. According to actual measurements, in the RTC mode, when the number of data plane processes is within 8, the computing performance is good and the occupied resources are also less.

[0043] like Figure 4 As shown, in some embodiments, each data plane process further includes a monitoring module, which is arranged downstream of the packet receiving module;

[0044] The monitoring module is used to monitor the real-time flow of data packets received by the packet receiving module.

[0045] In addition, each data plane process also includes a protocol stack module;

[0046] In RTC mode, the protocol stack module is set between the packet receiving module and the encryption and decryption module;

[0047] In pipeline mode, the protocol stack module is set between the packet receiving module and the encryption and decryption shared memory queue.

[0048] In this embodiment, the protocol stack module is the protocol stack L2 / 3 / 4 layer, and encryption and decryption processing is performed after completing the operation.

[0049] In some implementations, switching the gateway architecture between pipeline mode and RTC mode based on real-time traffic includes:

[0050] If the real-time traffic is greater than the preset value and the current gateway architecture is in RTC mode, a pipeline process is created based on the parent process, and it is determined whether the current session flow has been processed; if so, the current gateway architecture is switched from RTC mode to pipeline mode, and redundant data plane processes are destroyed based on the parent process; if not, the current session flow is continued to be processed in RTC mode until the current session flow is processed, and the current gateway architecture is switched from RTC mode to pipeline mode, and redundant data plane processes are destroyed based on the parent process;

[0051] If the real-time traffic is not greater than the preset value for a continuous preset time and the current gateway architecture is in pipeline mode, determine whether the current session flow has been processed; if so, switch the current gateway architecture from pipeline mode to RTC mode, and destroy the pipeline process based on the parent process, and build insufficient data plane processes; if not, continue to process the current session flow in pipeline mode until the current session flow is processed, switch the current gateway architecture from pipeline mode to RTC mode, destroy the pipeline process based on the parent process, and build insufficient data plane processes.

[0052] In this embodiment, by adopting the above-mentioned mode switching method, on the one hand, the gateway can be kept flowing, that is, before and after the mode switching, the same session flow will continue the previous processing mode until the session is terminated. On the other hand, using the pipeline mode at high-speed traffic can increase the processing speed. Switching to the RTC mode at low speed can save some computing resources for the application scenario of the gateway business on the cloud platform; for the application scenario of directly deploying the hardware server, part of the computing resources can be put into hibernation, saving energy consumption to a certain extent.

[0053] In other words, through mode switching, it is possible to solve the business scenario requirements of high-speed traffic processing as well as the business scenario requirements of low-speed traffic processing.

[0054] It should also be noted that users can also determine the processing mode of the gateway architecture according to the trough period of the SDP gateway. For example, in the midnight to early morning period (12:00 am to 6:00 am), the processing throughput of the entire gateway is low, even 1 to 2 values ​​lower than the peak value (from the peak value of 10G to a few hundred M below 1G), then the gateway architecture is switched from pipeline mode to RTC mode, and vice versa, the gateway architecture is switched from RTC mode to pipeline mode. Of course, users can also determine the switching criteria of the mode according to other methods, and this application does not make specific limitations.

[0055] like Figure 2 , Figure 3 As shown, an embodiment of the present invention provides an encryption and decryption processing device for SDP gateway traffic data packets. The device embodiment can be implemented by software, or by hardware or a combination of software and hardware. From the hardware level, Figure 2 As shown, a hardware architecture diagram of a computing device where an encryption and decryption processing device for an SDP gateway traffic data packet provided by an embodiment of the present invention is located, except Figure 2 In addition to the processor, memory, network interface, and non-volatile memory shown in the figure, the computing device in which the device is located in the embodiment may also generally include other hardware, such as a forwarding chip responsible for processing messages, etc. Taking software implementation as an example, Figure 3 As shown, as a device in a logical sense, the CPU of the computing device in which it is located reads the corresponding computer program in the non-volatile memory into the internal memory and runs it.

[0056] like Figure 3 As shown, the present embodiment provides an encryption and decryption processing device for an SDP gateway traffic data packet, comprising:

[0057] The construction unit 300 is used to construct an SDP gateway architecture, which includes a pipeline mode and an RTC mode; wherein the pipeline mode is used to concurrently encrypt and decrypt data packets received by multiple data plane processes in the gateway architecture when the traffic is high, and write the processed data packets back to the corresponding data plane processes; the RTC mode is used to perform single-threaded encryption and decryption processing on data packets received by each data plane process in the gateway architecture when the traffic is low;

[0058] The acquisition unit 302 is used to acquire the real-time traffic of the SDP gateway;

[0059] The switching unit 304 is used to switch the gateway architecture between the pipeline mode and the RTC mode based on the real-time traffic.

[0060] In some embodiments, the gateway architecture includes a plurality of data plane processes, a pipeline processing shared memory queue corresponding to each data plane process, an encryption and decryption shared memory queue, and a pipeline process;

[0061] In pipeline mode, each data plane process includes a packet receiving module and multiple business processing modules; pipeline mode concurrently encrypts and decrypts data packets received by multiple data plane processes in the following way:

[0062] The data packets received by each data plane process are written into the encryption and decryption shared memory queue through shared memory; the pipeline process creates a packet retrieval thread and multiple encryption and decryption threads in the form of a task thread pool; the packet retrieval thread is used to distribute the data packets in the encryption and decryption shared memory queue to each encryption and decryption thread, and each encryption and decryption thread encrypts and decrypts its own data packets respectively, and writes the encrypted and decrypted data packets back to the pipeline processing shared memory queue corresponding to the corresponding data plane process according to the context information in the data packet message.

[0063] In some implementations, in RTC mode, each data plane process includes a packet receiving module, an encryption and decryption module, and a plurality of service processing modules;

[0064] In the RTC mode, for each data plane process, the following are respectively performed: using the encryption and decryption module of the data plane process to encrypt and decrypt the data packets received by it, and sending the encrypted and decrypted data packets to the subsequent business processing module.

[0065] In some embodiments, each data plane process further includes a monitoring module, which is disposed downstream of the packet receiving module;

[0066] The monitoring module is used to monitor the real-time flow of data packets received by the packet receiving module.

[0067] In some implementations, the multiple data plane processes of the gateway architecture include a parent process, and the parent process is used to control the creation and destruction of the pipeline process and other data plane processes.

[0068] In some implementations, the switching unit 304 is configured to perform the following operations:

[0069] If the real-time traffic is greater than the preset value and the current gateway architecture is in RTC mode, a pipeline process is created based on the parent process, and it is determined whether the current session flow has been processed; if so, the current gateway architecture is switched from RTC mode to pipeline mode, and redundant data plane processes are destroyed based on the parent process; if not, the current session flow is continued to be processed in RTC mode until the current session flow is processed, and the current gateway architecture is switched from RTC mode to pipeline mode, and redundant data plane processes are destroyed based on the parent process;

[0070] If the real-time traffic is not greater than the preset value for a continuous preset time and the current gateway architecture is in pipeline mode, determine whether the current session flow has been processed; if so, switch the current gateway architecture from pipeline mode to RTC mode, and destroy the pipeline process based on the parent process, and build insufficient data plane processes; if not, continue to process the current session flow in pipeline mode until the current session flow is processed, switch the current gateway architecture from pipeline mode to RTC mode, destroy the pipeline process based on the parent process, and build insufficient data plane processes.

[0071] It is understandable that the structure illustrated in the embodiment of the present invention does not constitute a specific limitation on an encryption and decryption processing device for an SDP gateway traffic data packet. In other embodiments of the present invention, an encryption and decryption processing device for an SDP gateway traffic data packet may include more or fewer components than shown in the figure, or combine certain components, or split certain components, or arrange the components differently. The components shown in the figure may be implemented in hardware, software, or a combination of software and hardware.

[0072] The information interaction, execution process and other contents between the units in the above-mentioned device are based on the same concept as the embodiment of the method of the present invention. For specific contents, please refer to the description in the embodiment of the method of the present invention, and no further description is given here.

[0073] An embodiment of the present application also provides a computing device, including a memory and a processor, wherein a computer program is stored in the memory, and when the processor executes the computer program, an encryption and decryption processing method for an SDP gateway traffic data packet in any embodiment of the present invention is implemented.

[0074] An embodiment of the present application also provides a computer-readable storage medium, on which is stored at least one instruction, at least one program, code set or instruction set, and the at least one instruction, at least one program, code set or instruction set is loaded and executed by a processor to implement the encryption and decryption processing method of the SDP gateway traffic data packet provided in the above-mentioned method embodiments.

[0075] An embodiment of the present application also provides a computer program product, which includes a computer program. A processor of a computer device reads the computer program from a computer-readable storage medium, and the processor executes the computer program, so that the computer device executes the encryption and decryption processing method of the SDP gateway traffic data packet described in any of the above embodiments.

[0076] For the convenience of description, the above system or device is described by dividing it into various modules or units according to its functions. Of course, when implementing the present application, the functions of each unit can be implemented in the same or multiple software and / or hardware.

[0077] It can be known from the description of the above implementation methods that those skilled in the art can clearly understand that the present application can be implemented by means of software plus a necessary general hardware platform. Based on such an understanding, the technical solution of the present application can be essentially or partly contributed to the prior art in the form of a software product, which can be stored in a storage medium such as ROM / RAM, a magnetic disk, an optical disk, etc., and includes several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in the various embodiments of the present application or certain parts of the embodiments.

[0078] Finally, it should be noted that, in this article, relational terms such as first, second, third and fourth are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the statement "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0079] The above is only a preferred implementation of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A method for encrypting and decrypting SDP gateway traffic data packets, characterized in that: include: Construct an SDP gateway architecture, which includes a pipeline mode and an RTC mode; wherein the pipeline mode is used to concurrently encrypt and decrypt data packets received by multiple data plane processes in the gateway architecture when the traffic is high, and write the processed data packets back to the corresponding data plane processes; the RTC mode is used to perform single-threaded encryption and decryption processing on data packets received by each data plane process in the gateway architecture when the traffic is low; Obtaining real-time traffic of the SDP gateway; Switching the gateway architecture between the pipeline mode and the RTC mode based on the real-time traffic; The gateway architecture includes a plurality of the data plane processes, a pipeline processing shared memory queue, an encryption and decryption shared memory queue and a pipeline process respectively corresponding to each of the data plane processes; In the pipeline mode, each of the data plane processes includes a packet receiving module and multiple service processing modules; the pipeline mode performs concurrent encryption and decryption processing on data packets received by multiple data plane processes in the following manner: The data packets received by each data plane process are written into the encryption and decryption shared memory queue through shared memory; the pipeline process creates a packet fetching thread and multiple encryption and decryption threads in the form of a task thread pool; the packet fetching thread is used to distribute the data packets in the encryption and decryption shared memory queue to each encryption and decryption thread, and each encryption and decryption thread performs encryption and decryption processing on its own data packet, and writes the encrypted and decrypted data packet back to the pipeline processing shared memory queue corresponding to the corresponding data plane process according to the context information in the data packet message; In the RTC mode, each of the data plane processes includes a packet receiving module, an encryption and decryption module and a plurality of service processing modules; In the RTC mode, for each data plane process, the following are respectively performed: using the encryption and decryption module of the data plane process to encrypt and decrypt the data packets received by it, and sending the encrypted and decrypted data packets to the subsequent service processing module.

2. The method according to claim 1, characterized in that Each of the data plane processes further includes a monitoring module, which is arranged downstream of the packet receiving module; The monitoring module is used to monitor the real-time flow of the data packets received by the packet receiving module.

3. The method according to claim 1, characterized in that The multiple data plane processes of the gateway architecture include a parent process, and the parent process is used to control the creation and destruction of the pipeline process and other data plane processes.

4. The method according to claim 3, characterized in that The switching of the gateway architecture between the pipeline mode and the RTC mode based on the real-time traffic includes: If the real-time traffic is greater than the preset value and the current gateway architecture is in RTC mode, the pipeline process is created based on the parent process, and it is determined whether the current session flow has been processed; if so, the current gateway architecture is switched from RTC mode to pipeline mode, and redundant data plane processes are destroyed based on the parent process; if not, the current session flow is continued to be processed in RTC mode until the current session flow is processed, and the current gateway architecture is switched from RTC mode to pipeline mode, and redundant data plane processes are destroyed based on the parent process; If the real-time traffic is not greater than the preset value for a continuous preset time and the current gateway architecture is in pipeline mode, it is determined whether the current session flow has been processed; if so, the current gateway architecture is switched from pipeline mode to RTC mode, and the pipeline process is destroyed based on the parent process, and the insufficient data plane process is constructed; if not, the current session flow is continued to be processed in pipeline mode until the current session flow is processed, and the current gateway architecture is switched from pipeline mode to RTC mode, and the pipeline process is destroyed based on the parent process, and the insufficient data plane process is constructed.

5. The method according to claim 1, characterized in that: Each of the data plane processes also includes a protocol stack module; In the RTC mode, the protocol stack module is arranged between the packet receiving module and the encryption and decryption module; In the pipeline mode, the protocol stack module is arranged between the packet receiving module and the encryption and decryption shared memory queue.

6. An encryption and decryption processing device for SDP gateway traffic data packets, characterized in that: include: A construction unit is used to construct an SDP gateway architecture, wherein the gateway architecture includes a pipeline mode and an RTC mode; wherein the pipeline mode is used to concurrently encrypt and decrypt data packets received by multiple data plane processes in the gateway architecture when the traffic is high, and write the processed data packets back to the corresponding data plane processes; and the RTC mode is used to perform single-threaded encryption and decryption processing on data packets received by each data plane process in the gateway architecture when the traffic is low; An acquisition unit, used to acquire the real-time traffic of the SDP gateway; A switching unit, configured to switch the gateway architecture between the pipeline mode and the RTC mode based on the real-time traffic; The gateway architecture includes a plurality of the data plane processes, a pipeline processing shared memory queue, an encryption and decryption shared memory queue and a pipeline process respectively corresponding to each of the data plane processes; In the pipeline mode, each of the data plane processes includes a packet receiving module and multiple service processing modules; the pipeline mode performs concurrent encryption and decryption processing on data packets received by multiple data plane processes in the following manner: The data packets received by each data plane process are written into the encryption and decryption shared memory queue through shared memory; the pipeline process creates a packet fetching thread and multiple encryption and decryption threads in the form of a task thread pool; the packet fetching thread is used to distribute the data packets in the encryption and decryption shared memory queue to each encryption and decryption thread, and each encryption and decryption thread performs encryption and decryption processing on its own data packet, and writes the encrypted and decrypted data packet back to the pipeline processing shared memory queue corresponding to the corresponding data plane process according to the context information in the data packet message; In the RTC mode, each of the data plane processes includes a packet receiving module, an encryption and decryption module and a plurality of service processing modules; In the RTC mode, for each data plane process, the following are respectively performed: using the encryption and decryption module of the data plane process to encrypt and decrypt the data packets received by it, and sending the encrypted and decrypted data packets to the subsequent service processing module.

7. A computing device, comprising a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the method according to any one of claims 1 to 5 is implemented.

8. A computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to execute the method according to any one of claims 1 to 5.

Images