Network security data processing system and switch

Abstract

The invention relates to the field of network security, and discloses a network security data processing system and a switch, the switch comprises a network port and a network security module, the network port is used for sequentially receiving encrypted data and a key suite from a network, the network security module is used for executing an encryption algorithm, and the network security module is used for decrypting the encrypted data by using a key length and a decryption algorithm; the network security module is configured with a prediction table, and the network security module records each decryption execution result, such as the key length, into the prediction table; if the key lengths of the latest continuous N execution results are the same, decrypting the next packet of encrypted data by using the predicted key length and a predicted decryption algorithm when or after receiving the next packet of encrypted data from the network port, thereby obtaining predicted plaintext data; and if the prediction is consistent with the reality, taking the predicted plaintext data as a decryption plaintext of the next packet of encrypted data. And the network security module performs efficient decryption by using the prediction table, so that the burden of the server is relieved, and the data processing time delay is reduced.

Description

Technical Field

[0001] The present invention relates to the field of network security, and in particular to a network security data processing system and a switch. Background Art

[0002] With the popularization of the Internet and the increase in data transmission, protecting data from unauthorized access and preventing data leakage have become important prerequisites for network data interaction. Therefore, network security, data processing and encryption technology have become crucial components in the modern computer environment. At the same time, with the development of computer hardware technology, the processing speed and efficiency of the CPU have become key factors affecting the overall performance of the computer.

[0003] In summary, improving CPU utilization and data processing efficiency while ensuring data security has become a major challenge in the current technology field.

[0004] At present, the ciphertext data is usually stored inside the computer. When the CPU needs to use this data, it needs to convert the ciphertext data into plaintext data before subsequent data processing. Although this method can ensure the security of data, it has at least the following problems: First, the CPU needs to spend extra time converting ciphertext data into plaintext data, which leads to reduced CPU utilization and delayed data processing; second, if the data is maliciously intercepted during transmission, if the intercepted data is decrypted plaintext data, then the attacker can obtain complete and valuable information.

[0005] In summary, there are still shortcomings in ensuring data security and improving CPU utilization.

[0006] The disclosure of the above background technology content is only used to assist in understanding the concept and technical solution of the present application. It does not necessarily belong to the prior art of the present application, nor does it necessarily provide technical guidance. In the absence of clear evidence that the above content has been disclosed before the filing date of the present application, the above background technology should not be used to evaluate the novelty and creativity of the present application. Summary of the invention

[0007] The purpose of the present invention is to provide a network security data processing system, which improves the switch to configure a network security module with a predictive key function to complete the decryption of network data, so that the processor can directly access the plaintext data and improve the utilization of the CPU.

[0008] To achieve the above object, the technical solution adopted by the present invention is as follows: A network security data processing system, comprising a switch, wherein the switch is configured with the following modules: a network port configured to sequentially receive encrypted data and a corresponding key suite from a network, the key suite being used to determine a key length and a decryption algorithm for decrypting the encrypted data, wherein the encrypted data is received earlier than the key suite; A network security module, which is configured to decrypt the encrypted data received from the network by the network port using a key length and a decryption algorithm; the network security module is configured with a decryption prediction table, and the network security module records the execution result of each data decryption in the decryption prediction table, wherein the execution result includes the key length; if the key lengths of the most recent N consecutive execution results in the decryption prediction table are the same, wherein N is a preset positive integer, then the key length is predicted to be the predicted key length corresponding to the next packet of encrypted data, and when or after receiving the next packet of encrypted data from the network port, the network security module decrypts the received next packet of encrypted data using the predicted key length and the predicted decryption algorithm to obtain predicted plaintext data; if the actual key length and the actual decryption algorithm determined according to the key suite corresponding to the next packet of encrypted data are consistent with the predicted key length and the predicted decryption algorithm, then the predicted plaintext data is used as the decrypted plaintext of the next packet of encrypted data.

[0009] Further, based on any one of the above-mentioned technical solutions or a combination of multiple technical solutions, before decrypting the next package of encrypted data using the predicted key length and the predicted decryption algorithm, the network security module backs up the next package of encrypted data; If the actual key length is inconsistent with the predicted key length, or the actual decryption algorithm is inconsistent with the predicted decryption algorithm, the next package of encrypted data backed up is decrypted using the actual key length and the actual decryption algorithm to obtain the actual plaintext data, which is used as the decrypted plaintext of the next package of encrypted data.

[0010] Further, based on any one of the above-mentioned technical solutions or a combination of multiple technical solutions, the predicted decryption algorithm is determined by the following method: The execution result recorded in the decryption prediction table also includes a decryption algorithm; The decryption algorithm of the most recent execution result recorded in the decryption prediction table is used as the predicted decryption algorithm; or, the decryption algorithm with the highest frequency recorded in the decryption prediction table is used as the predicted decryption algorithm.

[0011] Further, based on any one of the above-mentioned technical solutions or a combination of multiple technical solutions, the value of N is automatically adjusted in the following manner: The execution results recorded in the decryption prediction table also include correct or incorrect prediction results; If the prediction results are wrong for i consecutive times, then N is incremented by 1; If the prediction results are correct for j consecutive times and the current N is greater than 1, a subtraction operation of 1 is performed on N, where i and j are the same or different positive integers.

[0012] Further, based on any one of the above technical solutions or a combination of multiple technical solutions, the network security data processing system further includes a processor, and the switch is further configured with a processor port or a bus port connected to the processor; The network security module sends the decrypted plaintext of the next package of encrypted data to the processor through the processor port or the bus port; alternatively, the network security module first sends the decrypted plaintext of the next package of encrypted data to the computer memory or the external storage device, and the processor then reads the decrypted plaintext from the computer memory or the external storage device through the bus or the network security module.

[0013] Further, based on any one of the above-mentioned technical solutions or a combination of multiple technical solutions, the execution result recorded in the decryption prediction table also includes a target address; The network security module directly sends the decrypted plaintext of the next packet of encrypted data to the target address according to the target address; Alternatively, the network security module stores the decrypted plaintext of the next packet of encrypted data in a designated area of ​​an external storage device, and uses the physical address of the designated area as the processor's allowed access address, and the processor accesses the data at the physical address and stores it in the target address.

[0014] Further, based on any one of the above-mentioned technical solutions or a combination of multiple technical solutions, the network security data processing system also includes a computer memory, and the switch is also configured with a memory port or a bus port connected to the computer memory; The network security module sends the decrypted plain text of the next packet of encrypted data to the computer memory through the memory port or the bus port.

[0015] Further, based on any one of the above-mentioned technical solutions or a combination of multiple technical solutions, the network security data processing system further includes a storage device, and the switch is further configured with a storage port connected to the storage device; The network security module sends the decrypted plain text of the next packet of encrypted data to the storage device through the storage port.

[0016] Further, based on any one of the technical solutions or a combination of multiple technical solutions described above, the network security module pre-allocates a portion of the memory area in the storage device for a computer outside the system, and establishes a mapping relationship between the computer and the physical address of the portion of the memory area, allocates different memory areas to different computers and establishes corresponding mapping relationships; When an external computer sends a memory access task to the storage device through the network port, the network security module maps the logical address of the memory access task to the physical address of the storage device, and determines whether it exceeds the range of the corresponding mapped physical address of the computer. If it exceeds the range, the network security module terminates its memory access task.

[0017] Further, based on any one of the technical solutions or a combination of multiple technical solutions described above, the network security module is also configured to receive the plaintext data and its corresponding key suite sent by the processor through the processor port, the key suite is used to determine the key length and encryption algorithm for encrypting the plaintext data, wherein the plaintext data is received earlier than the key suite; the network security module is configured with an encryption prediction table, and the network security module records the execution result of each data encryption in the encryption prediction table, wherein the execution result includes the key length; if there are the same key lengths of the most recent M consecutive execution results in the encryption prediction table, wherein M is a preset positive integer, then the key length is predicted to be the predicted key length corresponding to the next packet of plaintext data, and when or after receiving the next packet of plaintext data from the processor port, the network security module uses the predicted key length and the predicted encryption algorithm to encrypt the received next packet of plaintext data to obtain the predicted encrypted data; if the actual key length and the actual encryption algorithm determined according to the key suite corresponding to the next packet of plaintext data are consistent with the predicted key length and the predicted encryption algorithm, then the predicted encrypted data is used as the encrypted ciphertext of the next packet of plaintext data.

[0018] Further, based on any one of the technical solutions or a combination of multiple technical solutions described above, the network security module stores the encrypted data and its corresponding key suite separately, and / or the network security module stores the plaintext data and its corresponding key suite separately.

[0019] According to another aspect of the present invention, the present invention provides a network security data processing system, comprising a processor and a switch, wherein the switch is configured with the following modules: a processor port configured to connect to the processor; A network security module, configured to receive plaintext data and its corresponding key suite sent by the processor through the processor port, the key suite being used to determine the key length and encryption algorithm for encrypting the plaintext data, wherein the plaintext data is received earlier than the key suite; the network security module is configured with an encryption prediction table, and the network security module records the execution result of each data encryption into the encryption prediction table, wherein the execution result includes the key length; if the key lengths of the most recent M consecutive execution results in the encryption prediction table are the same, wherein M is a preset positive integer, then the key length is predicted to be the predicted key length corresponding to the next packet of plaintext data, and when or after receiving the next packet of plaintext data from the processor port, the network security module encrypts the received next packet of plaintext data using the predicted key length and the predicted encryption algorithm to obtain the predicted encrypted data; if the actual key length and the actual encryption algorithm determined according to the key suite corresponding to the next packet of plaintext data are consistent with the predicted key length and the predicted encryption algorithm, then the predicted encrypted data is used as the encrypted ciphertext of the next packet of plaintext data.

[0020] Further, based on any one of the above technical solutions or a combination of multiple technical solutions, the network security data processing system further includes a network port, which is configured to send the encrypted ciphertext output by the network security module to the network; There are multiple processor ports and processors in one-to-one correspondence, the network security module configures a different encryption prediction table for each processor port, and the network security module records the execution result of encrypting data from the processor port in the encryption prediction table corresponding to the processor port.

[0021] According to another aspect of the present invention, the present invention provides a switch, comprising: a network port configured to sequentially receive encrypted data and a corresponding key suite from a network, the key suite being used to determine a key length and a decryption algorithm for decrypting the encrypted data, wherein the encrypted data is received earlier than the key suite; A network security module, which is configured to decrypt the encrypted data received from the network by the network port using a key length and a decryption algorithm; the network security module is configured with a decryption prediction table, and the network security module records the execution result of each data decryption in the decryption prediction table, wherein the execution result includes the key length; if the key lengths of the most recent N consecutive execution results in the decryption prediction table are the same, wherein N is a preset positive integer, then the key length is predicted to be the predicted key length corresponding to the next packet of encrypted data, and when or after receiving the next packet of encrypted data from the network port, the network security module decrypts the received next packet of encrypted data using the predicted key length and the predicted decryption algorithm to obtain predicted plaintext data; if the actual key length and the actual decryption algorithm determined according to the key suite corresponding to the next packet of encrypted data are consistent with the predicted key length and the predicted decryption algorithm, then the predicted plaintext data is used as the decrypted plaintext of the next packet of encrypted data.

[0022] According to another aspect of the present invention, the present invention provides a switch, comprising: a processor port configured to connect to a processor external to the switch; A network security module, configured to receive plaintext data and its corresponding key suite sent by the processor through the processor port, the key suite being used to determine the key length and encryption algorithm for encrypting the plaintext data, wherein the plaintext data is received earlier than the key suite; the network security module is configured with an encryption prediction table, and the network security module records the execution result of each data encryption into the encryption prediction table, wherein the execution result includes the key length; if the key lengths of the most recent M consecutive execution results in the encryption prediction table are the same, wherein M is a preset positive integer, then the key length is predicted to be the predicted key length corresponding to the next packet of plaintext data, and when or after receiving the next packet of plaintext data from the processor port, the network security module encrypts the received next packet of plaintext data using the predicted key length and the predicted encryption algorithm to obtain the predicted encrypted data; if the actual key length and the actual encryption algorithm determined according to the key suite corresponding to the next packet of plaintext data are consistent with the predicted key length and the predicted encryption algorithm, then the predicted encrypted data is used as the encrypted ciphertext of the next packet of plaintext data.

[0023] The beneficial effects brought by the technical solution provided by the present invention are as follows: a. The switch is improved to set up a network security module, using a prediction table to predict the key length of the next data, so that while waiting for the key suite to be transmitted, the prediction information can be used in advance to encrypt or decrypt the next packet of data, thereby improving the encryption / decryption efficiency; b. The switch performs efficient decryption, and the processor can directly obtain or access the plaintext data after decryption of network data, improving data processing efficiency and reducing the computing burden of the processor; c. The processor only needs to send the processed data in plain text directly to the switch, which will perform efficient encryption and send it to the network, ensuring data security while reducing the computing burden of the light processor, thereby improving the data processing efficiency of the processor and reducing latency. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0025] Figure 1 A schematic block diagram of a network security data processing system provided for an exemplary embodiment of the present invention; Figure 2 A schematic diagram of a process flow of efficient decryption of a network security module provided by an exemplary embodiment of the present invention; Figure 3 A schematic diagram of a process flow of efficient encryption of a network security module provided by an exemplary embodiment of the present invention. DETAILED DESCRIPTION

[0026] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0027] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, device, product or equipment that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or equipment.

[0028] The present invention aims to solve the problem that the CPU needs to spend extra time to convert ciphertext data into plaintext data, resulting in reduced CPU utilization, so as to reduce the delay of CPU processing data; on the other hand, a switch with a newly added network security module is used to intervene between the CPU and the storage device to solve the problem that the CPU is intercepted during the transmission of plaintext data, allowing attackers to obtain valuable information.

[0029] In one embodiment of the present invention, a network security data processing system is provided. Figure 1 As shown, the system includes a switch, wherein the switch is configured with the following modules: a network port configured to sequentially receive encrypted data and a corresponding key suite from a network, the key suite being used to determine a key length and a decryption algorithm for decrypting the encrypted data, wherein the encrypted data is received earlier than the key suite; A network security module is configured to decrypt the encrypted data received by the network port from the network using a key length and a decryption algorithm; the network security module is configured with a decryption prediction table to achieve the following Figure 2 The efficient decryption shown: the network security module records the execution result of each data decryption into the decryption prediction table, wherein the execution result includes the key length; if the key length of the most recent N consecutive execution results is the same in the decryption prediction table, wherein N is a preset positive integer, then the key length is predicted to be the predicted key length corresponding to the next packet of encrypted data, and when or after receiving the next packet of encrypted data from the network port, the network security module uses the predicted key length and the predicted decryption algorithm to decrypt the received next packet of encrypted data to obtain the predicted plaintext data; if the actual key length and the actual decryption algorithm determined according to the key suite corresponding to the next packet of encrypted data are consistent with the predicted key length and the predicted decryption algorithm, that is, the prediction is correct, then the predicted plaintext data is used as the decrypted plaintext of the next packet of encrypted data, where the next packet of encrypted data refers to the encrypted data to be decrypted currently. The predicted decryption algorithm here can be determined in the following ways: the execution result recorded in the decryption prediction table also includes the decryption algorithm; the decryption algorithm of the most recent execution result recorded in the decryption prediction table is used as the predicted decryption algorithm; or, the decryption algorithm with the highest frequency recorded in the decryption prediction table is used as the predicted decryption algorithm.

[0030] The result of predicting the key length may be correct or may be wrong (if either the key length or the decryption algorithm does not match, it is deemed to be a prediction error). In this case, the encrypted data needs to be backed up in advance so that in the event of a prediction error, the actual key length received can be used to decrypt the data. That is, before using the predicted key length and the predicted decryption algorithm to decrypt the next package of encrypted data, the network security module backs up the next package of encrypted data; if the actual key length is inconsistent with the predicted key length, or the actual decryption algorithm is inconsistent with the predicted decryption algorithm, the actual key length and the actual decryption algorithm are used to decrypt the backed up next package of encrypted data to obtain the actual plaintext data, and use it as the decrypted plaintext of the next package of encrypted data.

[0031] It should be noted that there are more than one implementation method for dealing with prediction errors. For example, if there is no backup data and a prediction error occurs, you can request to send the encrypted data again.

[0032] The present invention proposes that in the process of waiting for the transmission of the secret key suite, the switch uses the prediction table of the network security module to predict the key length of the current data packet to decrypt in advance to obtain the decrypted plaintext; after receiving and parsing the key suite, it is determined whether the prediction is correct or wrong to decide whether to use the decrypted plaintext obtained by the advance decryption: if the prediction is correct, the decrypted plaintext is used, which saves time and improves the decryption efficiency of the network security module; if the prediction is wrong, it is not used, and the backup or retransmitted encrypted data is decrypted normally, that is, it is decrypted using the actual key length and the actual decryption algorithm, and no extra time is wasted compared to a solution without predicting the key.

[0033] In the above embodiment, the key length of the most recent N consecutive execution results in the decryption prediction table is the same as the condition for triggering the prediction operation. If N is set too large, the possibility of accurately predicting to improve the decryption efficiency will be missed; if N is set too small, the prediction failure rate may be too high, wasting the computing power of the network security module. Therefore, whether the value of N is suitable for the current data transmission situation is also critical. In one embodiment of the present invention, the value of N can be automatically adjusted in the following way: The execution results recorded in the decryption prediction table also include correct or incorrect prediction results; If the prediction results are wrong for i consecutive times, then N is incremented by 1; If the prediction results are correct for j consecutive times and the current N is greater than 1, then N is decremented by 1, where i and j are the same or different positive integers. The value of N is not a fixed constant, so that when the data transmission situation changes, the value of N can be automatically and adaptively adjusted to trigger a prediction action that is more in line with the actual situation.

[0034] like Figure 1 As shown, the network security data processing system further includes a processor, and the switch is further configured with a processor port or a bus port connected to the processor; The network security module sends the decrypted plaintext of the next package of encrypted data to the processor through the processor port or the bus port; alternatively, the network security module first sends the decrypted plaintext of the next package of encrypted data to the computer memory or the external storage device, and the processor then reads the decrypted plaintext from the computer memory or the external storage device through the bus or the network security module.

[0035] In a specific embodiment, the execution result recorded in the decryption prediction table also includes a target address; The network security module directly sends the decrypted plaintext of the next packet of encrypted data to the target address according to the target address; Alternatively, the network security module stores the decrypted plaintext of the next packet of encrypted data in a designated area of ​​an external storage device, and uses the physical address of the designated area as the processor's allowed access address, and the processor accesses the data at the physical address and stores it in the target address.

[0036] In addition to the processor port, the switch is also configured with a memory port or a bus port, and the network security data processing system also includes a computer memory, and the memory port or the bus port is connected to the computer memory; the network security module sends the decrypted plaintext of the next packet of encrypted data to the computer memory through the memory port or the bus port, so that the subsequent processor can directly access the plaintext data to the computer memory.

[0037] Similar to the memory port, the switch is also configured with a storage port, and the network security data processing system also includes a storage device, and the storage port is connected to the storage device; the network security module sends the decrypted plaintext of the next packet of encrypted data to the storage device through the storage port, so that the subsequent processor can directly access the plaintext data from the storage device.

[0038] The above embodiment provides an embodiment in which a switch uses a network security module to efficiently decrypt encrypted data transmitted over a network, so that a processor can directly obtain plaintext data, or access plaintext data from a computer memory or a storage device external to the switch, thereby improving the efficiency of the processor in processing data, reducing the delay in data processing, and alleviating the burden on the processor, which has obvious advantages.

[0039] The following embodiment will provide a method for a switch to efficiently encrypt plaintext data sent by a processor using a network security module, which can also reduce the burden on the processor, improve its data processing efficiency, and reduce the delay of data processing. The details are as follows: The network security module receives the plaintext data and its corresponding key suite sent by the processor through the processor port, and the key suite is used to determine the key length and encryption algorithm for encrypting the plaintext data, wherein the plaintext data is received earlier than the key suite; the network security module is configured with an encryption prediction table to achieve the following Figure 3 The efficient encryption shown: the network security module records the execution result of each data encryption into the encryption prediction table, wherein the execution result includes the key length; if the key length of the most recent M consecutive execution results in the encryption prediction table is the same, wherein M is a preset positive integer, then the key length is predicted to be the predicted key length corresponding to the next packet of plaintext data, and when or after receiving the next packet of plaintext data from the processor port, the network security module uses the predicted key length and the predicted encryption algorithm to encrypt the received next packet of plaintext data to obtain the predicted encrypted data; if the actual key length and the actual encryption algorithm determined according to the key suite corresponding to the next packet of plaintext data are consistent with the predicted key length and the predicted encryption algorithm, then the predicted encrypted data is used as the encrypted ciphertext of the next packet of plaintext data.

[0040] Similarly, the predicted encryption algorithm here can be determined in the following ways: the execution result recorded in the encryption prediction table also includes an encryption algorithm; the encryption algorithm of the most recent execution result recorded in the encryption prediction table is used as the predicted encryption algorithm; or, the encryption algorithm with the highest frequency recorded in the encryption prediction table is used as the predicted encryption algorithm.

[0041] In this embodiment, the result of predicting the key length may be correct or may be wrong (if any one of the key length and encryption algorithm does not match, it is considered a prediction error). In this case, the plaintext data needs to be backed up in advance so that the actual key length received can be used to encrypt the data in the event of a prediction error. That is, before using the predicted key length and the predicted encryption algorithm to encrypt the next package of plaintext data, the network security module backs up the next package of plaintext data; if the actual key length is inconsistent with the predicted key length, or the actual encryption algorithm is inconsistent with the predicted encryption algorithm, the actual key length and the actual encryption algorithm are used to encrypt the backed up next package of plaintext data to obtain the actual encrypted data, and use it as the encrypted ciphertext of the next package of plaintext data. Similarly, in addition to the implementation method of backing up the next package of plaintext data, the processor can also resend the plaintext data in the event of a prediction error.

[0042] The present invention proposes that in the process of waiting for the processor to transmit the key suite, the switch uses the prediction table of the network security module to predict the key length of the current data packet to encrypt in advance to obtain an encrypted ciphertext; after receiving and parsing the key suite, it is determined whether the prediction is correct or wrong to decide whether to use the encrypted ciphertext obtained by the advance encryption: if the prediction is correct, the encrypted ciphertext is used, which saves time and improves the encryption efficiency of the network security module; if the prediction is wrong, it is not used, and the backed up or retransmitted plaintext data is encrypted normally, that is, it is encrypted using the actual key length and the actual encryption algorithm, and no extra time is wasted compared to a solution without predicting the key.

[0043] Similarly, in the encryption prediction table, the key length of the most recent M consecutive execution results is the same as the condition for triggering the prediction operation. If M is set too large, the possibility of accurate prediction to improve encryption efficiency will be missed; if M is set too small, the prediction failure rate may be too high, wasting the computing power of the network security module. Therefore, it is also critical whether the value of M is suitable for the current data transmission situation. Similarly, the value of M can be automatically adjusted in the following ways: The execution results recorded in the encrypted prediction table also include correct or incorrect prediction results; If continuous i' If the prediction result is wrong, the M is incremented by 1. If continuous j’ If the prediction result is correct and the current M is greater than 1, then M is decremented by 1, where i' , j'The value of M is not a fixed constant, so that when the data transmission status changes, the value of M can be automatically and adaptively adjusted to trigger a prediction action that is more in line with the actual situation.

[0044] In the above embodiments, the network security module stores the encrypted data and its corresponding key suite separately, and / or the network security module stores the plaintext data and its corresponding key suite separately. Placing the key suite in a specific location in the storage device can facilitate user management and maintenance, and in particular can avoid the risk of leakage together with the encrypted data.

[0045] The processor is only responsible for sending the processed plaintext data to the switch. The switch uses the network security module to efficiently encrypt the plaintext data using a prediction table, and then the encrypted ciphertext can be sent to an external computer on the network through the network port.

[0046] In a specific embodiment, the processor ports correspond to multiple processors in a one-to-one manner. Some processors may be CPUs, and some processors may be GPUs. Different processors are connected to the same switch through ports to achieve interaction between different processors. On the other hand, the processors may also access computer memory or storage devices external to the switch through different ports of the switch.

[0047] The network security module can also configure different encryption prediction tables for each processor port. The network security module records the execution results of encrypting data from the processor port in the encryption prediction table corresponding to the processor port. In this case, a single prediction table can be used to count whether there is a situation where the key lengths of the most recent M consecutive execution results are the same.

[0048] In view of the above data processing system embodiments capable of efficient decryption and data processing system embodiments capable of efficient encryption, or data processing system embodiments combining efficient decryption with efficient encryption, an embodiment for further improving the security level is proposed here: the network security module pre-allocates a portion of the memory area in the storage device for a computer outside the system, and establishes a mapping relationship between the computer and the physical address of the portion of the memory area, allocates different memory areas to different computers and establishes corresponding mapping relationships; when an external computer sends a memory access task to the storage device through the network port, the network security module maps the logical address of the memory access task to the physical address of the storage device, and determines whether it exceeds the range of the corresponding mapped physical address of the computer. If it exceeds the range, the network security module terminates its memory access task.

[0049] That is to say, the network security module can allocate a section of the storage space to each access task. Specifically, when a task needs to access data in the storage device, the network security module will set the memory access permission of the corresponding data physical address to be accessible to this memory access task according to the storage location of the data requested for access, map the logical address of the memory access task to the physical address of the storage device, and establish a mapping table at the same time. The table shows the mapping relationship between the logical address and the physical address of the memory that the task can access. When the memory access is out of bounds, that is, there is no mapping relationship between the logical address of the memory access task and the physical address of the target data it requests to access, the network security module terminates the memory access task.

[0050] In one embodiment of the present invention, a switch is provided, including a network port and a network security module, wherein: The network port is configured to sequentially receive encrypted data and its corresponding key suite from the network, the key suite being used to determine a key length and a decryption algorithm for decrypting the encrypted data, wherein the encrypted data is received earlier than the key suite; The network security module is configured to decrypt the encrypted data received by the network port from the network using the key length and the decryption algorithm; the network security module is configured with a decryption prediction table, and the network security module records the execution result of each data decryption in the decryption prediction table, wherein the execution result includes the key length; if the key lengths of the most recent N consecutive execution results in the decryption prediction table are the same, wherein N is a preset positive integer, then the key length is predicted to be the predicted key length corresponding to the next packet of encrypted data, and when or after receiving the next packet of encrypted data from the network port, the network security module uses the predicted key length and the predicted decryption algorithm to decrypt the next packet of encrypted data received to obtain predicted plaintext data; if the actual key length and the actual decryption algorithm determined according to the key suite corresponding to the next packet of encrypted data are consistent with the predicted key length and the predicted decryption algorithm, then the predicted plaintext data is used as the decrypted plaintext of the next packet of encrypted data.

[0051] The switch provided in this embodiment and the network security data processing system capable of efficient decryption provided in the above-mentioned embodiment have the same concept. The entire contents of the embodiment of the network security data processing system for efficient decryption using a decryption prediction table are incorporated into the present switch embodiment by way of full reference and will not be repeated here.

[0052] In yet another embodiment of the present invention, a switch is provided, comprising a processor port and a network security module, wherein: The processor port is configured to connect to a processor external to the switch; The network security module is configured to receive the plaintext data and its corresponding key suite sent by the processor through the processor port, the key suite is used to determine the key length and encryption algorithm for encrypting the plaintext data, wherein the plaintext data is received earlier than the key suite; the network security module is configured with an encryption prediction table, and the network security module records the execution result of each data encryption into the encryption prediction table, wherein the execution result includes the key length; if the key lengths of the most recent M consecutive execution results in the encryption prediction table are the same, wherein M is a preset positive integer, then the key length is predicted to be the predicted key length corresponding to the next packet of plaintext data, and when or after receiving the next packet of plaintext data from the processor port, the network security module encrypts the received next packet of plaintext data using the predicted key length and the predicted encryption algorithm to obtain the predicted encrypted data; if the actual key length and the actual encryption algorithm determined according to the key suite corresponding to the next packet of plaintext data are consistent with the predicted key length and the predicted encryption algorithm, then the predicted encrypted data is used as the encrypted ciphertext of the next packet of plaintext data.

[0053] The switch provided in this embodiment and the network security data processing system capable of efficient encryption provided in the above-mentioned embodiment have the same concept. The entire contents of the embodiment of the network security data processing system that uses the encryption prediction table for efficient encryption are incorporated into the present switch embodiment by full reference and will not be repeated here.

[0054] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0055] The above is only a specific implementation of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A network security data processing system, characterized in that: including a switch, wherein The switch is configured with the following modules: a network port configured to sequentially receive encrypted data and a corresponding key suite from a network, the key suite being used to determine a key length and a decryption algorithm for decrypting the encrypted data, wherein the encrypted data is received earlier than the key suite; A network security module, which is configured to decrypt the encrypted data received from the network by the network port using a key length and a decryption algorithm; the network security module is configured with a decryption prediction table, and the network security module records the execution result of each data decryption in the decryption prediction table, wherein the execution result includes the key length; if the key lengths of the most recent N consecutive execution results in the decryption prediction table are the same, wherein N is a preset positive integer, then the key length is predicted to be the predicted key length corresponding to the next packet of encrypted data, and when or after receiving the next packet of encrypted data from the network port, the network security module decrypts the received next packet of encrypted data using the predicted key length and the predicted decryption algorithm to obtain predicted plaintext data; if the actual key length and the actual decryption algorithm determined according to the key suite corresponding to the next packet of encrypted data are consistent with the predicted key length and the predicted decryption algorithm, then the predicted plaintext data is used as the decrypted plaintext of the next packet of encrypted data.

2. The network security data processing system according to claim 1, characterized in that: Before decrypting the next packet of encrypted data using the predicted key length and the predicted decryption algorithm, the network security module backs up the next packet of encrypted data; If the actual key length is inconsistent with the predicted key length, or the actual decryption algorithm is inconsistent with the predicted decryption algorithm, the next package of encrypted data backed up is decrypted using the actual key length and the actual decryption algorithm to obtain the actual plaintext data, which is used as the decrypted plaintext of the next package of encrypted data.

3. The network security data processing system according to claim 1, characterized in that: The predicted decryption algorithm is determined by: The execution result recorded in the decryption prediction table also includes a decryption algorithm; The decryption algorithm of the most recent execution result recorded in the decryption prediction table is used as the predicted decryption algorithm; or, the decryption algorithm with the highest frequency recorded in the decryption prediction table is used as the predicted decryption algorithm.

4. The network security data processing system according to claim 1, characterized in that: The value of N is automatically adjusted in the following way: The execution results recorded in the decryption prediction table also include correct or incorrect prediction results; If continuous i If the prediction result is wrong, the N is incremented by 1. If continuous j If the prediction result is correct and the current N is greater than 1, then N is decremented by 1, where i , j are the same or different positive integers.

5. The network security data processing system according to claim 1, characterized in that: Also comprising a processor, the switch is further configured with a processor port or a bus port connected to the processor; The network security module sends the decrypted plaintext of the next package of encrypted data to the processor through the processor port or the bus port; alternatively, the network security module first sends the decrypted plaintext of the next package of encrypted data to the computer memory or the external storage device, and the processor then reads the decrypted plaintext from the computer memory or the external storage device through the bus or the network security module.

6. The network security data processing system according to claim 5, characterized in that: The execution result recorded in the decryption prediction table also includes a target address; The network security module directly sends the decrypted plaintext of the next packet of encrypted data to the target address according to the target address; Alternatively, the network security module stores the decrypted plaintext of the next packet of encrypted data in a designated area of ​​an external storage device, and uses the physical address of the designated area as the processor's allowed access address, and the processor accesses the data at the physical address and stores it in the target address.

7. The network security data processing system according to claim 1, characterized in that: Also includes a computer memory, and the switch is further configured with a memory port or a bus port connected to the computer memory; The network security module sends the decrypted plain text of the next packet of encrypted data to the computer memory through the memory port or the bus port.

8. The network security data processing system according to claim 1, characterized in that: Also comprising a storage device, the switch is further configured with a storage port connected to the storage device; The network security module sends the decrypted plain text of the next packet of encrypted data to the storage device through the storage port.

9. The network security data processing system according to claim 8, characterized in that: The network security module pre-allocates a portion of the memory area in the storage device for a computer outside the system, and establishes a mapping relationship between the computer and the physical address of the portion of the memory area, allocates different memory areas to different computers and establishes corresponding mapping relationships; When an external computer sends a memory access task to the storage device through the network port, the network security module maps the logical address of the memory access task to the physical address of the storage device, and determines whether it exceeds the range of the corresponding mapped physical address of the computer. If it exceeds the range, the network security module terminates its memory access task.

10. The network security data processing system according to claim 1, characterized in that: The network security module is further configured to receive, through the processor port, plaintext data sent by the processor and a corresponding key suite, the key suite being used to determine a key length and an encryption algorithm for encrypting the plaintext data, wherein a reception time of the plaintext data is earlier than the key suite; The network security module is configured with an encryption prediction table, and the network security module records the execution result of each data encryption into the encryption prediction table, wherein the execution result includes the key length; if the key lengths of the most recent M consecutive execution results in the encryption prediction table are the same, wherein M is a preset positive integer, then the key length is predicted to be the predicted key length corresponding to the next packet of plaintext data, and when or after receiving the next packet of plaintext data from the processor port, the network security module uses the predicted key length and the predicted encryption algorithm to encrypt the received next packet of plaintext data to obtain the predicted encrypted data; if the actual key length and the actual encryption algorithm determined according to the key suite corresponding to the next packet of plaintext data are consistent with the predicted key length and the predicted encryption algorithm, then the predicted encrypted data is used as the encrypted ciphertext of the next packet of plaintext data.

11. The network security data processing system according to claim 10, characterized in that: The network security module stores the encrypted data and its corresponding key suite separately, and / or the network security module stores the plaintext data and its corresponding key suite separately.

12. A network security data processing system, characterized in that: The invention comprises a processor and a switch, wherein the switch is configured with the following modules: a processor port configured to connect to the processor; A network security module, configured to receive plaintext data and its corresponding key suite sent by the processor through the processor port, the key suite being used to determine the key length and encryption algorithm for encrypting the plaintext data, wherein the plaintext data is received earlier than the key suite; the network security module is configured with an encryption prediction table, and the network security module records the execution result of each data encryption into the encryption prediction table, wherein the execution result includes the key length; if there are the same key lengths of the most recent M consecutive execution results in the encryption prediction table, wherein M is a preset positive integer, then the key length is predicted to be the predicted key length corresponding to the next packet of plaintext data, and when or after receiving the next packet of plaintext data from the processor port, the network security module encrypts the received next packet of plaintext data using the predicted key length and the predicted encryption algorithm to obtain the predicted encrypted data; if the actual key length and the actual encryption algorithm determined according to the key suite corresponding to the next packet of plaintext data are consistent with the predicted key length and the predicted encryption algorithm, then the predicted encrypted data is used as the encrypted ciphertext of the next packet of plaintext data.

13. The network security data processing system according to claim 12, characterized in that: Also included is a network port configured to send the encrypted ciphertext output by the network security module to a network; There are multiple processor ports and processors in one-to-one correspondence, the network security module configures a different encryption prediction table for each processor port, and the network security module records the execution result of encrypting data from the processor port in the encryption prediction table corresponding to the processor port.

14. A switch, characterized in that: include: a network port configured to sequentially receive encrypted data and a corresponding key suite from a network, the key suite being used to determine a key length and a decryption algorithm for decrypting the encrypted data, wherein the encrypted data is received earlier than the key suite; A network security module, which is configured to decrypt the encrypted data received from the network by the network port using a key length and a decryption algorithm; the network security module is configured with a decryption prediction table, and the network security module records the execution result of each data decryption in the decryption prediction table, wherein the execution result includes the key length; if the key lengths of the most recent N consecutive execution results in the decryption prediction table are the same, wherein N is a preset positive integer, then the key length is predicted to be the predicted key length corresponding to the next packet of encrypted data, and when or after receiving the next packet of encrypted data from the network port, the network security module decrypts the received next packet of encrypted data using the predicted key length and the predicted decryption algorithm to obtain predicted plaintext data; if the actual key length and the actual decryption algorithm determined according to the key suite corresponding to the next packet of encrypted data are consistent with the predicted key length and the predicted decryption algorithm, then the predicted plaintext data is used as the decrypted plaintext of the next packet of encrypted data.

15. A switch, characterized in that: include: a processor port configured to connect to a processor external to the switch; a network security module, configured to receive, through the processor port, plaintext data sent by the processor and a corresponding key suite, the key suite being used to determine a key length and an encryption algorithm for encrypting the plaintext data, wherein a reception time of the plaintext data is earlier than the key suite; The network security module is configured with an encryption prediction table, and the network security module records the execution result of each data encryption into the encryption prediction table, wherein the execution result includes the key length; if the key lengths of the most recent M consecutive execution results in the encryption prediction table are the same, wherein M is a preset positive integer, then the key length is predicted to be the predicted key length corresponding to the next packet of plaintext data, and when or after receiving the next packet of plaintext data from the processor port, the network security module uses the predicted key length and the predicted encryption algorithm to encrypt the received next packet of plaintext data to obtain the predicted encrypted data; if the actual key length and the actual encryption algorithm determined according to the key suite corresponding to the next packet of plaintext data are consistent with the predicted key length and the predicted encryption algorithm, then the predicted encrypted data is used as the encrypted ciphertext of the next packet of plaintext data.

Images