Data processing method, device, non-volatile storage medium and computer equipment

Abstract

The present invention discloses a data processing method, device, non-volatile storage medium and computer equipment. The method includes: receiving target data and obtaining network traffic data for transmitting the target data; determining a target processing method according to the network traffic data, and selecting a target security algorithm from a plurality of pre-set security algorithms, wherein the target processing method is encryption or decryption; according to the target processing method, the target data is processed according to the pipeline corresponding to the target security algorithm to obtain a target processing result. The present invention solves the technical problem that the DPU in the related art only implements encryption of a single security algorithm and cannot adapt to the device's requirements for different types of security algorithms.

Description

Technical Field

[0001] The present invention relates to the field of data processing technology, and in particular to a data processing method, device, non-volatile storage medium and computer equipment. Background Art

[0002] The current data processing unit (DPU) of power grid edge computing generally implements separate security algorithm encryption and decryption, which cannot well meet the needs of different types of security algorithms for multiple types of services in the device. Specifically, it cannot well adapt to situations where the device may need to use multiple different types of security algorithms. This limits the application capabilities of the device in different scenarios. Furthermore, due to the lack of support for multiple different types of security algorithms, the DPU has the risk of insufficient security. Certain specific types of attacks may not be effectively dealt with, which poses potential security risks to the device.

[0003] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0004] The embodiments of the present invention provide a data processing method, apparatus, non-volatile storage medium and computer device to at least solve the technical problem in the related art that the DPU only implements a single security algorithm encryption and cannot adapt to the device's requirements for different types of security algorithms.

[0005] According to one aspect of an embodiment of the present invention, there is provided a data processing method, which is applied to a data processing unit DPU, and includes: receiving target data and acquiring network traffic data for transmitting the target data; determining a target processing method based on the network traffic data, and selecting a target security algorithm from a plurality of pre-set security algorithms, wherein the target processing method is encryption or decryption; and processing the target data according to the target processing method and a pipeline corresponding to the target security algorithm to obtain a target processing result.

[0006] Optionally, according to the target processing mode, the target data is processed according to the pipeline corresponding to the target security algorithm to obtain a target processing result, including: determining the execution direction of the pipeline corresponding to the target security algorithm according to the target processing mode; according to the execution direction, sequentially calling multiple target processing modules included in the pipeline corresponding to the target security algorithm to process the target data and obtain the target processing result.

[0007] Optionally, according to the execution direction, multiple target processing modules included in the pipeline corresponding to the target security algorithm are called in sequence to process the target data to obtain a target processing result, including: according to the execution direction, determining the first processing module on the pipeline corresponding to the target security algorithm; calling the first processing module to process the target data to obtain a first processing result; in accordance with the manner of obtaining the first processing result, multiple target processing modules included in the pipeline corresponding to the target security algorithm are called in sequence to iteratively process the target data to obtain a target processing result.

[0008] Optionally, before processing the target data according to the target processing method and the pipeline corresponding to the target security algorithm to obtain the target processing result, it also includes: respectively determining the processing flow of multiple security algorithms; respectively dividing the processing flow of multiple security algorithms into multiple steps to obtain multiple steps of multiple security algorithms; and respectively setting the pipelines of multiple security algorithms according to the multiple steps of multiple security algorithms.

[0009] Optionally, according to the multiple steps of each of the multiple security algorithms, respective pipelines of the multiple security algorithms are respectively set, including: based on the multiple steps of each of the multiple security algorithms, generating multiple modules corresponding one-to-one to the multiple steps of each of the multiple security algorithms, and obtaining a total of multiple pre-selected modules; deleting duplicate modules in the multiple pre-selected modules to obtain multiple processing modules; determining the order in which each of the multiple security algorithms calls the processing modules in the multiple processing modules according to the processing flows of the multiple security algorithms; and according to the order in which each of the multiple security algorithms calls the processing modules in the multiple processing modules, respectively setting the pipelines of the multiple security algorithms.

[0010] Optionally, a target processing method is determined based on network traffic data, and a target security algorithm is selected from multiple pre-set security algorithms, including: determining a sending address of the target data based on the network traffic data; determining a target processing method based on the sending address of the target data; and determining that the security algorithm corresponding to the sending address of the target data is the target security algorithm.

[0011] According to another aspect of an embodiment of the present invention, a data processing device is also provided, including: a receiving module, used to receive target data and obtain network traffic data for transmitting the target data; a determination module, used to determine a target processing method based on the network traffic data, and select a target security algorithm from a plurality of pre-set security algorithms, wherein the target processing method is encryption or decryption; a processing module, used to process the target data according to the target processing method and according to the pipeline corresponding to the target security algorithm to obtain a target processing result.

[0012] According to another aspect of an embodiment of the present invention, a non-volatile storage medium is provided, the non-volatile storage medium including a stored program, wherein when the program is running, the device where the non-volatile storage medium is located is controlled to execute any one of the above data processing methods.

[0013] According to yet another aspect of an embodiment of the present invention, a computer device is provided. The computer device includes a processor, and the processor is used to run a program. When the program is run, any one of the above data processing methods is executed.

[0014] According to yet another aspect of an embodiment of the present invention, a computer program product is provided, including a computer program, and when the computer program is executed by a processor, any one of the above data processing methods is implemented.

[0015] In an embodiment of the present invention, target data is received and network traffic data for transmitting the target data is obtained; a target processing mode is determined based on the network traffic data, and a target security algorithm is selected from a plurality of pre-set security algorithms, wherein the target processing mode is encryption or decryption; according to the target processing mode, the target data is processed according to a pipeline corresponding to the target security algorithm to obtain a target processing result, thereby achieving the purpose of the DPU selecting a corresponding security algorithm to process the target data based on the received target data, thereby achieving the technical effect of satisfying the DPU's requirements for different types of security algorithms, and further solving the technical problem in the related art that the DPU only implements encryption of a single security algorithm and cannot adapt to the device's requirements for different types of security algorithms. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] The drawings described herein are used to provide a further understanding of the present invention and constitute a part of this application. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings:

[0017] Figure 1 A hardware structure block diagram of a computer terminal for implementing a data processing method is shown;

[0018] Figure 2 is a flow chart of a data processing method provided according to an embodiment of the present invention;

[0019] Figure 3 is a schematic diagram of a pipeline of an encryption method provided according to an optional embodiment of the present invention;

[0020] Figure 4 is a schematic diagram of a data processing flow provided according to an optional embodiment of the present invention;

[0021] Figure 5 is a structural block diagram of a data processing device provided according to an optional embodiment of the present invention. DETAILED DESCRIPTION

[0022] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0023] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0024] According to an embodiment of the present invention, a method embodiment of data processing is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0025] The method embodiment provided in the first embodiment of the present application can be executed in a mobile terminal, a computer terminal or a similar computing device. Figure 1 FIG. 1 shows a hardware structure block diagram of a computer terminal for implementing a data processing method. Figure 1 As shown, the computer terminal 10 may include one or more (102a, 102b, ..., 102n are used to illustrate) processors (the processor may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA), a memory 104 for storing data. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of the BUS bus), a network interface, a power supply and / or a camera. It can be understood by those skilled in the art that Figure 1 The structure shown is only for illustration and does not limit the structure of the above electronic device. Figure 1 More or fewer components as shown, or with Figure 1 Different configurations shown.

[0026] It should be noted that the one or more processors and / or other data processing circuits described above may generally be referred to herein as "data processing circuits". The data processing circuits may be embodied in whole or in part as software, hardware, firmware, or any other combination thereof. In addition, the data processing circuit may be a single independent processing module, or may be incorporated in whole or in part into any of the other components in the computer terminal 10. As described in the embodiments of the present application, the data processing circuit acts as a processor control (e.g., selection of a variable resistor terminal path connected to an interface).

[0027] The memory 104 can be used to store software programs and modules of application software, such as program instructions / data storage devices corresponding to the data processing method in the embodiment of the present invention. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory 104, that is, realizing the data processing method of the above-mentioned application program. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 104 may further include a memory remotely arranged relative to the processor, and these remote memories may be connected to the computer terminal 10 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0028] The display may be, for example, a touch screen liquid crystal display (LCD) that enables a user to interact with a user interface of the computer terminal 10 .

[0029] Figure 2 is a flow chart of a data processing method according to an embodiment of the present invention. Figure 2 As shown, the method comprises the following steps:

[0030] Step S202, receiving target data, and acquiring network traffic data for transmitting the target data.

[0031] In this step, the execution subject is the DPU located in the device, which can be an edge device in the power Internet of Things. The DPU can receive data that needs to be processed, that is, target data. The source of the target data can be sensors, user input, or other network devices. When receiving data, the DPU can also monitor and collect network traffic data for transmitting target data, which can specifically include metadata in data transmission, such as sender, receiver, timestamp, and transmission protocol, etc. This information is crucial to determining the security level and processing method of the data.

[0032] Step S204, determining a target processing method according to the network traffic data, and selecting a target security algorithm from a plurality of pre-set security algorithms, wherein the target processing method is encryption or decryption.

[0033] In this step, after collecting the network traffic data, the DPU can analyze the network traffic data to determine the most appropriate data processing method for the target data. For example, decide whether the target data needs to be encrypted to protect privacy and security, or needs to be decrypted for further use or analysis. Once the target processing method (encryption or decryption) is determined, the DPU can select the most appropriate target security algorithm from multiple pre-set security algorithms. Multiple security algorithms can specifically include symmetric encryption, asymmetric encryption, hash algorithms, etc., and each algorithm has its corresponding application scenario.

[0034] Step S206, according to the target processing method and the pipeline corresponding to the target security algorithm, the target data is processed to obtain the target processing result.

[0035] In this step, after selecting the target security algorithm, the DPU can process the target data according to the pre-set operation steps of the target security algorithm, that is, the implementation pipeline of the target security algorithm. The pipeline may include steps such as key generation, data partitioning, encryption / decryption algorithm application, and data integration. Under the guidance of the pre-set pipeline, the DPU actually performs data processing. Depending on whether it is required to encrypt or decrypt, the DPU will apply the selected security algorithm to perform corresponding conversions on the data. After the processing is completed, the DPU will output the processing results. If it is encrypted, the result will be encrypted data, which can be securely stored or transmitted; if it is decrypted, the result will be original data, which can be used for further processing or analysis.

[0036] Through the above steps, the purpose of DPU selecting the corresponding security algorithm to process the target data according to the received target data can be achieved, thereby achieving the technical effect of meeting the DPU's needs for different types of security algorithms, and thus solving the technical problem that the DPU in the related technology only implements a separate security algorithm encryption and cannot adapt to the device's needs for different types of security algorithms. The above method can flexibly determine the most appropriate processing algorithm dynamically based on real-time network traffic data, improve the adaptability of DPU, enable it to better meet the security needs of different types of services, thereby reducing the risk of insufficient security and enhancing the application capabilities of the device in different scenarios.

[0037] As an optional embodiment, according to the target processing method, the target data is processed according to the pipeline corresponding to the target security algorithm to obtain the target processing result, including: determining the execution direction of the pipeline corresponding to the target security algorithm according to the target processing method; according to the execution direction, sequentially calling multiple target processing modules included in the pipeline corresponding to the target security algorithm to process the target data and obtain the target processing result.

[0038] Optionally, after determining the target processing mode, the execution direction of the pipeline can be determined according to the target processing mode. Since the encryption and decryption processes are generally completely opposite processes, when the encryption pipeline is executed in reverse, it is the pipeline of the decryption process. In order to reduce the occupation of memory resources and improve the efficiency of memory application, each security algorithm can only pre-store one pipeline in the DPU and configure the direction of the pipeline. If the direction of the pipeline is the encryption direction, the target processing mode is to execute the pipeline forward when encrypting, and the target processing mode is to execute the pipeline in reverse when decrypting.

[0039] Once the pipeline and the direction of execution of the pipeline are determined, the DPU will execute the various steps in the pipeline in sequence. These steps may include: key generation step: generate keys for the encryption process, or obtain the correct key for the decryption process; data preprocessing step: perform format conversion, segmentation or other necessary preprocessing on the data to adapt to subsequent encryption or decryption operations; encryption / decryption step: apply the selected target security algorithm to encrypt or decrypt the data, such as row shift, column mixing, byte replacement, etc.; data integration step: reintegrate the encrypted or decrypted data to prepare for output or further processing.

[0040] After completing the processing of all pipeline steps, the DPU will output the target processing result. If the target processing method is encryption, the result will be secure data that can be used for secure storage or transmission. If it is decrypted, the result will be original data that can be used for further analysis, processing or use.

[0041] As an optional embodiment, according to the execution direction, multiple target processing modules included in the pipeline corresponding to the target security algorithm are called in sequence to process the target data and obtain the target processing result, including: according to the execution direction, determining the first processing module on the pipeline corresponding to the target security algorithm; calling the first processing module to process the target data and obtain the first processing result; in accordance with the manner of obtaining the first processing result, multiple target processing modules included in the pipeline corresponding to the target security algorithm are called in sequence to iteratively process the target data and obtain the target processing result.

[0042] Optionally, after determining the execution direction of the pipeline, the DPU calls the first module on the pipeline for data processing. After completing the processing of the first module, the DPU will obtain the first processing result, which will be used as input to enter the next processing module on the pipeline. Once the first processing result is obtained, the DPU will continue to execute subsequent modules in the order of the pipeline. Each module receives the output of the previous module as input and further processes it. This process is iterative, and the output of each module is the input of the next module. In this way, data is passed between multiple processing modules, gradually completing the entire encryption or decryption process. After completing the iterative processing of all pipeline modules, the DPU will obtain the final target processing result.

[0043] As an optional embodiment, before processing the target data according to the target processing method and the pipeline corresponding to the target security algorithm to obtain the target processing result, it also includes: respectively determining the processing flow of multiple security algorithms; respectively dividing the processing flow of the multiple security algorithms into multiple steps to obtain multiple steps of the multiple security algorithms; and respectively setting the pipelines of the multiple security algorithms according to the multiple steps of the multiple security algorithms.

[0044] Optionally, before choosing to use a specific security algorithm, the DPU first needs to determine the pipeline corresponding to each security algorithm, and determine the basic working principle and required data processing steps of each security algorithm. After determining the processing flow of each algorithm, the DPU breaks down these processes into specific operation steps. These steps may include key generation, data segmentation, encryption / decryption operations, data integration, etc. Each step is a necessary link in the processing flow to ensure the smooth progress of the entire encryption or decryption process.

[0045] The DPU defines a series of steps for each security algorithm, which together constitute the specific execution process of the algorithm. After determining the steps of each algorithm, the DPU needs to set up a pipeline for each algorithm. A pipeline is a collection of steps arranged in a specific order that work together to complete the entire data processing task. Each pipeline is designed to meet the requirements of the corresponding algorithm, ensuring that data can pass through the correct processing steps at the right time. After completing the above preparations, the DPU can select the appropriate target security algorithm based on the received target data and the determined target processing method (encryption or decryption), and process the data according to the pipeline of the algorithm.

[0046] Figure 3 is a schematic diagram of a pipeline of an encryption method provided according to an optional embodiment of the present invention, such as Figure 3As shown, the AES256 algorithm is taken as an example to show the pipeline architecture used in the present invention. The core of the AES encryption algorithm consists of four operations: byte substitution (SubBytes), row shift (ShiftRows), column mixing (MixColumns) and round key addition (AddRoundKey). The encryption process of AES mainly includes the initial round (Initial Round), multiple main rounds (MainRounds) and the final round (Final Round).

[0047] 1. Key Expansion

[0048] AES uses a fixed-length key (128 bits, 192 bits, or 256 bits) and generates a set of round keys through a key expansion process. These round keys will be used for each round of encryption operations.

[0049] 2. Initial Round

[0050] AddRoundKey: XOR the plaintext with the first round key to generate the initial state.

[0051] 3. Main Rounds

[0052] The main number of AES encryption rounds depends on the key length, which are 10 rounds (128-bit key), 12 rounds (192-bit key) and 14 rounds (256-bit key). Each round consists of the following four steps:

[0053] SubBytes (byte substitution): Use S-box (Substitution Box) to perform nonlinear substitution on each byte in the state matrix.

[0054] ShiftRows: Performs a circular shift operation on each row of the state matrix. Row 0 remains unchanged, row 1 is shifted left by 1 byte, row 2 is shifted left by 2 bytes, and row 3 is shifted left by 3 bytes.

[0055] MixColumns: Treat each column of the state matrix as a polynomial and perform algebraic operations to achieve mixing between bytes. This step is omitted in the last round.

[0056] AddRoundKey: XOR the current state matrix with the round key of this round.

[0057] 4. Final Round

[0058] The final round is similar to the steps of the main round, but omits the MixColumns step and only includes SubBytes, ShiftRows, and AddRoundKey.

[0059] Through the above steps, AES can efficiently and securely encrypt plaintext into ciphertext, and the decryption process is similar to the encryption process, requiring only the reverse operation.

[0060] By splitting the AES encryption process into independent pipelines, certain steps can be processed in parallel, especially steps repeated in multiple rounds (such as byte replacement, row shift, column mixing and round key addition), thereby improving the overall encryption performance. At the same time, this architecture also provides the possibility of finer-grained control and optimization of each encryption step. Pipeline technology is to insert pipeline registers into the logic circuit to shorten the length of the combinational logic path, so as to increase the operating frequency and achieve high throughput. Since the overall delay depends on the longest delay level, in order to optimize the function of the pipeline structure, it is necessary to make the delay time of each level in the pipeline equal. In the present invention, the pipeline structure of the AES algorithm is realized according to the division of key scheduling, initial round, each standard round (each standard round is independent of each other) and final round.

[0061] As an optional embodiment, according to the multiple steps of each of the multiple security algorithms, respective pipelines of the multiple security algorithms are respectively set, including: based on the multiple steps of each of the multiple security algorithms, generating multiple modules corresponding to the multiple steps of each of the multiple security algorithms one by one, and obtaining a total of multiple pre-selected modules; deleting duplicate modules in the multiple pre-selected modules to obtain multiple processing modules; according to the processing flows of the multiple security algorithms, determining the order in which the multiple security algorithms call the processing modules in the multiple processing modules; according to the order in which the multiple security algorithms call the processing modules in the multiple processing modules, respective pipelines of the multiple security algorithms are respectively set.

[0062] Optionally, the DPU needs to create a corresponding module for each step of each security algorithm. These modules are specific implementations of the processing flow, and they are responsible for performing specific tasks in the algorithm, such as key generation, data encryption, data decryption, etc. After determining the steps of multiple security algorithms and generating multiple modules included in each of the multiple security algorithms, and obtaining multiple pre-selected modules, since these pre-selected modules are generated according to the algorithm steps, the same operations may need to be performed in different algorithms. Therefore, multiple pre-selected modules may contain many duplicate modules. In order to optimize the pipeline and reduce resource waste, the DPU can identify and delete duplicate modules. After deleting duplicate modules, the DPU will obtain a streamlined set of multiple processing modules. Multiple processing modules will be used to build pipelines for different algorithms. When building pipelines for different algorithms, modules can be reused.

[0063] Taking the AES256 algorithm and the ChaCha20 algorithm as examples, the design of module sharing in the present invention is demonstrated. The AES256 algorithm and the ChaCha20 algorithm are decomposed into modules respectively, as shown in Table 1. The "round key addition" in the AES256 algorithm implements the XOR of the current round data and the current round key, and the "encryption" in the ChaCha20 algorithm implements the XOR of the generated key stream and the plaintext data. Therefore, these two functional modules can be designed as the same module. By adding the input condition of "data length", the XOR between two sets of data of specified length can be realized, which reduces the number of microservice configuration files and achieves the effect of packaging security algorithms to the greatest extent.

[0064] Table 1 Comparison of AES256 and ChaCha20 functions

[0065]

[0066] Taking the RSA algorithm and the ECC algorithm as examples, the design of module sharing in the present invention is demonstrated. The RSA algorithm and the ECC algorithm are decomposed into modules respectively, as shown in Table 2. The two have similar processes and input and output logic in key generation, and differ only in the generation principle. Therefore, the two functional modules can be designed as the same module. By making the two different key generation methods different partitions in the current module and increasing the input parameters of the partition selection, the module sharing of the two algorithms in key generation can be realized, reducing the number of microservice configuration files and achieving the effect of packaging the security algorithm to the greatest extent.

[0067] Table 2 Functional comparison between RSA algorithm and ECC algorithm

[0068]

[0069] After generating multiple processing modules, the DPU can determine the calling order of these modules according to the specific processing flow of each algorithm. According to the determined calling order, a complete pipeline can be set up for each algorithm. Each pipeline is composed of a series of processing modules that work together in a specific order to complete the task of secure data processing.

[0070] As an optional embodiment, a target processing method is determined based on network traffic data, and a target security algorithm is selected from multiple pre-set security algorithms, including: determining a sending end address for sending target data based on network traffic data; determining a target processing method based on the sending end address of the target data; and determining that the security algorithm corresponding to the sending address of the target data is the target security algorithm.

[0071] Optionally, before processing the target data, it is necessary to first analyze the network traffic data to determine the source of the data. Specifically, this may include identifying the IP address, port number, or other identifier of the sender. Once the source of the data is known, the data processing method can be determined based on the address of the sender. For example, if the sender is a sensor or a user, it may be necessary to send the collected data to the server for processing, and encryption is required during the process to ensure data security; if the sender is a server, it may be necessary to decrypt the instructions sent by the server so that the user or sensor can receive and execute the instructions.

[0072] After determining how the data is processed, you can select a target security algorithm to perform data processing based on the sender address and the target processing method. For example, if the sender address is associated with specific security requirements, you can select a pre-set algorithm that meets these requirements. For example, if the data comes from a known security source, it may require an encryption algorithm with a lower security level and higher encryption efficiency; if the data comes from an untrusted source, it may require an encryption algorithm with a higher security level to ensure the security of the data during transmission. In the DPU, multiple security algorithms can be pre-set to accommodate different security requirements and scenarios.

[0073] As an optional embodiment, Figure 4 is a schematic diagram of a data processing flow according to an optional embodiment of the present invention, such as Figure 4 As shown, the present invention proposes a DPU-based secure transmission architecture that can effectively ensure the secure transmission of data links between devices in new power system scenarios, specifically including an incoming traffic feature detection module in a general processing unit, and an encryption service dynamic adjustment module; the hardware programmable unit includes a microservice encryption module, a key generation management module and a microservice decryption module.

[0074] Microservice encryption / decryption module. In the present invention, the security algorithm is unloaded to the DPU hardware programmable unit, and the security of the communication link is protected by designing a reconfigurable encryption technology on the DPU to implement an efficient data transmission encryption / decryption module. Different encryption / decryption algorithms are decomposed into independent, universal functional modules. Each module can be independently developed and deployed as a microservice, and a unified interface is defined, such as input / output data format, error handling mechanism, etc., to ensure that different microservice modules can exchange data efficiently, achieve effective synchronization between modules, ensure that data is processed in the correct order at each stage, and is dynamically loaded and unloaded when needed; the universal module design enables different security algorithms to achieve resource sharing to the greatest extent, reducing the reconstruction delay when switching algorithms.

[0075] In order to improve the working efficiency of the encryption and decryption module in the DPU hardware programmable unit, the encryption and decryption process is processed through pipeline technology, and the microservice encryption and decryption algorithm is divided into multiple stages with roughly balanced processing time, as independent as possible, and can be executed in parallel, and the algorithm is dynamically loaded according to the divided stages. In the DPU hardware programmable unit, the necessary logical resources and processing units are allocated to each pipeline stage, and parallel pipeline processing is designed. The synchronization and data transmission issues of each pipeline stage are considered in the design. By reasonably allocating resources such as registers, lookup tables, and multipliers, the processing power of each stage is balanced and the resource usage of each module is optimized to avoid resource conflicts and waste. Registers are used as buffers between stages to match the processing rates of different stages.

[0076] Key generation and management module. The key management module uses cryptographic technology to protect digital certificates and key information to ensure the security and integrity of keys and certificates. The key management module consists of multiple execution steps such as key generation, key storage, key exchange, key backup and recovery, which can realize the management of the entire life cycle of the key. The key generation management module of the present invention supports symmetric and asymmetric keys. The physical unclonable function used to generate keys is a hardware security feature that uses the physical irregularities of hardware devices to generate unique responses. The unclonable function is mainly used to generate keys for encryption and authentication operations, and its randomness and unpredictability ensure the high security of the keys. In addition to the unclonable function, this module is also equipped with a high-quality random number generator to ensure that the generated keys have sufficient entropy, that is, randomness, to further enhance security. The distribution of keys is carried out through a secure communication channel, and key access is managed through role-based access control and multi-factor authentication.

[0077] Incoming traffic feature detection module and encryption service dynamic adjustment module. The incoming traffic feature detection module is used to detect incoming traffic and pass the results to the encryption service dynamic adjustment module. Dynamically adjusting the encryption and decryption security algorithms and key management strategies in the DPU is an effective strategy to improve system responsiveness and security. The combination of the two can analyze data traffic in real time and automatically select the most appropriate security algorithm based on specific security threats or traffic patterns.

[0078] The basic principle of DPU hardware acceleration is to perform specific computing tasks through specially designed hardware circuits, thereby improving computing speed and efficiency. Compared with traditional CPUs and GPUs, DPUs have the following significant features: Dedicated hardware architecture: DPUs use dedicated hardware architectures and can efficiently handle specific types of computing tasks, such as network packet processing, storage management, data encryption and decryption, etc.; Software and hardware collaboration: DPUs combine hardware acceleration and software flexibility, can seamlessly connect with CPUs and virtualization software stacks, and provide efficient computing resource management and scheduling; FPGAs are composed of programmable logic units and programmable connection resources, and users can define their hardware behaviors through programming. This programmability enables FPGAs to customize hardware accelerators according to application requirements and improve computing efficiency; DPUs perform specific tasks, such as image processing, encryption and decryption, by implementing specialized hardware accelerators on FPGAs. Such hardware implementations are more efficient than software implementations and can achieve better performance in data processing; DPUs can implement efficient data encryption and decryption algorithms through hardware accelerators to protect the confidentiality and integrity of user data. This is of great significance to fields such as network communication and data storage; Customized hardware accelerator: Collaborative design allows developers to customize hardware accelerators to improve the effect of hardware acceleration according to the requirements of specific tasks.

[0079] The traffic feature detection module can monitor the traffic on the data link in real time and analyze the characteristics of the data packet size, transmission frequency, data type, and source and destination IP addresses. By extracting these useful traffic features and using machine learning models to identify and learn the characteristics of normal and abnormal traffic. The detection results will be transmitted to the encryption service dynamic adjustment module for dynamic reconstruction of security algorithms. This module can not only effectively monitor and analyze network traffic, process and analyze large amounts of data, but also promptly detect and respond to potential security threats. In addition, it also supports the dynamic adjustment of encryption services through analysis results, and adapts to new traffic patterns through continuous updating and training of machine learning models.

[0080] The dynamic adjustment module of encryption service can select the security encryption algorithm adapted to the current environment according to the information obtained by analyzing the characteristics of incoming traffic, adjust the combination and configuration of encryption microservices in the DPU hardware programmable unit, and dynamically reconstruct the security algorithm used. This module implements a decision logic that can select the appropriate security algorithm according to specific traffic characteristics and preset rules, and designs a fast algorithm switching mechanism to ensure that the security algorithm is switched without affecting the system performance. Taking the AES encryption algorithm and the SHA-256 hash algorithm as an example, when high data volume and high transmission rate traffic are detected, the decision logic decides to use the AES algorithm, loads and initializes the AES encryption pipeline module, and the pipeline processes data blocks in parallel, performing key scheduling, initial round, standard round and final round operations; when traffic that needs to verify data integrity is detected, the decision logic decides to use the SHA-256 hash algorithm, loads and initializes the SHA-256 hash pipeline module. In addition, this module is seamlessly integrated with the security algorithm module and communicates with it through a standardized interface.

[0081] It should be noted that, for the above-mentioned method embodiments, for the sake of simplicity, they are all described as a series of action combinations, but those skilled in the art should know that the present invention is not limited by the described action sequence, because according to the present invention, certain steps can be performed in other sequences or simultaneously. Secondly, those skilled in the art should also know that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the present invention.

[0082] Through the description of the above implementation methods, those skilled in the art can clearly understand that the data processing method according to the above embodiment can be implemented by means of software plus a necessary general hardware platform, and of course can also be implemented by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes a number of instructions for a terminal device (which can be a mobile phone, a computer, a server, or a network device, etc.) to execute the methods described in each embodiment of the present invention.

[0083] According to an embodiment of the present invention, a data processing device for implementing the above data processing method is also provided. Figure 5 is a structural block diagram of a data processing device provided according to an embodiment of the present invention, such as Figure 5 As shown, the data processing device includes: a receiving module 52, a determining module 54 and a processing module 56. The data processing device is described below.

[0084] The receiving module 52 is used to receive target data and obtain network traffic data for transmitting the target data.

[0085] The determination module 54 is connected to the receiving module 52 and is used to determine the target processing method according to the network flow data, and select a target security algorithm from a plurality of pre-set security algorithms, wherein the target processing method is encryption or decryption.

[0086] The processing module 56 is connected to the determination module 54, and is used to process the target data according to the target processing mode and the pipeline corresponding to the target security algorithm to obtain the target processing result.

[0087] It should be noted that the receiving module 52, the determining module 54 and the processing module 56 correspond to steps S202 to S206 in the embodiment, and the examples and application scenarios implemented by the multiple modules and the corresponding steps are the same, but are not limited to the contents disclosed in the above embodiment. It should be noted that the above modules, as part of the device, can be run in the computer terminal 10 provided in the embodiment.

[0088] An embodiment of the present invention may provide a computer device. Optionally, in this embodiment, the computer device may be located in at least one network device among multiple network devices of a computer network. The computer device includes a memory and a processor.

[0089] Among them, the memory can be used to store software programs and modules, such as program instructions / modules corresponding to the data processing method and device in the embodiment of the present invention. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory, that is, realizing the above-mentioned data processing method. The memory may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory may further include a memory remotely arranged relative to the processor, and these remote memories may be connected to the computer terminal via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0090] The processor can call the information and application programs stored in the memory through the transmission device to perform the following steps: receive the target data and obtain the network traffic data of the target data; determine the target processing method based on the network traffic data, and select the target security algorithm from multiple pre-set security algorithms, where the target processing method is encryption or decryption; according to the target processing method, process the target data according to the pipeline corresponding to the target security algorithm to obtain the target processing result.

[0091] Optionally, according to the target processing mode, the target data is processed according to the pipeline corresponding to the target security algorithm to obtain a target processing result, including: determining the execution direction of the pipeline corresponding to the target security algorithm according to the target processing mode; according to the execution direction, sequentially calling multiple target processing modules included in the pipeline corresponding to the target security algorithm to process the target data and obtain the target processing result.

[0092] Optionally, according to the execution direction, multiple target processing modules included in the pipeline corresponding to the target security algorithm are called in sequence to process the target data to obtain a target processing result, including: according to the execution direction, determining the first processing module on the pipeline corresponding to the target security algorithm; calling the first processing module to process the target data to obtain a first processing result; in accordance with the manner of obtaining the first processing result, multiple target processing modules included in the pipeline corresponding to the target security algorithm are called in sequence to iteratively process the target data to obtain a target processing result.

[0093] Optionally, before processing the target data according to the target processing method and the pipeline corresponding to the target security algorithm to obtain the target processing result, it also includes: respectively determining the processing flow of multiple security algorithms; respectively dividing the processing flow of multiple security algorithms into multiple steps to obtain multiple steps of multiple security algorithms; and respectively setting the pipelines of multiple security algorithms according to the multiple steps of multiple security algorithms.

[0094] Optionally, according to the multiple steps of each of the multiple security algorithms, respective pipelines of the multiple security algorithms are respectively set, including: based on the multiple steps of each of the multiple security algorithms, generating multiple modules corresponding one-to-one to the multiple steps of each of the multiple security algorithms, and obtaining a total of multiple pre-selected modules; deleting duplicate modules in the multiple pre-selected modules to obtain multiple processing modules; determining the order in which each of the multiple security algorithms calls the processing modules in the multiple processing modules according to the processing flows of the multiple security algorithms; and according to the order in which each of the multiple security algorithms calls the processing modules in the multiple processing modules, respectively setting the pipelines of the multiple security algorithms.

[0095] Optionally, a target processing method is determined based on network traffic data, and a target security algorithm is selected from multiple pre-set security algorithms, including: determining a sending address of the target data based on the network traffic data; determining a target processing method based on the sending address of the target data; and determining that the security algorithm corresponding to the sending address of the target data is the target security algorithm.

[0096] The embodiment of the present invention provides a data processing solution. By receiving target data and obtaining network traffic data for transmitting the target data; determining the target processing method according to the network traffic data, and selecting the target security algorithm from a plurality of pre-set security algorithms, wherein the target processing method is encryption or decryption; processing the target data according to the target processing method and the pipeline corresponding to the target security algorithm to obtain the target processing result, the purpose of the DPU selecting the corresponding security algorithm to process the target data according to the received target data is achieved, thereby achieving the technical effect of meeting the DPU's requirements for different types of security algorithms, and further solving the technical problem in the related art that the DPU only implements encryption of a single security algorithm and cannot adapt to the device's requirements for different types of security algorithms.

[0097] A person of ordinary skill in the art can understand that all or part of the steps in the various methods of the above embodiments can be completed by instructing the hardware related to the terminal device through a program, and the program can be stored in a non-volatile storage medium, and the storage medium may include: a flash drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0098] The embodiment of the present invention further provides a non-volatile storage medium. Optionally, in this embodiment, the non-volatile storage medium can be used to store the program code executed by the data processing method provided by the above embodiment.

[0099] Optionally, in this embodiment, the non-volatile storage medium may be located in any computer terminal in a computer terminal group in a computer network, or in any mobile terminal in a mobile terminal group.

[0100] Optionally, in this embodiment, the non-volatile storage medium is configured to store program code for executing the following steps: receiving target data and obtaining network traffic data for transmitting the target data; determining a target processing method based on the network traffic data, and selecting a target security algorithm from a plurality of pre-set security algorithms, wherein the target processing method is encryption or decryption; and processing the target data according to the target processing method and a pipeline corresponding to the target security algorithm to obtain a target processing result.

[0101] Optionally, according to the target processing mode, the target data is processed according to the pipeline corresponding to the target security algorithm to obtain a target processing result, including: determining the execution direction of the pipeline corresponding to the target security algorithm according to the target processing mode; according to the execution direction, sequentially calling multiple target processing modules included in the pipeline corresponding to the target security algorithm to process the target data and obtain the target processing result.

[0102] Optionally, according to the execution direction, multiple target processing modules included in the pipeline corresponding to the target security algorithm are called in sequence to process the target data to obtain a target processing result, including: according to the execution direction, determining the first processing module on the pipeline corresponding to the target security algorithm; calling the first processing module to process the target data to obtain a first processing result; in accordance with the manner of obtaining the first processing result, multiple target processing modules included in the pipeline corresponding to the target security algorithm are called in sequence to iteratively process the target data to obtain a target processing result.

[0103] Optionally, before processing the target data according to the target processing method and the pipeline corresponding to the target security algorithm to obtain the target processing result, it also includes: respectively determining the processing flow of multiple security algorithms; respectively dividing the processing flow of multiple security algorithms into multiple steps to obtain multiple steps of multiple security algorithms; and respectively setting the pipelines of multiple security algorithms according to the multiple steps of multiple security algorithms.

[0104] Optionally, according to the multiple steps of each of the multiple security algorithms, respective pipelines of the multiple security algorithms are respectively set, including: based on the multiple steps of each of the multiple security algorithms, generating multiple modules corresponding one-to-one to the multiple steps of each of the multiple security algorithms, and obtaining a total of multiple pre-selected modules; deleting duplicate modules in the multiple pre-selected modules to obtain multiple processing modules; determining the order in which each of the multiple security algorithms calls the processing modules in the multiple processing modules according to the processing flows of the multiple security algorithms; and according to the order in which each of the multiple security algorithms calls the processing modules in the multiple processing modules, respectively setting the pipelines of the multiple security algorithms.

[0105] Optionally, a target processing method is determined based on network traffic data, and a target security algorithm is selected from multiple pre-set security algorithms, including: determining a sending address of the target data based on the network traffic data; determining a target processing method based on the sending address of the target data; and determining that the security algorithm corresponding to the sending address of the target data is the target security algorithm.

[0106] An embodiment of the present invention further provides a computer program product, including a computer program, which implements the steps of the data processing method in each embodiment of the present application when the computer program is executed by a processor.

[0107] The serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages or disadvantages of the embodiments.

[0108] In the above embodiments of the present invention, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0109] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the units can be a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0110] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0111] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0112] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a non-volatile storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions to enable a computer device (which can be a personal computer, server or network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, magnetic disk or optical disk and other media that can store program codes.

[0113] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principle of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A data processing method, characterized in that: Applied to data processing unit DPU, including: Receiving target data and acquiring network traffic data for transmitting the target data; Determine a target processing method according to the network traffic data, and select a target security algorithm from a plurality of pre-set security algorithms, wherein the target processing method is encryption or decryption; According to the target processing method, the target data is processed according to the pipeline corresponding to the target security algorithm to obtain a target processing result; Wherein, the step of processing the target data according to the target processing mode and the pipeline corresponding to the target security algorithm to obtain the target processing result includes: determining the execution direction of the pipeline corresponding to the target security algorithm according to the target processing mode; and sequentially calling the plurality of target processing modules included in the pipeline corresponding to the target security algorithm according to the execution direction to process the target data and obtain the target processing result; Wherein, before the target data is processed according to the target processing mode and the pipeline corresponding to the target security algorithm to obtain the target processing result, the method further includes: respectively determining the processing flow of each of the multiple security algorithms; respectively dividing the processing flow of each of the multiple security algorithms into multiple steps to obtain multiple steps of each of the multiple security algorithms; respectively setting the pipelines of each of the multiple security algorithms according to the multiple steps of each of the multiple security algorithms; Wherein, the respective pipelines of the plurality of security algorithms are respectively set according to the respective multiple steps of the plurality of security algorithms, including: based on the respective multiple steps of the plurality of security algorithms, generating a plurality of modules corresponding to the respective multiple steps of the plurality of security algorithms one by one, and obtaining a total of a plurality of pre-selected modules; deleting repeated modules in the plurality of pre-selected modules, and obtaining a plurality of processing modules; determining the order in which the plurality of security algorithms call the processing modules in the plurality of processing modules according to the respective processing flows of the plurality of security algorithms; and respectively setting the respective pipelines of the plurality of security algorithms according to the order in which the plurality of security algorithms call the processing modules in the plurality of processing modules; The step of determining the target processing method according to the network traffic data and selecting a target security algorithm from a plurality of pre-set security algorithms includes: determining the address of a sender for sending the target data according to the network traffic data; determining the target processing method according to the address of a sender for the target data; and determining that the security algorithm corresponding to the sending address of the target data is the target security algorithm; The method further includes: analyzing the size, transmission frequency, data type, and source and target IP addresses of the data packet, and selecting a security encryption algorithm that is adapted to the current environment as the target security algorithm.

2. The method according to claim 1, characterized in that: The method of sequentially calling multiple target processing modules included in the pipeline corresponding to the target security algorithm according to the execution direction, processing the target data, and obtaining the target processing result includes: Determine, according to the execution direction, a first processing module on the pipeline corresponding to the target security algorithm; Calling the first processing module to process the target data to obtain a first processing result; In accordance with the manner of obtaining the first processing result, multiple target processing modules included in the pipeline corresponding to the target security algorithm are called in sequence, the target data is iteratively processed, and the target processing result is obtained.

3. A data processing device, characterized in that: include: A receiving module, used to receive target data and obtain network traffic data for transmitting the target data; A determination module, used to determine a target processing method according to the network traffic data, and select a target security algorithm from a plurality of pre-set security algorithms, wherein the target processing method is encryption or decryption; A processing module, used to process the target data according to the target processing mode and the pipeline corresponding to the target security algorithm to obtain a target processing result; The processing module is further used to: determine the execution direction of the pipeline corresponding to the target security algorithm according to the target processing mode; and sequentially call multiple target processing modules included in the pipeline corresponding to the target security algorithm according to the execution direction to process the target data and obtain the target processing result; The processing module is further used to: respectively determine the processing flow of each of the multiple security algorithms; respectively divide the processing flow of each of the multiple security algorithms into multiple steps to obtain multiple steps of each of the multiple security algorithms; and respectively set the pipelines of each of the multiple security algorithms according to the multiple steps of each of the multiple security algorithms; The processing module is further used to: generate multiple modules corresponding to the multiple steps of each of the multiple security algorithms based on the multiple steps of each of the multiple security algorithms, and obtain a total of multiple pre-selected modules; delete duplicate modules in the multiple pre-selected modules to obtain multiple processing modules; determine the order in which each of the multiple security algorithms calls the processing modules in the multiple processing modules according to the processing flows of each of the multiple security algorithms; and set the pipelines of each of the multiple security algorithms according to the order in which each of the multiple security algorithms calls the processing modules in the multiple processing modules; The determination module is further used to: determine the sender address of the target data according to the network traffic data; determine the target processing method according to the sender address of the target data; determine the security algorithm corresponding to the sender address of the target data as the target security algorithm; The determination module is further used to analyze the size, transmission frequency, data type, and source and target IP addresses of the data packet, and select a security encryption algorithm that is compatible with the current environment as the target security algorithm.

4. A non-volatile storage medium, characterized in that: The non-volatile storage medium includes a stored program, wherein when the program is executed, the device where the non-volatile storage medium is located is controlled to execute the data processing method according to any one of claims 1 to 2.

5. A computer device, characterized in that: include: Memory and processor, The memory stores a computer program; The processor is used to execute the computer program stored in the memory, and when the computer program is run, the processor executes the data processing method according to any one of claims 1 to 2.

6. A computer program product comprising computer instructions, characterized in that: The computer instructions are executed by a processor to execute the data processing method according to any one of claims 1 to 2.

Images