Method, computer equipment and medium for transport layer security service offloading

Abstract

The present application relates to the field of computer technology, and in particular to a method, computer device and medium for transport layer security service unloading. The method includes: establishing a first transport layer security service channel and a second transport layer security service channel between the software side of the host machine and the hardware side connected to the host machine; in response to the establishment of the first transport layer security session, determining the matching result of the first transport layer security session based on the associated bandwidth demand, and then unloading the transport layer security service associated with the first transport layer security session to the hardware side based on the matching result; after being unloaded and before the session ends, sending the associated transport layer security record according to the first sending method or the second sending method based on the matching result. In this way, it is helpful to take into account the data specification requirements of high-specification transport layer security sessions and maintain high transport layer security session processing performance at the same time.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a method, computer equipment and medium for transport layer security service unloading. Background Art

[0002] With the development of technology applications such as artificial intelligence, big data, and cloud services, the demand for high-specification and high-performance Transport Layer Security (TLS) sessions has also increased rapidly. The TLS protocol consists of two layers of protocols. The bottom layer is the TLS record protocol, which is used to encrypt messages using passwords. The upper layer is the handshake protocol, which is used for handshakes between two parties, changes in password specifications, and application data. Offloading TLS services to dedicated hardware such as smart network cards helps maintain high performance, but as the data specifications of TLS sessions, that is, the number of records included in TLS sessions, increase, a large amount of resources are required, thereby squeezing out limited hardware resources.

[0003] To this end, the present application provides a method, computer device and medium for transport layer security service offloading, while taking into account the data specification requirements of high-specification transport layer security sessions and maintaining high transport layer security session processing performance. Summary of the invention

[0004] In a first aspect, the present application provides a method for transport layer security service unloading. The method comprises: establishing a first transport layer security service channel and a second transport layer security service channel between a software side of a host machine and a hardware side connected to the host machine, wherein the first transport layer security service channel is adapted to a first data specification and is maintained by the hardware side, and the second transport layer security service channel is adapted to a second data specification and is jointly maintained by the software side and the hardware side, and the first data specification is smaller than the second data specification; in response to the establishment of a first transport layer security session, determining a matching result of the first transport layer security session based on a bandwidth requirement associated with the first transport layer security session, and then unloading the first transport layer security session based on the matching result of the first transport layer security session. The method comprises the following steps: transmitting the transport layer security service associated with the first transport layer security session to the hardware side, wherein the matching result of the first transport layer security session indicates that the first transport layer security session matches the first transport layer security service channel or the second transport layer security service channel; after the transport layer security service associated with the first transport layer security session is uninstalled and before the first transport layer security session ends, based on the matching result of the first transport layer security session, sending the transport layer security record associated with the first transport layer security session in a first sending mode or a second sending mode, wherein the first sending mode is adapted to the first transport layer security service channel and the second sending mode is adapted to the second transport layer security service channel.

[0005] Through the first aspect of the present application, it is helpful to meet customer needs while making full use of bandwidth resources and hardware resources, and it is helpful to take into account the data specification requirements of high-specification transport layer security sessions while maintaining high transport layer security session processing performance.

[0006] In a possible implementation of the first aspect of the present application, the transport layer security record associated with the first transport layer security session includes a first ciphertext carried by a first message and a second ciphertext carried by a second message, the first ciphertext is an intermediate state obtained by encrypting a first plaintext, the second ciphertext is an intermediate state obtained by encrypting the second plaintext based on the first ciphertext, and the first message is sent between the second message.

[0007] In a possible implementation of the first aspect of the present application, when the matching result of the first transport layer security session indicates that the first transport layer security session matches the first transport layer security service channel, the first ciphertext and the second plaintext are both unloaded to the hardware side, and the transport layer security record associated with the first transport layer security session is sent according to the first sending method, including: through the hardware side, after sending the first message, obtaining the first ciphertext unloaded to the hardware side, and then obtaining the second ciphertext based on the first ciphertext for sending the second message.

[0008] In a possible implementation of the first aspect of the present application, when the matching result of the first transport layer security session indicates that the first transport layer security session matches the second transport layer security service channel, the second plaintext is unloaded to the hardware side and the first ciphertext is synchronously uploaded to the software side, and the transport layer security record associated with the first transport layer security session is sent according to the second sending method, including: through the hardware side, after sending the first message and at least after obtaining the first ciphertext from the software side, the second ciphertext is obtained based on the first ciphertext for sending the second message.

[0009] In a possible implementation of the first aspect of the present application, based on the bandwidth demand associated with the first transport layer security session, determining a matching result of the first transport layer security session, including: when the bandwidth demand associated with the first transport layer security session is a high bandwidth demand and the first transport layer security service channel is idle, the matching result of the first transport layer security session indicates that the first transport layer security session matches the first transport layer security service channel; when the bandwidth demand associated with the first transport layer security session is a high bandwidth demand and the first transport layer security service channel is not idle, the matching result of the first transport layer security session indicates that the first transport layer security session matches the second transport layer security service channel; when the bandwidth demand associated with the first transport layer security session is a low bandwidth demand, the matching result of the first transport layer security session indicates that the first transport layer security session matches the second transport layer security service channel.

[0010] In a possible implementation of the first aspect of the present application, the first transport layer security service channel is a dedicated session encryption channel, the second transport layer security service channel is a shared session encryption channel, and the data transmission performance of the first transport layer security service channel is higher than the data transmission performance of the second transport layer security service channel.

[0011] In a possible implementation of the first aspect of the present application, when the bandwidth demand associated with the first transport layer security session is higher than a preset threshold and the exclusive session encryption channel is idle, the exclusive session encryption channel is allocated to the first transport layer security session; otherwise, the shared session encryption channel is allocated to the first transport layer security session.

[0012] In a possible implementation of the first aspect of the present application, the first transport layer security business channel is maintained by the hardware side, including: all intermediate states in the transport layer security record associated with any transport layer security session conducted through the first transport layer security business channel are unloaded to the hardware side.

[0013] In a possible implementation of the first aspect of the present application, the second transport layer security business channel is jointly maintained by the software side and the hardware side, including: all intermediate states in the transport layer security record associated with any transport layer security session conducted through the second transport layer security business channel are synchronously uploaded to the software side, and all plaintexts in the transport layer security record associated with any transport layer security session conducted through the second transport layer security business channel are unloaded to the hardware side.

[0014] In a possible implementation of the first aspect of the present application, the method further includes: after the transport layer security service associated with the first transport layer security session is unloaded and before the first transport layer security session ends, switching between the first sending mode and the second sending mode based on the real-time traffic detection result of the first transport layer security session.

[0015] In a possible implementation of the first aspect of the present application, the method further includes: when the business requirements of the first transport layer security session indicate a high sensitivity to traffic fluctuations, not performing switching between the first sending mode and the second sending mode.

[0016] In a possible implementation of the first aspect of the present application, when the real-time traffic detection result of the first transport layer security session indicates low session traffic or link degradation, switch to the second sending mode, and continue the first transport layer security session through the second transport layer security service channel; when the real-time traffic detection result of the first transport layer security session indicates high session traffic, switch to the first sending mode, and continue the first transport layer security session through the first transport layer security service channel.

[0017] In a possible implementation manner of the first aspect of the present application, the first data specification is a preset data specification in a set of multiple preset data specifications, and the multiple preset data specifications are all smaller than the second data specification.

[0018] In a possible implementation of the first aspect of the present application, the method also includes: when the load on the hardware side exceeds a preset load upper limit, closing the first transport layer security service channel, switching to the second sending mode, and continuing the first transport layer security session through the second transport layer security service channel.

[0019] In a second aspect, an embodiment of the present application further provides a computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements a method according to any one of the implementation modes of any of the above aspects when executing the computer program.

[0020] In a third aspect, an embodiment of the present application further provides a computer-readable storage medium, which stores computer instructions. When the computer instructions are executed on a computer device, the computer device executes a method according to any one of the implementation methods of any of the above aspects.

[0021] In a fourth aspect, an embodiment of the present application further provides a computer program product, which includes instructions stored on a computer-readable storage medium, and when the instructions are executed on a computer device, the computer device executes a method according to any one of the implementation methods of any of the above aspects. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0023] Figure 1 A flow chart of a method for transport layer security service offloading provided in an embodiment of the present application;

[0024] Figure 2 A reference provided for the embodiments of this application Figure 1 A schematic diagram of a method for transport layer security service offloading to conduct a transport layer security session is shown;

[0025] Figure 3 A schematic diagram of the structure of a computing device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0026] The embodiments of the present application will be further described in detail below in conjunction with the accompanying drawings.

[0027] It should be understood that, in the description of this application, "at least one" means one or more, and "a plurality of" means two or more. In addition, unless otherwise specified, the words "first", "second", etc. are only used for the purpose of distinguishing descriptions, and cannot be understood as indicating or implying relative importance, nor can they be understood as indicating or implying an order.

[0028] Figure 1 A flow chart of a method for transport layer security service offloading provided in an embodiment of the present application. Figure 1 As shown, the method for transport layer security service unloading includes the following steps.

[0029] Step S110: Establish a first transport layer security business channel and a second transport layer security business channel between the software side of the host machine and the hardware side connected to the host machine, wherein the first transport layer security business channel adapts to a first data specification and is maintained by the hardware side, and the second transport layer security business channel adapts to a second data specification and is jointly maintained by the software side and the hardware side, and the first data specification is smaller than the second data specification.

[0030] Step S120: In response to the establishment of a first transport layer security session, based on the bandwidth requirement associated with the first transport layer security session, determine a matching result of the first transport layer security session, and then, based on the matching result of the first transport layer security session, unload the transport layer security service associated with the first transport layer security session to the hardware side, wherein the matching result of the first transport layer security session indicates that the first transport layer security session matches the first transport layer security service channel or the second transport layer security service channel.

[0031] Step S130: After the transport layer security service associated with the first transport layer security session is unloaded and before the first transport layer security session ends, based on the matching result of the first transport layer security session, the transport layer security record associated with the first transport layer security session is sent according to the first sending mode or the second sending mode, wherein the first sending mode is adapted to the first transport layer security service channel and the second sending mode is adapted to the second transport layer security service channel.

[0032] Figure 1The method for transport layer security service offloading shown can be applied to technical fields such as artificial intelligence, big data, and cloud services, where the demand for high-specification and high-performance transport layer security (TLS) sessions is rapidly increasing. The transport layer security protocol includes two layers of protocols. The bottom layer protocol is the transport layer security record protocol, which is used to encrypt messages using passwords, and the upper layer protocol is the handshake protocol, which is used for handshakes between two parties, changes in password specifications, and application data. A single transport layer security session may include multiple continuous transport layer security records, which are carried by multiple messages, and the records and messages are not necessarily one-to-one corresponding, that is, the messages carrying records of different transport layer security sessions can be arbitrarily interwoven. However, because it involves encryption calculation and ciphertext calculation, if the record of a transport layer security session is carried by multiple messages, then the record carried by the subsequent message needs to be based on the state after the plaintext encryption of the previous message is completed, that is, the intermediate state, in order to correctly continue to encrypt or perform ciphertext calculation. Therefore, considering that there is not necessarily a one-to-one correspondence between records and messages, that is, messages carrying records of different transport layer security sessions can be arbitrarily interleaved, it is necessary to maintain intermediate states according to the records of different transport layer security sessions. As the data size of the transport layer security session increases, that is, the number of records included in the transport layer security session increases, for example, a single transport layer security session may include 2000 or more records, which means that it is necessary to maintain more intermediate states in the encryption process, that is, the ciphertext obtained after encrypting the plaintext. In addition, because the sending order of messages carrying records of different transport layer security sessions is difficult to predict and may be interleaved, it means that before a transport layer security session ends, it may be necessary to maintain the intermediate state of the encryption process of the transport layer security session. If there are a large number of transport layer security sessions in progress and these transport layer security sessions may have a large data size, a large amount of resources will be required. Transport layer security sessions with larger data specifications may be required by applications such as video conferencing, live broadcasting, and cloud office. These applications may rely on transport layer security sessions and related security protocols to encrypt and transmit messages carrying sensitive information in order to protect user privacy and data security. Moreover, these applications may last for a long time, so a large number of records are generated, which requires the support of transport layer security sessions with larger data specifications. For example, a business online meeting may require the support of a transport layer security session with a data specification of one million records. If there are multiple business online meetings in progress, it is necessary to maintain multiple similar high-specification transport layer security sessions on the server. Therefore, as the demand for high-specification and high-performance transport layer security sessions increases, it is a challenge to simultaneously take into account high data specifications and maintain high performance.A transport layer security session needs to be completed through multiple continuous messages, and the transport layer security session may have encryption and decryption requirements, such as encryption and decryption of keys, private data, key files, etc. This encryption and decryption needs to be completed through encrypted transport layer security records. Continuous transport layer security records are carried between multiple messages related to the transport layer security session. For this reason, the previous message carries the encrypted state of the record plaintext (that is, ciphertext, or intermediate state), so that the subsequent message can continue to encrypt or carry the record plaintext based on the intermediate state carried by the previous message. Therefore, during the entire transport layer security session, it is necessary to maintain the record of the transport layer security session, including maintaining the encrypted intermediate state. According to the nature of the encryption algorithm, the ciphertext obtained after encrypting the plaintext may greatly increase the data length. For example, a privacy calculation on 1 bit of plaintext may obtain 1024 bits of ciphertext. Therefore, during the transport layer security session, it is necessary to provide certain data specifications to maintain the record of the transport layer security session, or to store and manage the encryption and decryption information related to the transport layer security session. Combined below. Figure 1 The specific embodiments of the present application will explain in detail how the method, computer equipment and medium for transport layer security service offloading provided by the present application can simultaneously take into account the data specification requirements of high-specification transport layer security sessions and maintain high transport layer security session processing performance.

[0033] See also Figure 1, in step S110, a first transport layer security service channel and a second transport layer security service channel are established between the software side of the host machine and the hardware side connected to the host machine. Among them, the first transport layer security service channel adapts to the first data specification and is maintained by the hardware side, the second transport layer security service channel adapts to the second data specification and is jointly maintained by the software side and the hardware side, and the first data specification is smaller than the second data specification. In some embodiments, the first transport layer security service channel is an exclusive session encryption channel, the second transport layer security service channel is a shared session encryption channel, and the data transmission performance of the first transport layer security service channel is higher than the data transmission performance of the second transport layer security service channel. In this way, two types of transport layer security service channels are provided, namely the first transport layer security service channel and the second transport layer security service channel. The first transport layer security service channel provides higher data transmission performance and adapts to smaller data specifications. Therefore, the first transport layer security service channel is suitable for exclusive session encryption channels, that is, allocated to designated transport layer security sessions. In contrast, the second transport layer security service channel provides lower data transmission performance and adapts to larger data specifications. Therefore, the second transport layer security service channel is suitable for shared session encryption channels, that is, it can be shared between multiple transport layer security sessions. In addition, the first transport layer security service channel adapts to the first data specification and is maintained by the hardware side, and the second transport layer security service channel adapts to the second data specification and is jointly maintained by the software side and the hardware side. In this way, the first transport layer security service channel can be used for hardware offloading in a complete sense, that is, the complete record of the transport layer security session is offloaded to the hardware and maintained by the hardware. The second transport layer security service channel is jointly maintained in a software and hardware collaborative manner, so the ciphertext that occupies a large space, that is, the encrypted intermediate state, can be synchronized from the hardware to the software, and then when the next message carrying the record of the transport layer security session is sent, the intermediate state is transmitted from the software to the hardware, which is equivalent to combining the storage space on the software side to store and manage the record of the transport layer security session. In this way, through the interaction between software and hardware, as well as the uplink and downlink of the intermediate state, the problem of insufficient hardware resources can be solved. In some examples, the first transport layer security service channel is suitable for a dedicated session encryption channel and can support multiple data specifications, such as 1000, 2000, 3000 or 4000 records, to adapt to the specification requirements of transport layer security service records of different transport layer security services that require high performance; the second transport layer security service channel is suitable for a shared session encryption channel and can support large-scale transport layer security service sessions, such as one million.

[0034] Continue reading Figure 1In step S120, in response to the establishment of the first transport layer security session, based on the bandwidth requirement associated with the first transport layer security session, a matching result of the first transport layer security session is determined, and then, based on the matching result of the first transport layer security session, the transport layer security service associated with the first transport layer security session is unloaded to the hardware side, wherein the matching result of the first transport layer security session indicates that the first transport layer security session matches the first transport layer security service channel or the second transport layer security service channel. In this way, for the establishment phase of the transport layer security session, the matching result is determined based on the bandwidth requirement associated with the transport layer security session, so as to determine that the transport layer security session matches the first transport layer security service channel or the second transport layer security service channel. Here, the bandwidth requirement associated with the first transport layer security session refers to the high bandwidth or low bandwidth required by the transport layer security service corresponding to the first transport layer security session. High bandwidth and low bandwidth are relative concepts, and the specific values ​​can be determined based on the maximum data bit width of the external interaction of the hardware side, the maximum data bit width of the bus on which the interaction between the software side and the hardware side depends, and other information. For example, the maximum data bit width of an intelligent network card that may interact with the outside world is 100 gigabytes (GB). The bandwidth requirement exceeding 10 gigabytes can be defined as a high bandwidth requirement, while the bandwidth requirement less than 10 gigabytes can be defined as a low bandwidth requirement. In some embodiments, one or more preset bandwidth thresholds can be set, and by comparing the bandwidth requirement associated with the first transport layer security session with these preset bandwidth thresholds, it is determined whether the bandwidth requirement associated with the first transport layer security session is a high bandwidth requirement or a low bandwidth requirement. Scoring can also be performed based on the comparison result, for example, one point is counted each time the bandwidth requirement associated with the first transport layer security session exceeds a preset bandwidth threshold, and the bandwidth requirement associated with the first transport layer security session is evaluated based on the scoring result to determine whether it is a high bandwidth requirement or a low bandwidth requirement. In this way, in response to the establishment of the first transport layer security session, the corresponding transport layer security service channel is matched based on the bandwidth requirement, which helps to meet customer needs while making full use of bandwidth resources and hardware resources, and helps to take into account the data specification requirements of high-specification transport layer security sessions and maintain high transport layer security session processing performance.

[0035] Continue reading Figure 1In step S130, after the transport layer security service associated with the first transport layer security session is unloaded and before the first transport layer security session ends, based on the matching result of the first transport layer security session, the transport layer security record associated with the first transport layer security session is sent in a first sending mode or a second sending mode, wherein the first sending mode is adapted to the first transport layer security service channel and the second sending mode is adapted to the second transport layer security service channel. In this way, for the established transport layer security session, that is, in the ongoing stage after the establishment phase of the transport layer security session and before the end of the session, because the establishment phase of the transport layer security session has ended, the transport layer security service associated with the first transport layer security session is unloaded to the hardware side based on the matching result of the first transport layer security session. As described above, in response to the establishment of the first transport layer security session, the corresponding transport layer security service channel is matched based on the bandwidth requirement, so that, depending on the matching result of the first transport layer security session, the first transport layer security session can match the first transport layer security service channel, or the first transport layer security session can match the second transport layer security service channel. Here, the first transport layer security service channel is adapted to the first data specification and maintained by the hardware side, and the second transport layer security service channel is adapted to the second data specification and maintained by the software side and the hardware side. Therefore, when the matching result of the first transport layer security session indicates that the first transport layer security session matches the first transport layer security service channel, it means that hardware offloading in a complete sense can be performed through the first transport layer security service channel, that is, the complete record of the transport layer security session is offloaded to the hardware and maintained by the hardware. In this way, based on the matching result of the first transport layer security session, the first sending mode adapted to the first transport layer security service channel may be selected to send the transport layer security record associated with the first transport layer security session, so that the high-performance first transport layer security service channel can be fully utilized, and the first transport layer security service channel is maintained by the hardware side, so the advantages of hardware offloading in performance improvement can be fully utilized; conversely, based on the matching result of the first transport layer security session, the second sending mode of the second transport layer security service channel may be selected to send the transport layer security record associated with the first transport layer security session, so that the high-specification second transport layer security service channel can be fully utilized, and the second transport layer security service channel is jointly maintained by the software side and the hardware side, so the problem of insufficient hardware resources can be effectively solved through the interaction between software and hardware and the intermediate uplink and downlink.Moreover, the matching result of the first transport layer security session is determined based on the bandwidth requirement associated with the first transport layer security session. Therefore, it helps to meet customer needs while making full use of bandwidth resources and hardware resources, and helps to take into account the data specification requirements of high-specification transport layer security sessions while maintaining high transport layer security session processing performance.

[0036] Figure 2 A reference provided for the embodiments of this application Figure 1 The schematic diagram of the method for transport layer security service offloading to perform transport layer security session is shown in FIG. Figure 2 As shown, a transport layer security session A211 is established between the software side 201 of the host machine and the hardware side 203 connected to the host machine, and there are already established transport layer security sessions B221 and transport layer security sessions C231. Among them, for the newly created transport layer security session A211, the software side 201 performs operation A213: obtains the idle table, sends down the initial state of the transport layer security record, and initiates the transport layer security record message, and then the hardware side 203 performs operation B215: completes the initialization based on the record of the transport layer security session and completes the encryption of the transport layer security record. For the already established transport layer security session B221, the matching result of the transport layer security session B221 indicates that the transport layer security session B221 matches the first transport layer security service channel 251. For example, the transport layer security session B221 is an exclusive session, that is, Figure 2 The transport layer security session B221 shown matches the first transport layer security service channel 251. For the established transport layer security session B221, the software side 201 performs operation C223: obtains the exclusive session and then initiates the transport layer security record message, and then the hardware side 203 performs operation D225: obtains the intermediate state maintained by the hardware based on the exclusive session and completes the transport layer security record encryption. For the established transport layer security session C231, the matching result of the transport layer security session C231 indicates that the transport layer security session C231 matches the second transport layer security service channel 253, for example, the transport layer security session C231 is a shared session, that is, Figure 2 The transport layer security session C231 shown matches the second transport layer security service channel 253. For the established transport layer security session C231, the software side 201 performs operation E233: obtains the shared session, obtains the latest intermediate state, sends the intermediate state, and initiates the transport layer security record message, and then the hardware side 203 performs operation F235: updates the intermediate state based on the shared session, completes the transport layer security record encryption, and synchronizes the intermediate state.

[0037] See also Figure 1 and Figure 2, for the establishment phase of the transport layer security session, and for the established transport layer security session, that is, the ongoing phase after the establishment phase of the transport layer security session and before the end of the session, the corresponding transport layer security service channel is matched based on the bandwidth demand and the corresponding sending mode is selected to send the transport layer security record. In this way, based on the matching result of the first transport layer security session, the first sending mode adapted to the first transport layer security service channel may be selected to send the transport layer security record associated with the first transport layer security session, which can make full use of the high-performance first transport layer security service channel, and the first transport layer security service channel is maintained by the hardware side, so the advantages of hardware offloading in performance improvement can be fully utilized; on the contrary, based on the matching result of the first transport layer security session, the second sending mode of the second transport layer security service channel may be selected to send the transport layer security record associated with the first transport layer security session, which can make full use of the high-specification second transport layer security service channel, and the second transport layer security service channel is jointly maintained by the software side and the hardware side, so the problem of insufficient hardware resources can be effectively solved through the interaction between software and hardware and the intermediate state uplink and downlink. Moreover, the matching result of the first transport layer security session is determined based on the bandwidth requirement associated with the first transport layer security session. Therefore, it helps to meet customer needs while making full use of bandwidth resources and hardware resources, and helps to take into account the data specification requirements of high-specification transport layer security sessions while maintaining high transport layer security session processing performance.

[0038] See also Figure 1 and Figure 2 In some embodiments, the host machine may be a high-performance server or a network node in a cloud computing network, or may be a host in a data center. In some embodiments, the hardware side connected to the host machine may be dedicated hardware such as a smart network card, a network interface controller (NIC), etc., for providing network communication functions.

[0039] See also Figure 1 and Figure 2In a possible implementation, the transport layer security record associated with the first transport layer security session includes a first ciphertext carried by a first message and a second ciphertext carried by a second message, the first ciphertext is an intermediate state obtained by encrypting the first plaintext, the second ciphertext is an intermediate state obtained by encrypting the second plaintext based on the first ciphertext, and the first message is sent between the second messages. A single transport layer security session may include multiple continuous transport layer security records, which are carried by multiple messages, and the records and messages are not necessarily one-to-one corresponding, that is, the messages carrying records of different transport layer security sessions can be arbitrarily interleaved. However, because encryption calculation and ciphertext calculation are involved, if the record of a transport layer security session is carried by multiple messages, then the record carried by the subsequent message needs to be correctly encrypted or ciphertext calculated based on the state after the plaintext encryption of the previous message is completed, that is, the intermediate state. Therefore, considering that the record and the message are not necessarily one-to-one corresponding, that is, the messages carrying the records of different transport layer security sessions can be arbitrarily interleaved, it is necessary to maintain the intermediate state according to the records of different transport layer security sessions. Here, the transport layer security record associated with the first transport layer security session includes a first ciphertext carried by the first message and a second ciphertext carried by the second message, wherein the first ciphertext is an intermediate state obtained by encrypting the first plaintext, and the second ciphertext is an intermediate state obtained by encrypting the second plaintext based on the first ciphertext. Therefore, the encryption or ciphertext calculation of the second ciphertext requires the first ciphertext. In other words, the previous message carries the encrypted state of the record plaintext (that is, the ciphertext, or the intermediate state), so that the subsequent message can continue to encrypt or carry the record plaintext based on the intermediate state carried by the previous message. Therefore, during the entire transport layer security session, it is necessary to maintain the record of the transport layer security session, including maintaining the intermediate state under encryption. In this way, in response to the establishment of the first transport layer security session, matching the corresponding transport layer security service channel based on the bandwidth demand helps to meet customer needs while making full use of bandwidth resources and hardware resources, and helps to take into account the data specification requirements of high-standard transport layer security sessions and maintain high transport layer security session processing performance.

[0040] In some embodiments, when the matching result of the first transport layer security session indicates that the first transport layer security session matches the first transport layer security service channel, both the first ciphertext and the second plaintext are unloaded to the hardware side, and the transport layer security record associated with the first transport layer security session is sent according to the first sending method, including: after sending the first message, the first ciphertext unloaded to the hardware side is obtained through the hardware side, and then the second ciphertext is obtained based on the first ciphertext for sending the second message. In this way, based on the matching result of the first transport layer security session, the first sending method adapted to the first transport layer security service channel is selected to send the transport layer security record associated with the first transport layer security session, which can make full use of the high-performance first transport layer security service channel, and the first transport layer security service channel is maintained by the hardware side, so the advantages of hardware offloading in performance improvement can be fully utilized.

[0041] In some embodiments, when the matching result of the first transport layer security session indicates that the first transport layer security session matches the second transport layer security service channel, the second plaintext is unloaded to the hardware side and the first ciphertext is synchronously uploaded to the software side, and the transport layer security record associated with the first transport layer security session is sent according to the second sending mode, including: after sending the first message and at least after obtaining the first ciphertext from the software side, the second ciphertext is obtained based on the first ciphertext for sending the second message through the hardware side. In this way, based on the matching result of the first transport layer security session, the second sending mode of the second transport layer security service channel is selected to send the transport layer security record associated with the first transport layer security session, which can make full use of the high-specification second transport layer security service channel, and the second transport layer security service channel is jointly maintained by the software side and the hardware side, so the problem of insufficient hardware resources can be effectively solved through the interaction between software and hardware and the intermediate state uploading and downloading.

[0042] In a possible implementation, determining a matching result of the first transport layer security session based on the bandwidth requirement associated with the first transport layer security session includes: when the bandwidth requirement associated with the first transport layer security session is a high bandwidth requirement and the first transport layer security service channel is idle, the matching result of the first transport layer security session indicates that the first transport layer security session matches the first transport layer security service channel; when the bandwidth requirement associated with the first transport layer security session is a high bandwidth requirement and the first transport layer security service channel is not idle, the matching result of the first transport layer security session indicates that the first transport layer security session matches the second transport layer security service channel; when the bandwidth requirement associated with the first transport layer security session is a low bandwidth requirement, the matching result of the first transport layer security session indicates that the first transport layer security session matches the second transport layer security service channel. The bandwidth requirement associated with the first transport layer security session refers to whether the transport layer security service corresponding to the first transport layer security session requires high bandwidth or low bandwidth. High bandwidth and low bandwidth are relative concepts, and specific values ​​can be determined based on information such as the maximum data bit width of the external interaction on the hardware side and the maximum data bit width of the bus on which the interaction between the software side and the hardware side depends. For example, the maximum data bit width of an intelligent network card that may interact with the outside world is 100 gigabytes (GB). The bandwidth requirement exceeding 10 gigabytes can be defined as a high bandwidth requirement, while the bandwidth requirement less than 10 gigabytes can be defined as a low bandwidth requirement. In some embodiments, one or more preset bandwidth thresholds can be set, and by comparing the bandwidth requirement associated with the first transport layer security session with these preset bandwidth thresholds, it is determined whether the bandwidth requirement associated with the first transport layer security session is a high bandwidth requirement or a low bandwidth requirement. Scoring can also be performed based on the comparison result, for example, one point is counted each time the bandwidth requirement associated with the first transport layer security session exceeds a preset bandwidth threshold, and the bandwidth requirement associated with the first transport layer security session is evaluated based on the scoring result to determine whether it is a high bandwidth requirement or a low bandwidth requirement. In this way, in response to the establishment of the first transport layer security session, the corresponding transport layer security service channel is matched based on the bandwidth requirement, which helps to meet customer needs while making full use of bandwidth resources and hardware resources, and helps to take into account the data specification requirements of high-specification transport layer security sessions and maintain high transport layer security session processing performance.

[0043] In a possible implementation, the first transport layer security service channel is a dedicated session encryption channel, the second transport layer security service channel is a shared session encryption channel, and the data transmission performance of the first transport layer security service channel is higher than the data transmission performance of the second transport layer security service channel. In this way, two types of transport layer security service channels are provided, namely the first transport layer security service channel and the second transport layer security service channel. The first transport layer security service channel provides higher data transmission performance and adapts to smaller data specifications. Therefore, the first transport layer security service channel is suitable for exclusive session encryption channels, that is, allocated to designated transport layer security sessions. In contrast, the second transport layer security service channel provides lower data transmission performance and adapts to larger data specifications. Therefore, the second transport layer security service channel is suitable for shared session encryption channels, that is, it can be shared among multiple transport layer security sessions. The first transport layer security service channel can be used for hardware offloading in a complete sense, that is, the complete records of the transport layer security session are offloaded to the hardware and maintained by the hardware. The second transport layer security service channel is jointly maintained through the collaboration of software and hardware. Therefore, the ciphertext that occupies a large space, that is, the encrypted intermediate state, can be synchronized from the hardware to the software. Then, when the next message carrying the record of the transport layer security session is sent, the intermediate state is transmitted from the software to the hardware. This is equivalent to combining the storage space on the software side to store and manage the records of the transport layer security session. In this way, through the interaction between software and hardware, as well as the uplink and downlink of the intermediate state, the problem of insufficient hardware resources can be solved.

[0044] In some embodiments, when the bandwidth demand associated with the first transport layer security session is higher than a preset threshold and the dedicated session encryption channel is idle, the dedicated session encryption channel is allocated to the first transport layer security session, otherwise, the shared session encryption channel is allocated to the first transport layer security session. In this way, in response to the establishment of the first transport layer security session, the corresponding transport layer security service channel is matched based on the bandwidth demand, which helps to meet customer needs while making full use of bandwidth resources and hardware resources, and helps to take into account the data specification requirements of high-specification transport layer security sessions and maintain high transport layer security session processing performance.

[0045] In a possible implementation, the first transport layer security service channel is maintained by the hardware side, including: all intermediate states in the transport layer security record associated with any transport layer security session conducted through the first transport layer security service channel are unloaded to the hardware side. In this way, the first transport layer security service channel can be used for hardware offloading in a complete sense, that is, the complete record of the transport layer security session is offloaded to the hardware and maintained by the hardware. Based on the matching result of the first transport layer security session, the first sending method adapted to the first transport layer security service channel may be selected to send the transport layer security record associated with the first transport layer security session, which can make full use of the high-performance first transport layer security service channel. Moreover, the first transport layer security service channel is maintained by the hardware side, so the advantages of hardware offloading in performance improvement can be fully utilized.

[0046] In some embodiments, the second transport layer security service channel is jointly maintained by the software side and the hardware side, including: all intermediate states in the transport layer security record associated with any transport layer security session conducted through the second transport layer security service channel are synchronously uploaded to the software side, and all plaintexts in the transport layer security record associated with any transport layer security session conducted through the second transport layer security service channel are unloaded to the hardware side. During the entire transport layer security session, it is necessary to maintain the record of the transport layer security session, including maintaining the encrypted intermediate state. According to the nature of the encryption algorithm, the ciphertext obtained after encrypting the plaintext may greatly increase the data length. For example, a privacy calculation of 1 bit of plaintext may obtain a 1024-bit ciphertext. The second transport layer security service channel is jointly maintained by software and hardware collaboration, so the ciphertext that occupies a large space, that is, the encrypted intermediate state, can be synchronized from the hardware to the software, and then when the next message carrying the record of the transport layer security session is sent, the intermediate state is transmitted from the software to the hardware, which is equivalent to combining the storage space on the software side to store and manage the record of the transport layer security session. In this way, based on the matching result of the first transport layer security session, the second sending method of the second transport layer security service channel may be selected to send the transport layer security record associated with the first transport layer security session, so that the high-specification second transport layer security service channel can be fully utilized, and the second transport layer security service channel is jointly maintained by the software side and the hardware side. Therefore, the problem of insufficient hardware resources can be effectively solved through the interaction between software and hardware and the intermediate uplink and downlink.

[0047] In a possible implementation, the method further includes: after the transport layer security service associated with the first transport layer security session is unloaded and before the first transport layer security session ends, switching between the first sending mode and the second sending mode based on the real-time traffic detection result of the first transport layer security session. As described above, in response to the establishment of the first transport layer security session, matching the corresponding transport layer security service channel based on bandwidth requirements helps to meet customer needs while making full use of bandwidth resources and hardware resources, and helps to take into account the data specification requirements of high-specification transport layer security sessions and maintain high transport layer security session processing performance. In this way, switching the corresponding sending mode based on the real-time traffic detection results can more efficiently utilize bandwidth resources and hardware resources.

[0048] In some embodiments, the method further includes: when the service requirements of the first transport layer security session indicate a high sensitivity to traffic fluctuations, not performing switching between the first sending mode and the second sending mode. Considering some transport layer security sessions with special requirements, such as customers with high privacy and performance requirements, even if the service requirements themselves have large demand fluctuations, such as sometimes reaching a peak and then quickly falling to a trough and then rising sharply, for the purpose of ensuring bandwidth stability and reliability, by prohibiting switching the sending mode, the bandwidth can be kept stable and thus help avoid traffic fluctuations.

[0049] In some examples, when the real-time traffic detection result of the first transport layer security session indicates low session traffic or link degradation, the second transmission mode is switched to, and the first transport layer security session is continued through the second transport layer security service channel; when the real-time traffic detection result of the first transport layer security session indicates high session traffic, the first transmission mode is switched to, and the first transport layer security session is continued through the first transport layer security service channel. In this way, when low session traffic or link degradation is detected, the second transmission mode is switched to, that is, the transport layer security service channel for shared sessions is switched to release the transport layer security service channel for exclusive sessions. The operation process of switching to a shared session can be: sending an intermediate state command for synchronizing a hardware-dedicated session to a host machine, and after the host machine obtains the latest intermediate state, a shared session is obtained to synchronize the intermediate state to the hardware first, and then a TLS service is initiated, or the intermediate state is sent to the hardware together with the obtained shared session and the TLS service. In addition, when high session traffic is detected, the first transmission mode is switched to, that is, the transport layer security service channel for exclusive sessions is switched to, which helps to more efficiently utilize bandwidth resources and hardware resources. The operation process of switching to a dedicated session can be: after the host obtains the latest intermediate state, it synchronizes the intermediate state to the hardware dedicated session based on the obtained dedicated session, and then initiates the TLS service, and there is no need to switch the intermediate state again in the future.

[0050] In a possible implementation, the first data size is a preset data size in a set of multiple preset data sizes, and the multiple preset data sizes are all smaller than the second data size. This is conducive to adapting the specification requirements of TLS records of different TLS services that require high performance.

[0051] In a possible implementation, the method further includes: when the load on the hardware side exceeds a preset load upper limit, closing the first transport layer security service channel, switching to the second sending mode, and continuing the first transport layer security session through the second transport layer security service channel. In this way, when the hardware load is heavy, the high performance specification is 0, the dedicated TLS session channel is closed, power consumption is reduced, and all sessions are forcibly switched to the shared session channel, which is conducive to meeting the low power consumption requirement.

[0052] Figure 33 is a schematic diagram of the structure of a computing device provided in an embodiment of the present application, and the computing device 300 includes: one or more processors 310, a communication interface 320 and a memory 330. The processor 310, the communication interface 320 and the memory 330 are interconnected via a bus 340. Optionally, the computing device 300 may also include an input / output interface 350, and the input / output interface 350 is connected to an input / output device for receiving parameters set by a user, etc. The computing device 300 can be used to implement some or all of the functions of the device embodiment or system embodiment in the above-mentioned embodiment of the present application; the processor 310 can also be used to implement some or all of the operating steps of the method embodiment in the above-mentioned embodiment of the present application. For example, the specific implementation of the various operations performed by the computing device 300 can refer to the specific details in the above-mentioned embodiments, such as the processor 310 is used to perform some or all of the steps in the above-mentioned method embodiment or some or all of the operations in the above-mentioned method embodiment. For another example, in an embodiment of the present application, the computing device 300 may be used to implement part or all of the functions of one or more components in the above-mentioned device embodiment. In addition, the communication interface 320 may be specifically used to perform the communication functions necessary to implement the functions of these devices and components, and the processor 310 may be specifically used to perform the processing functions necessary to implement the functions of these devices and components.

[0053] It should be understood that Figure 3 The computing device 300 may include one or more processors 310, and the multiple processors 310 may provide processing capabilities in a parallel connection mode, a serial connection mode, a serial-parallel connection mode, or any connection mode, or the multiple processors 310 may form a processor sequence or a processor array, or the multiple processors 310 may be divided into a main processor and an auxiliary processor, or the multiple processors 310 may have different architectures such as a heterogeneous computing architecture. In addition, Figure 3 The computing device 300 shown in the figure, and the related structural description and functional description are exemplary and non-limiting. In some exemplary embodiments, the computing device 300 may include Figure 3 More or fewer components may be shown, or some components may be combined or separated, or may have a different arrangement of components.

[0054] The processor 310 may have a variety of specific implementation forms. For example, the processor 310 may include a central processing unit (CPU), a graphic processing unit (GPU), a neural-network processing unit (NPU), a tensor processing unit (TPU) or a data processing unit (DPU), etc., and the embodiment of the present application does not specifically limit it. The processor 310 may also be a single-core processor or a multi-core processor. The processor 310 may be a combination of a CPU and a hardware chip. The above-mentioned hardware chip may be an application-specific integrated circuit (ASIC), a programmable logic device (PLD) or a combination thereof. The above-mentioned PLD may be a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL) or any combination thereof. The processor 310 may also be implemented using a logic device with built-in processing logic alone, such as an FPGA or a digital signal processor (DSP). The communication interface 320 may be a wired interface or a wireless interface for communicating with other modules or devices. The wired interface may be an Ethernet interface, a local interconnect network (LIN), etc., and the wireless interface may be a cellular network interface or a wireless local area network interface, etc.

[0055] The memory 330 may be a non-volatile memory, such as a read-only memory (ROM), a programmable ROM (PROM), an erasable PROM (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The memory 330 may also be a volatile memory, which may be a random access memory (RAM) used as an external cache. By way of example but not limitation, many forms of RAM are available, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate synchronous DRAM (DDR SDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), and direct rambus RAM (DR RAM). The memory 330 may also be used to store program codes and data, so that the processor 310 calls the program codes stored in the memory 330 to execute some or all of the operation steps in the above method embodiment, or to execute the corresponding functions in the above device embodiment. Figure 3 Show more or fewer components, or have different component configurations.

[0056] The bus 340 may be a peripheral component interconnect express (PCIe) bus, an extended industry standard architecture (EISA) bus, a unified bus (Ubus or UB), a compute express link (CXL), a cache coherent interconnect for accelerators (CCIX), etc. The bus 340 may be divided into an address bus, a data bus, a control bus, etc. In addition to the data bus, the bus 340 may also include a power bus, a control bus, and a status signal bus, etc. However, for the sake of clarity, Figure 3 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0057] The method and device provided in the embodiments of the present application are based on the same inventive concept. Since the principles of solving the problems in the methods and devices are similar, the embodiments, implementation methods, examples or implementation methods of the methods and devices can refer to each other, and the repeated parts will not be repeated. The embodiments of the present application also provide a system, which includes multiple computing devices, and the structure of each computing device can refer to the structure of the computing device described above. The functions or operations that can be implemented by the system can refer to the specific implementation steps in the above method embodiments and / or the specific functions described in the above device embodiments, which will not be repeated here.

[0058] The present application also provides a computer-readable storage medium, in which computer instructions are stored. When the computer instructions are executed on a computer device (such as one or more processors), the method steps in the above method embodiment can be implemented. The specific implementation of the processor of the computer-readable storage medium in executing the above method steps can refer to the specific operations described in the above method embodiment and / or the specific functions described in the above device embodiment, which will not be repeated here.

[0059] It should be understood by those skilled in the art that the embodiments of the present application may be provided as methods, systems, or computer program products. The present application may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. The embodiments of the present application may be implemented in whole or in part by software, hardware, firmware, or any other combination. When implemented using software, the above embodiments may be implemented in whole or in part in the form of a computer program product. The present application may take the form of a computer program product implemented on one or more computer-usable storage media containing computer-usable program codes. The computer program product includes one or more computer instructions. When the computer program instructions are loaded or executed on a computer, the process or function described in the embodiments of the present application is generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. Computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, computer instructions may be transmitted from one website, computer, server, or data center to another website, computer, server, or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line) or wireless (e.g., infrared, wireless, microwave, etc.) means. Computer-readable storage media can be any available medium that can be accessed by a computer or a data storage device such as a server or data center that contains one or more available media. Available media can be magnetic media (such as floppy disks, hard disks, tapes), optical media, or semiconductor media. Semiconductor media can be solid-state hard disks, random access memory, flash memory, read-only memory, erasable programmable read-only memory, electrically erasable programmable read-only memory, registers, or any other form of suitable storage media.

[0060] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. Each process and / or block in the flowchart and / or block diagram, as well as the combination of the processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 These computer program instructions can also be stored in a computer-readable memory that can guide a computer or other programmable data processing device to work in a specific way, so that the instructions stored in the computer-readable memory produce a product including an instruction device, which implements the functions specified in the process. Figure 1A process or multiple processes and / or boxes Figure 1 These computer program instructions can also be loaded onto a computer or other programmable data processing device, so that a series of operation steps are executed on the computer or other programmable device to produce a computer-implemented process, so that the instructions executed on the computer or other programmable device provide for implementing the process in the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0061] In the above embodiments, the descriptions of each embodiment have their own emphasis. For parts that are not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments. Obviously, those skilled in the art can make various changes and modifications to the embodiments of the present application without departing from the spirit and scope of the embodiments of the present application. The steps in the method of the embodiment of the present application can be adjusted in sequence, merged or deleted according to actual needs; the modules in the system of the embodiment of the present application can be divided, merged or deleted according to actual needs. If these modifications and variations of the embodiments of the present application fall within the scope of the claims of the present application and their equivalent technologies, the present application is also intended to include these modifications and variations.

Claims

1. A method for transport layer security service unloading, characterized in that: The method comprises: Establishing a first transport layer security service channel and a second transport layer security service channel between a software side of a host machine and a hardware side connected to the host machine, wherein the first transport layer security service channel is adapted to a first data specification and maintained by the hardware side, the second transport layer security service channel is adapted to a second data specification and maintained by the software side and the hardware side, and the first data specification is smaller than the second data specification; In response to the establishment of a first transport layer security session, based on the bandwidth demand associated with the first transport layer security session, determining a matching result of the first transport layer security session, and then, based on the matching result of the first transport layer security session, unloading the transport layer security service associated with the first transport layer security session to the hardware side, wherein the matching result of the first transport layer security session indicates that the first transport layer security session matches the first transport layer security service channel or the second transport layer security service channel; After the transport layer security service associated with the first transport layer security session is unloaded and before the first transport layer security session ends, based on the matching result of the first transport layer security session, sending the transport layer security record associated with the first transport layer security session in a first sending mode or a second sending mode, wherein the first sending mode is adapted to the first transport layer security service channel and the second sending mode is adapted to the second transport layer security service channel, The transport layer security record associated with the first transport layer security session includes a first ciphertext carried by a first message and a second ciphertext carried by a second message, the first ciphertext is an intermediate state obtained by encrypting a first plaintext, the second ciphertext is an intermediate state obtained by encrypting the second plaintext based on the first ciphertext, and the first message is sent between the first message and the second message. When the matching result of the first transport layer security session indicates that the first transport layer security session matches the first transport layer security service channel, both the first ciphertext and the second plaintext are unloaded to the hardware side, and the transport layer security record associated with the first transport layer security session is sent according to the first sending mode, including: after sending the first message, obtaining the first ciphertext unloaded to the hardware side through the hardware side, and then obtaining the second ciphertext based on the first ciphertext for sending the second message, When the matching result of the first transport layer security session indicates that the first transport layer security session matches the second transport layer security service channel, the second plaintext is unloaded to the hardware side and the first ciphertext is synchronously uploaded to the software side, and the transport layer security record associated with the first transport layer security session is sent according to the second sending method, including: through the hardware side, after sending the first message and at least after obtaining the first ciphertext from the software side, the second ciphertext is obtained based on the first ciphertext for sending the second message.

2. The method according to claim 1, characterized in that Determining a matching result of the first transport layer security session based on a bandwidth requirement associated with the first transport layer security session includes: When the bandwidth demand associated with the first transport layer security session is a high bandwidth demand and the first transport layer security service channel is idle, the matching result of the first transport layer security session indicates that the first transport layer security session matches the first transport layer security service channel; When the bandwidth demand associated with the first transport layer security session is a high bandwidth demand and the first transport layer security service channel is not idle, the matching result of the first transport layer security session indicates that the first transport layer security session matches the second transport layer security service channel; When the bandwidth requirement associated with the first transport layer security session is a low bandwidth requirement, the matching result of the first transport layer security session indicates that the first transport layer security session matches the second transport layer security service channel.

3. The method according to claim 1, characterized in that: The first transport layer security service channel is an exclusive session encryption channel, the second transport layer security service channel is a shared session encryption channel, and the data transmission performance of the first transport layer security service channel is higher than the data transmission performance of the second transport layer security service channel.

4. The method according to claim 3, characterized in that When the bandwidth demand associated with the first transport layer security session is higher than a preset threshold and the dedicated session encryption channel is idle, the dedicated session encryption channel is allocated to the first transport layer security session; otherwise, the shared session encryption channel is allocated to the first transport layer security session.

5. The method according to claim 1, characterized in that The first transport layer security service channel is maintained by the hardware side, including: all intermediate states in the transport layer security record associated with any transport layer security session conducted through the first transport layer security service channel are unloaded to the hardware side.

6. The method according to claim 5, characterized in that The second transport layer security business channel is jointly maintained by the software side and the hardware side, including: all intermediate states in the transport layer security record associated with any transport layer security session conducted through the second transport layer security business channel are synchronously uploaded to the software side, and all plaintexts in the transport layer security record associated with any transport layer security session conducted through the second transport layer security business channel are unloaded to the hardware side.

7. The method according to claim 1, characterized in that The method further comprises: After the transport layer security service associated with the first transport layer security session is unloaded and before the first transport layer security session ends, switching between the first sending mode and the second sending mode is performed based on a real-time traffic detection result of the first transport layer security session.

8. The method according to claim 7, characterized in that The method further comprises: When the service requirements of the first transport layer security session indicate a high sensitivity to traffic fluctuations, switching between the first sending mode and the second sending mode is not performed.

9. The method according to claim 7, characterized in that: When the real-time traffic detection result of the first transport layer security session indicates low session traffic or link degradation, switching to the second sending mode, and continuing the first transport layer security session through the second transport layer security service channel; When the real-time traffic detection result of the first transport layer security session indicates high session traffic, switching to the first sending mode, and continuing the first transport layer security session through the first transport layer security service channel.

10. The method according to claim 1, characterized in that The first data specification is a preset data specification in a set of multiple preset data specifications, and the multiple preset data specifications are all smaller than the second data specification.

11. The method according to claim 1, characterized in that: The method further comprises: When the load on the hardware side exceeds a preset load upper limit, the first transport layer security service channel is closed, the second sending mode is switched to, and the first transport layer security session is continued through the second transport layer security service channel.

12. A computer device, characterized in that: The computer device comprises a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the method according to any one of claims 1 to 11 when executing the computer program.

13. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, which, when executed on a computer device, cause the computer device to perform the method according to any one of claims 1 to 11.

Images