Data transmission method, device and equipment, medium and computer program product

Abstract

The invention discloses a data transmission method and device, equipment, a medium and a computer program product, relates to the technical field of security, is applied to any distributed cache in a multiprocessor computing architecture, and comprises the following steps: obtaining a data reading request sent by a target central processing unit and used for reading target data; if the currently used security mechanism is a preset first-class security mechanism, performing identity authentication on the target central processing unit; the first type security mechanism is used for carrying out identity authentication on nodes sending requests, carrying out ciphertext transmission on data between the nodes and carrying out ciphertext storage on the data in each distributed cache; if the identity authentication is passed, judging whether plaintext data which is stored in the preset buffer area and decrypts a local target cache line in advance is target data or not; and if any distributed cache is not the local cache of the target central processing unit, replacing the ciphertext data in the target cache line with the plaintext data, encrypting the plaintext data, and transmitting the encrypted plaintext data to the target central processing unit.

Description

Technical Field

[0001] The present invention relates to the field of security technology, and in particular to a data transmission method, device, equipment, medium and computer program product. Background Art

[0002] In order to improve the computing performance of modern computer systems, multi-processor architecture has become the mainstream computing architecture. As the number of processors increases, it becomes increasingly important to ensure data consistency and system security. The multi-processor computing architecture allows the processor and memory resources in the system to be expanded in units of nodes, so that the scale of the system can be flexibly adjusted when adding processors and memory; each processor usually has local memory, and the processor has a low latency in accessing local memory, which helps to reduce memory access latency and improve the collaborative performance between processors. In addition, the multi-processor computing architecture requires inter-node cache to store frequently accessed data, and a cache consistency protocol is required to handle multiple nodes' access to cached data.

[0003] Currently, the main method to improve the security of system data and maintain cache consistency is to encrypt cache data and memory data. However, in the consistency protocol, in addition to the possibility that a certain node may be attacked, the link layer in the cache protocol may also be intercepted and stolen. Therefore, the existing method is limited to the security of cache and local memory data, and does not involve the problem of data tampering and theft between multi-processor architecture nodes. In addition, since the cache needs to be encrypted, when the CPU (Central Processing Unit) accesses the cache, the encrypted data in the cache needs to be decrypted before it can be used, which will greatly affect the computing performance of the system. In addition, there is only a single security protection method in the existing solution, which cannot adapt to task scenarios with different security requirements, and lacks flexibility and compatibility.

[0004] In summary, in a multi-processor computing architecture, how to adapt to task scenarios with different security requirements and further improve the security of system data and improve the computing performance of the system are issues that need to be resolved. Summary of the invention

[0005] In view of this, the purpose of the present invention is to provide a data transmission method, device, equipment, medium and computer program product, which can adapt to task scenarios with different security requirements in a multi-processor computing architecture, and further improve the security of system data and improve the computing performance of the system. The specific scheme is as follows:

[0006] In a first aspect, the present application discloses a data transmission method, which is applied to any distributed cache in a multi-processor computing architecture, wherein the multi-processor computing architecture is set based on a cache consistency protocol and includes multiple central processing units as source nodes and multiple distributed caches as destination nodes, and the method includes:

[0007] Obtaining a data read request sent by a target central processing unit for reading target data;

[0008] If the currently used security mechanism is a preset first-class security mechanism, the target central processor is authenticated; the first-class security mechanism is used to represent the authentication of the node sending the request, the encrypted transmission of data between nodes, and the encrypted storage of data in each distributed cache;

[0009] If the identity authentication result indicates that the authentication is passed, determining whether the plaintext data stored in the preset buffer after pre-decrypting the local target cache line is the target data;

[0010] If it is the target data and any of the distributed caches is not the local cache of the target CPU, the ciphertext data in the target cache line is replaced by the plaintext data, and the plaintext data is encrypted by a preset encryption algorithm before being transmitted to the target CPU.

[0011] Optionally, the data transmission method further includes:

[0012] If the currently used security mechanism is a preset second-type security mechanism, the target data stored in the distributed cache is transmitted to the target central processor based on the second-type security mechanism; wherein the second-type security mechanism is used to represent identity authentication of the node sending the request, encrypted data transmission between nodes, and plaintext storage of data in each distributed cache;

[0013] If the currently used security mechanism is a preset third-type security mechanism, the target data stored in the distributed cache is transmitted to the target central processor based on the third-type security mechanism; wherein the third-type security mechanism is used to characterize identity authentication of the node sending the request, plaintext transmission of data between nodes, and plaintext storage of data in each distributed cache;

[0014] If the security mechanism currently used is the preset fourth-type security mechanism, the target data stored in the distributed cache is transmitted to the target central processor based on the fourth-type security mechanism; wherein the fourth-type security mechanism is used to characterize that no identity authentication is performed on the node sending the request, data is transmitted in plain text between nodes, and data is stored in plain text in each distributed cache.

[0015] Optionally, after determining whether the plaintext data stored in the preset buffer after pre-decrypting the local target cache line is the target data, the method further includes:

[0016] If it is the target data and any of the distributed caches is a local cache of the target central processor, the ciphertext data in the target cache line is replaced with the plaintext data, and the plaintext data is transmitted to the target central processor.

[0017] Optionally, after determining whether the plaintext data stored in the preset buffer after pre-decrypting the local target cache line is the target data, the method further includes:

[0018] If the plaintext data stored in the preset buffer is not the target data, locally determining the cache line where the target data is located, and decrypting the ciphertext data in the cache line where the target data is located to obtain the plaintext data;

[0019] The plaintext data is encrypted using a preset encryption algorithm and then transmitted to the target central processing unit.

[0020] Optionally, a preset trusted node information table is provided in each of the distributed caches, and the preset trusted node information table stores a list of node identifiers of nodes that are allowed to be accessed and corresponding valid access periods;

[0021] Accordingly, the identity authentication of the target central processor includes:

[0022] Parsing the data read request to obtain a target node identifier of the target central processor, and determining whether the target node identifier is located in the node identifier list;

[0023] If the target node identifier is in the node identifier list, it is determined whether the valid access period is currently met. If the valid access period is currently met, an identity authentication result indicating that the authentication is successful is obtained.

[0024] Optionally, the data transmission method further includes:

[0025] If the target node identifier is not in the node identifier list, an identity authentication result indicating that the authentication has failed is obtained;

[0026] Or, if the target node identifier is in the node identifier list but the valid access period is not currently satisfied, an identity authentication result indicating that the authentication has failed is obtained.

[0027] Optionally, the data transmission method further includes:

[0028] If the identity authentication result indicates that the authentication has not passed, the data read request is stored in a preset request temporary storage area, and the target node identifier is sent to a preset node trusted management unit so as to obtain the latest node identifier sent by the node trusted management unit based on the target node identifier, so as to re-authenticate the target central processor based on the latest node identifier.

[0029] Optionally, sending the target node identifier to a preset node trusted management unit so as to obtain a latest node identifier sent by the node trusted management unit based on the target node identifier, so as to re-authenticate the target central processor based on the latest node identifier, includes:

[0030] Sending the target node identifier to a preset node trusted management unit so that the node trusted management unit determines whether the target node identifier exists in its own trusted node identifier table;

[0031] If the target node identifier does not exist in the trusted node identifier table of the node trusted management unit itself, obtaining an alarm message sent by the node trusted management unit;

[0032] If the target node identifier exists in the trusted node identifier table of the node trusted management unit itself, the node trusted management unit generates a latest node identifier based on the physical address of the target central processor, and sends the latest node identifier to the target central processor and any one of the distributed caches;

[0033] The latest node identifier resent by the target central processor is obtained to re-authenticate the target central processor based on the latest node identifier.

[0034] Optionally, generating the latest node identifier based on the physical address of the target central processor by the node trusted management unit includes:

[0035] A random number is generated by the node trusted management unit, and a hash operation is performed on the random number and the physical address of the target central processor, so that the hash operation result is used as the latest node identifier.

[0036] Optionally, each of the distributed caches includes a plurality of cache lines;

[0037] Correspondingly, before determining whether the plaintext data stored in the preset buffer after pre-decrypting the local target cache line is the target data, it also includes:

[0038] Predicting the next target cache line to be read from multiple local cache lines according to a preset cache security preprocessing mechanism;

[0039] The ciphertext data stored in the target cache line is decrypted to obtain plaintext data, and the plaintext data is stored in the preset buffer.

[0040] Optionally, the cache security preprocessing mechanism includes a first historical information table for recording the cache line address of the distributed cache each time it is accessed; a second historical information table for recording the moving direction of the cache line address of the distributed cache each time it is accessed relative to the cache line address of the last accessed; a third historical information table for recording the moving distance of the cache line address of the distributed cache each time it is accessed relative to the cache line address of the last accessed; a fourth historical information table for recording whether each cache line is predicted successfully; and a counter for recording the credibility of the prediction result.

[0041] Optionally, the counter includes a first counter for recording the credibility of the moving direction prediction result;

[0042] Correspondingly, predicting the next target cache line to be read from the local multiple cache lines according to the preset cache security preprocessing mechanism includes:

[0043] Using the address of the cache line most recently accessed in the first history information table as a reference address;

[0044] Predicting a target moving direction of a next cache line to be read relative to the reference address using an offset direction counter constructed based on the fourth history information table, the second history information table, and the first counter, and predicting a target moving distance of a next cache line to be read relative to the reference address using the third history information table;

[0045] A next target cache line to be read is located from a plurality of local cache lines based on the target moving direction and the target moving distance.

[0046] Optionally, the cache security preprocessing mechanism further includes a register for predicting a cache line decryption range, and the counter further includes a second counter for recording the credibility of the access address prediction result;

[0047] Correspondingly, after locating the next target cache line to be read from the local multiple cache lines based on the target moving direction and the target moving distance, the method further includes:

[0048] inputting the current first credibility recorded by the second counter into the register, so that the register predicts the incremental cache line based on the current first credibility;

[0049] Taking the target cache line as the center, adding the incremental cache lines before and after the target cache line to obtain a target decryption range;

[0050] Correspondingly, decrypting the ciphertext data stored in the target cache line to obtain plaintext data, and storing the plaintext data in the preset buffer includes:

[0051] The ciphertext data stored in the target decryption range is decrypted to obtain plaintext data, and the plaintext data is stored in the preset buffer.

[0052] Optionally, the predicting a target moving direction of a next cache line to be read relative to the reference address by using an offset direction counter constructed based on the fourth history information table, the second history information table, and the first counter includes:

[0053] Determine the corresponding initial offset direction according to the current count of the offset direction counter; wherein the offset direction counter is constructed based on the fourth history information table, and after each access, if the moving direction prediction of the cache line is successful, then the offset direction counter is incremented by one, and if the moving direction prediction of the cache line fails, then the offset direction counter is decremented by one;

[0054] Counting the ratios of different moving reverse directions in the second historical information table, if any ratio exceeds a preset ratio threshold, multiplying the current second credibility recorded by the first counter by the preset ratio threshold, and using the calculation result as the final credibility;

[0055] A target moving direction of a next cache line to be read relative to the reference address is determined based on the final credibility and the initial offset direction.

[0056] Optionally, determining a target moving direction of a next cache line to be read relative to the reference address based on the final credibility and the initial offset direction includes:

[0057] Determining whether the final credibility exceeds a preset credibility value;

[0058] If the final credibility exceeds the preset credibility value, determining the initial offset direction as the target moving direction of the next cache line to be read relative to the reference address;

[0059] If the final credibility does not exceed the preset credibility value, the opposite direction of the initial offset direction is determined as the target moving direction of the next cache line to be read relative to the reference address.

[0060] Optionally, the predicting a target moving distance of a next cache line to be read relative to the reference address by using the third history information table includes:

[0061] Determine a target ratio of different distance values ​​in the third historical information table, and use the target ratio as a weight coefficient for each distance value;

[0062] A weighted average is calculated for each of the distance values ​​in the third history information table based on the weight coefficient, and the weighted average is used as a target moving distance of the next cache line to be read relative to the reference address.

[0063] In a second aspect, the present application discloses a data transmission device, which is applied to any distributed cache in a multi-processor computing architecture, wherein the multi-processor computing architecture is set based on a cache consistency protocol and includes multiple central processing units as source nodes and multiple distributed caches as destination nodes, and the device includes:

[0064] A request acquisition module, used for acquiring a data read request sent by a target central processor for reading target data;

[0065] An identity authentication module, used for authenticating the target central processor if the currently used security mechanism is a preset first-class security mechanism; the first-class security mechanism is used to represent the identity authentication of the node sending the request, the encrypted transmission of data between nodes, and the encrypted storage of data in each distributed cache;

[0066] A judgment module, configured to judge whether the plaintext data stored in the preset buffer after pre-decrypting the local target cache line is the target data if the identity authentication result indicates that the authentication is passed;

[0067] A data transmission module is used to replace the ciphertext data in the target cache line with the plaintext data if it is the target data and any of the distributed caches is not the local cache of the target central processor, and to encrypt the plaintext data using a preset encryption algorithm before transmitting it to the target central processor.

[0068] In a third aspect, the present application discloses an electronic device, comprising:

[0069] Memory, used to store computer programs;

[0070] The processor is used to execute the computer program to implement the steps of the aforementioned disclosed data transmission method.

[0071] In a fourth aspect, the present application discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, the steps of the aforementioned disclosed data transmission method are implemented.

[0072] In a fifth aspect, the present application discloses a computer program product, including a computer program / instruction, which implements the steps of the aforementioned disclosed data transmission method when executed by a processor.

[0073] It can be seen that the present application discloses a data transmission method applied to any distributed cache in a multi-processor computing architecture, wherein the multi-processor computing architecture is set up based on a cache consistency protocol and includes multiple central processing units as source nodes and multiple distributed caches as destination nodes, and the method includes: obtaining a data read request sent by a target central processing unit for reading target data; if the currently used security mechanism is a preset first-class security mechanism, then authenticating the target central processing unit; the first-class security mechanism is used to characterize the authentication of the node sending the request, the encrypted transmission of data between nodes, and the encrypted storage of data in each distributed cache; if the authentication result indicates that the authentication is passed, then determining whether the plaintext data stored in a preset buffer after pre-decrypting the local target cache line is the target data; if it is the target data and any distributed cache is not the local cache of the target central processing unit, then replacing the ciphertext data in the target cache line with the plaintext data, and encrypting the plaintext data with a preset encryption algorithm before transmitting it to the target central processing unit.

[0074] Beneficial effects: The present application discloses a data transmission method applied to a multi-processor computing architecture, which is based on a cache consistency protocol and includes multiple central processing units as source nodes and multiple distributed caches as destination nodes. Specifically, when the central processing unit needs to read data, it can send a data read request to the corresponding distributed cache. Therefore, when any distributed cache obtains a data read request sent by the target central processing unit to read the target data, it is necessary to determine the security mechanism used by the current system. That is, different security mechanisms can be adopted in the multi-processor computing architecture for tasks with different security requirements, wherein the first type of security mechanism refers to the need to authenticate the node sending the request, transmit data in ciphertext between nodes, and store data in ciphertext in each distributed cache. In other words, if the currently used security mechanism is the preset first type of security mechanism, it is first necessary to authenticate the target central processing unit to ensure that the identity of the central processing unit currently being accessed is legal. If the identity authentication is passed, it is determined whether the plaintext data stored in the preset buffer after pre-decrypting the local target cache line is the target data. It can be understood that under the first type of security mechanism, data is stored in each distributed cache in ciphertext form. When the central processing unit accesses the cache, the ciphertext data in the cache needs to be decrypted before it can be used, which will greatly affect the computing performance of the system. Therefore, the present application pre-decrypts the ciphertext data in the local target cache line and stores the plaintext data in the preset buffer. If the plaintext data stored in the preset buffer is the target data to be read by the target central processing unit, and the current distributed cache is not the local cache of the target central processing unit, the plaintext data can be used to replace the ciphertext data in the target cache line, and then according to the requirements of the first type of security mechanism, the plaintext data is encrypted using a preset encryption algorithm and then transmitted to the target central processing unit, so that data is also transmitted in ciphertext form at the link layer, further improving the security of system data and the computing performance of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0075] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0076] Figure 1 A flow chart of a data transmission method disclosed in this application;

[0077] Figure 2 A schematic diagram of a specific multi-processor computing architecture disclosed in this application;

[0078] Figure 3 A schematic diagram of a cache security preprocessing mechanism disclosed in the present application;

[0079] Figure 4 A schematic diagram of an offset direction counter disclosed in the present application;

[0080] Figure 5 A flowchart of a specific data transmission method disclosed in this application;

[0081] Figure 6 A schematic diagram of a node identity authentication process disclosed in this application;

[0082] Figure 7 This is a schematic diagram of the structure of a data transmission device disclosed in this application;

[0083] Figure 8 This is a structural diagram of an electronic device disclosed in this application. DETAILED DESCRIPTION

[0084] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0085] In order to improve the computing performance of modern computer systems, multi-processor architecture has become the mainstream computing architecture. As the number of processors increases, it is increasingly important to ensure data consistency and system security. Currently, the security of system data is improved and cache consistency is maintained mainly by encrypting cache data and memory data. However, in the consistency protocol, in addition to the possibility that a certain node may be attacked, the link layer in the cache protocol also has the possibility of data interception and theft. Therefore, the existing method is limited to the security of cache and local memory data, and does not involve the problem of data tampering and theft between multi-processor architecture nodes. In addition, since the cache needs to be encrypted, when the CPU accesses the cache, the encrypted data in the cache needs to be decrypted before it can be used, which will greatly affect the computing performance of the system. In addition, there is only a single security protection method in the existing solution, which cannot adapt to task scenarios with different security requirements, and lacks flexibility and compatibility.

[0086] To this end, the embodiments of the present application disclose a data transmission method, apparatus, device, medium and computer program product, which can adapt to task scenarios with different security requirements in a multi-processor computing architecture, and further improve the security of system data and improve the computing performance of the system.

[0087] See also Figure 1As shown, an embodiment of the present application discloses a data transmission method, which is applied to any distributed cache in a multi-processor computing architecture, wherein the multi-processor computing architecture is set based on a cache consistency protocol and includes multiple central processing units as source nodes and multiple distributed caches as destination nodes, and the method includes:

[0088] Step S11: obtaining a data read request sent by a target central processing unit for reading target data.

[0089] In this embodiment, the multi-processor computing architecture is set up based on a cache consistency protocol and includes multiple central processing units as source nodes and multiple distributed caches as destination nodes. Figure 2 This is a schematic diagram of a specific multi-processor computing architecture disclosed in this application, in which a RISC-V multi-core processor is composed of multiple RISC-V (an open source instruction set architecture) computing cores, each processor has its own local memory, and multiple processors and multiple distributed caches together constitute a NUMA (Non-Uniform Memory Access, a type of multi-processor computing architecture) computing architecture. The CPU and distributed cache are regarded as nodes, and a mesh (wireless mesh network) network is composed of multiple nodes. Communication between CPUs is carried out through distributed caches, and data can also be transmitted between distributed caches. The NUMA architecture is scalable and can be configured according to the Figure 2 The nodes are expanded according to the connection rule shown in , that is, one CPU is connected to four distributed caches, and these four distributed caches can be regarded as the local caches of the CPU. One distributed cache is also connected to four CPUs. There are data paths between the distributed caches. The overall network topology presents a rectangular grid. The CPU, memory and distributed cache can all be regarded as nodes in the cache consistency protocol.

[0090] First, let's introduce the cache consistency protocol: suppose a CPU needs to read data from a distributed cache. At this time, the CPU is regarded as the source node and the distributed cache is regarded as the target node. First, the source node will initiate a cache miss request and ask the target node whether it has the required data; then after receiving the request, the target node will check whether it has the data in its cache; if the required data exists in the target node's cache, it will return the data to the source node; after receiving the data, the source node will load the data into its local cache; after receiving the data and updating the local cache, the source node will send a signal to other nodes that its local cache has been updated according to the provisions of the cache consistency protocol to maintain the cache consistency of the system. In this way, when other nodes need to obtain the data, they can send data read requests to them.

[0091] It can be known from the above content that when any central processing unit needs to read data, it can send a data read request to the corresponding distributed cache, and the distributed cache can be a local cache of the central processing unit or an external cache.

[0092] Step S12: If the currently used security mechanism is the preset first-class security mechanism, the target central processor is authenticated; the first-class security mechanism is used to represent the identity authentication of the node sending the request, the encrypted transmission of data between nodes, and the encrypted storage of data in each distributed cache.

[0093] In this embodiment, when any distributed cache obtains a data read request sent by the target central processor to read the target data, it first needs to determine the security mechanism used by the current system. That is, different security mechanisms can be adopted for tasks with different security requirements in a multi-processor computing architecture, where the first type of security mechanism refers to the need to authenticate the node sending the request, transmit data in ciphertext between nodes, and store data in ciphertext in each distributed cache. In other words, if the currently used security mechanism is the preset first type of security mechanism, the target central processor must first be authenticated to ensure that the identity of the central processor currently being accessed is legal.

[0094] In addition to the first type of security mechanism, there are also second type of security mechanism, third type of security mechanism and fourth type of security mechanism. That is, the embodiment of the present application designs security mechanisms of four different security levels.

[0095] In a specific implementation, if the currently used security mechanism is a preset second-type security mechanism, the target data stored in the distributed cache is transmitted to the target central processor based on the second-type security mechanism; wherein the second-type security mechanism is used to characterize the identity authentication of the node sending the request, the encrypted transmission of data between nodes, and the plaintext storage of data in each distributed cache. That is, compared with the first-type security mechanism, the second-type security mechanism stipulates that data is stored in plaintext in each distributed cache, and accordingly does not involve the content of pre-decrypting the local target cache line, that is, under the second-type security mechanism, the target central processor is first authenticated, and after the authentication is passed, the cache line where the target data is located is determined locally, and the plaintext data is directly read from it, and then the plaintext data is encrypted using a preset encryption algorithm before being transmitted to the target central processor.

[0096] In a specific implementation, if the currently used security mechanism is a preset third-type security mechanism, the target data stored in the distributed cache is transmitted to the target central processor based on the third-type security mechanism; wherein the third-type security mechanism is used to characterize the identity authentication of the node sending the request, the transmission of data in plain text between nodes, and the storage of data in plain text in each distributed cache. That is, compared with the first-type security mechanism, the third-type security mechanism stipulates that data is transmitted in plain text between nodes and stored in plain text in each distributed cache, and accordingly does not involve the content of pre-decrypting the local target cache line, that is, under the third-type security mechanism, the target central processor is first authenticated, and after the authentication is passed, the cache line where the target data is located is determined locally, and the plain text data is directly read from it, and then the plain text data is directly transmitted to the target central processor.

[0097] In a specific implementation, if the currently used security mechanism is a preset fourth-type security mechanism, the target data stored in the distributed cache is transmitted to the target central processor based on the fourth-type security mechanism; wherein the fourth-type security mechanism is used to characterize that the node sending the request is not authenticated, data is transmitted in plain text between nodes, and data is stored in plain text in each distributed cache. That is, compared with the first-type security mechanism, the fourth-type security mechanism does not have any additional security processing in the cache consistency protocol, and the entire security mechanism is in an invalid state. This security level is used for task scenarios that have almost no requirements for security but have relatively demanding performance requirements. That is, under the third-type security mechanism, there is no need to authenticate the target central processor. After obtaining the data read request, the cache line where the target data is located is determined locally, and the plain text data is directly read from it, and then the plain text data is directly transmitted to the target central processor.

[0098] It should be pointed out that RISC-V, as an open source instruction set architecture, allows designers to customize the expansion of instructions according to the rules of RISC-V to achieve different hardware functions due to its flexibility, compatibility and scalability. Based on this, this embodiment customizes and expands a security level adjustment instruction kcsl according to the rules of RISC-V, which can adjust the security level of the multi-level node authentication mechanism according to the required security level of the current system execution task. After the kcsl instruction is decoded, the information indicating the current system security level is sent to all nodes, so that each node adjusts the security level accordingly, thereby using the corresponding security mechanism.

[0099] Step S13: If the identity authentication result indicates that the authentication is successful, it is determined whether the plaintext data stored in the preset buffer after pre-decrypting the local target cache line is the target data.

[0100] In this embodiment, if the identity authentication is passed, it is determined whether the plaintext data stored in the preset buffer after the local target cache line is decrypted in advance is the target data. It can be understood that under the first type of security mechanism, the data is stored in ciphertext form in each distributed cache. When the central processing unit accesses the cache, the ciphertext data in the cache needs to be decrypted before it can be used, which will greatly affect the computing performance of the system. Therefore, this application decrypts the ciphertext data in the local target cache line in advance and stores the plaintext data in the preset buffer.

[0101] It should be pointed out that each of the distributed caches includes multiple cache lines; accordingly, before judging whether the plaintext data stored in the preset buffer after pre-decrypting the local target cache line is the target data, it also includes: predicting the next target cache line to be read from the local multiple cache lines according to the preset cache security preprocessing mechanism; decrypting the ciphertext data stored in the target cache line to obtain plaintext data, and storing the plaintext data in the preset buffer. Since the introduction of a multi-level identity authentication mechanism will greatly affect the system performance, if a task with a high security level and high response speed requirements is encountered, it is difficult to meet the task requirements. In order to reduce the system performance loss caused by the security mechanism, this embodiment designs a cache security preprocessing mechanism, which can predict the cache access address, predict the next target cache line to be read from the local multiple cache lines in advance, and decrypt the ciphertext data that will be needed in the target cache line, and store the decrypted plaintext data in the preset buffer. In this way, the loss of system performance caused by the security mechanism is reduced.

[0102] Specifically, the cache security preprocessing mechanism includes a first history information table for recording the cache line address of each access to the distributed cache; a second history information table for recording the moving direction of the cache line address of each access to the distributed cache relative to the cache line address of the previous access; a third history information table for recording the moving distance of the cache line address of each access to the distributed cache relative to the cache line address of the previous access; a fourth history information table for recording whether each cache line is predicted successfully; and a counter for recording the credibility of the prediction result. It should be pointed out that each time the distributed cache is accessed by the CPU, the cache line address accessed is sent to the first history information table for storage, and the moving direction and moving distance of the cache line address currently accessed compared to the cache line address of the last access can be calculated, and the two data are recorded in the corresponding history information table. The distributed cache will also update the fourth history information table based on the prediction result and the actual access address. In addition, after each successful prediction, the value of the counter will increase, and if the prediction fails, its value will decrease.

[0103] In a specific embodiment, the above-mentioned counter includes a first counter for recording the credibility of the moving direction prediction result; accordingly, the next target cache line to be read is predicted from multiple local cache lines according to the preset cache security preprocessing mechanism, including: taking the cache line address currently accessed in the first history information table as the reference address; using the offset direction counter constructed based on the fourth history information table, the second history information table and the first counter to predict the target moving direction of the next cache line to be read relative to the reference address, and using the third history information table to predict the target moving distance of the next cache line to be read relative to the reference address; based on the target moving direction and the target moving distance, the next target cache line to be read is located from multiple local cache lines. That is, each time when predicting the next target cache line to be read, first use the address of the cache line currently most recently accessed in the first historical information table as the reference address, that is, use the address of the cache line last accessed in the distributed cache as the reference address, and the address will be stored in the latest table entry in the first historical information table; then, based on the offset direction counter constructed in the fourth historical information table, the second historical information table and the first counter, predict the target moving direction of the next cache line to be read relative to the reference address, and use the third historical information table to predict the target moving distance of the next cache line to be read relative to the reference address; in this way, after obtaining the target moving direction and target moving distance of the next cache line to be read relative to the reference address, the next target cache line to be read can be located from multiple local cache lines based on the target moving direction and the target moving distance.

[0104] Furthermore, the cache security preprocessing mechanism also includes a register for predicting a cache line decryption range, and the counter also includes a second counter for recording the credibility of an access address prediction result; accordingly, after locating the next target cache line to be read from multiple local cache lines based on the target moving direction and the target moving distance, it also includes: inputting the current first credibility recorded by the second counter into the register, so that the register predicts an incremental cache line based on the current first credibility; with the target cache line as the center, adding the incremental cache line before and after the target cache line to obtain a target decryption range; accordingly, decrypting the ciphertext data stored in the target cache line to obtain plaintext data, and storing the plaintext data in the preset buffer, includes: decrypting the ciphertext data stored in the target decryption range to obtain plaintext data, and storing the plaintext data in the preset buffer.

[0105] It can be understood that a single cache line is located according to the target moving direction and the target moving distance. In order to improve the prediction hit rate, the cache security preprocessing mechanism also includes a register for predicting the cache line decryption range, and the counter also includes a second counter for recording the credibility of the access address prediction result, so that the current first credibility recorded by the second counter is input into the register, so that the register predicts the incremental cache line based on the current first credibility. It should be pointed out that the higher the first credibility, the fewer incremental cache lines, and the higher the second credibility, the more incremental cache lines, and its specific value can be debugged according to the actual situation. Then, with the target cache line as the center, the incremental cache line is added before and after the target cache line to obtain the target decryption range, so that when decrypting, the target decryption range including the target cache line is decrypted, and then the decrypted plaintext data is stored in the preset cache area. That is, the application is centered on the predicted target cache line, and several adjacent cache lines before and after will also be decrypted together to increase the hit probability.

[0106] Figure 3 The present application discloses a schematic diagram of a cache security preprocessing mechanism, which can predict the requested cache line, decrypt the predicted cache line in advance, and put the decrypted plaintext into a preset buffer. It should be pointed out that the preset buffer only communicates with the distributed cache and its encryption and decryption module. After the prediction hits, the plaintext data in the preset buffer replaces the corresponding cache line in the distributed cache. If the hit fails, the prediction record is added to the fourth historical information table.

[0107] In a specific embodiment, the above-mentioned use of the offset direction counter constructed based on the fourth historical information table, the second historical information table and the first counter to predict the target moving direction of the next cache line to be read relative to the reference address includes: determining the corresponding initial offset direction according to the current count of the offset direction counter; wherein, the offset direction counter is constructed based on the fourth historical information table, and after each access, if the moving direction of the cache line is predicted successfully, the offset direction counter is incremented by one, and if the moving direction of the cache line is predicted unsuccessfully, the offset direction counter is decremented by one; the ratio of different moving directions in the second historical information table is counted, and if any ratio exceeds a preset ratio threshold, the current second credibility recorded by the first counter is multiplied by the preset ratio threshold, and the result of the operation is used as the final credibility; based on the final credibility and the initial offset direction, the target moving direction of the next cache line to be read relative to the reference address is determined.

[0108] It can be understood that in order to predict the offset direction (divided into two directions, front and back) of the cache line address to be accessed this time relative to the reference address, the present application designs an offset direction counter based on the fourth history information table. The counter is 2 bits, and its state change is explained in detail as follows: Figure 4 As shown. Among them, when the offset direction counter is 00 and 01, the predicted initial offset direction is "forward"; when the offset direction counter is 10 and 11, the predicted initial offset direction is "backward". After each access, the counter will be increased or decreased according to whether the moving direction prediction recorded in the fourth historical information table is hit. Furthermore, the second historical information table will record the moving direction of the cache line address recently accessed relative to the reference address. In this embodiment, a preset ratio threshold Y is set for the ratio of "front" and "backward" in the historical information table, and its value range is 0~100%, for example, it can be 80%; when the ratio of the number of "front" or "backward" to all table items in the second historical information table exceeds the preset ratio threshold Y, the current second credibility recorded by the first counter is multiplied by the preset ratio threshold Y to obtain the final credibility, so as to determine the target moving direction of the next cache line to be read relative to the reference address based on the final credibility and the initial offset direction.

[0109] Specifically, the determination of the target moving direction of the next cache line to be read relative to the reference address based on the final credibility and the initial offset direction includes: judging whether the final credibility exceeds a preset credibility value; if the final credibility exceeds the preset credibility value, determining the initial offset direction as the target moving direction of the next cache line to be read relative to the reference address; if the final credibility does not exceed the preset credibility value, determining the reverse direction of the initial offset direction as the target moving direction of the next cache line to be read relative to the reference address. That is, after obtaining the final credibility, it is necessary to further judge whether it exceeds the preset credibility value. If it exceeds, it means that this prediction is credible, and the initial offset direction is determined as the target moving direction of the next cache line to be read relative to the reference address. If it does not exceed the preset credibility value, it means that this prediction is unreliable, so the reverse direction of the initial offset direction is determined as the target moving direction of the next cache line to be read relative to the reference address. For example, if the initial offset direction is "forward", the target moving direction is "backward". Among them, the preset credibility value can be set to 0.25, then when the final credibility value is greater than 0.25, the prediction is credible; when the final credibility value is less than 0.25, the prediction is not credible.

[0110] From the foregoing, it can be seen that the present application sets up two counters for predicting the credibility S0, one is a first counter that provides credibility for the moving direction prediction result, and the other is a second counter that provides credibility for the access address prediction result. The first counter and the second counter are both 3 bits. Whenever the prediction hits, the counter value is increased by one until it reaches the maximum value and remains unchanged. Among them, 000 represents S0=0.125, 001 represents S0=0.25, 010 represents S0=0.375, 011 represents S0=0.5, 100 represents S0=0.625, 101 represents S0=0.75, 110 represents S0=0.875, and 111 represents S0=1.

[0111] In a specific embodiment, the above-mentioned prediction of the target moving distance of the next cache line to be read relative to the reference address using the third historical information table includes: determining the target ratio of different distance values ​​in the third historical information table, and using the target ratio as the weight coefficient of each distance value; calculating the weighted average of each distance value in the third historical information table based on the weight coefficient, and using the weighted average as the target moving distance of the next cache line to be read relative to the reference address. It can be understood that the third historical information table records the moving distance of each cache line address accessed relative to the cache line address accessed last time. When predicting the target moving distance, first determine the target ratio of different distance values ​​in the third historical information table, and use the target ratio as the weight coefficient of each distance value, so as to calculate the weighted average of each distance value in the third historical information table based on the weight coefficient, and the weighted average is used as the target moving distance of the next cache line to be read relative to the reference address.

[0112] Step S14: If it is the target data and any of the distributed caches is not the local cache of the target CPU, the ciphertext data in the target cache line is replaced with the plaintext data, and the plaintext data is encrypted using a preset encryption algorithm before being transmitted to the target CPU.

[0113] In a specific implementation, if the plaintext data stored in the preset buffer is the target data to be read by the target CPU, and the current distributed cache is not the local cache of the target CPU, the plaintext data can be used to replace the ciphertext data in the target cache line, and then according to the requirements of the first type of security mechanism, the plaintext data is encrypted using a preset encryption algorithm before being transmitted to the target CPU, so that the data is also transmitted in ciphertext form at the link layer, further improving the security of the system data and the computing performance of the system. It should be pointed out that the ciphertext data in the target cache line needs to be decrypted in advance and then encrypted because the encryption algorithm used in the distributed cache is often different from the encryption algorithm used for link layer transmission.

[0114] In another specific implementation, if the plaintext data stored in the preset buffer is not the target data, the cache line where the target data is located is determined locally, and the ciphertext data in the cache line where the target data is located is decrypted to obtain the plaintext data; the plaintext data is encrypted using a preset encryption algorithm and then transmitted to the target central processor. That is, if the plaintext data stored in the preset buffer is not the target data, it means that the prediction is not a hit, so the data is read from the cache line where the target data is located according to the normal data reading process, and then the plaintext data is encrypted using a preset encryption algorithm and then transmitted to the target central processor.

[0115] In addition, if it is the target data and any of the distributed caches is the local cache of the target central processor, the plaintext data is used to replace the ciphertext data in the target cache line, and the plaintext data is transmitted to the target central processor. That is, when the target central processor reads the local cache after passing the node authentication, the link layer data is transmitted in plaintext, and no encryption is required. In addition, when the central processor needs to write data, it sends a write request transaction to the local cache. The local cache updates the cache line data according to the cache consistency protocol, and informs the other nodes of the various information of this update according to the specific cache consistency protocol. It should be pointed out that when the central processor writes to the local cache, the link layer data is transmitted in ciphertext.

[0116] It can be seen that the present application discloses a data transmission method applied to any distributed cache in a multi-processor computing architecture, wherein the multi-processor computing architecture is set up based on a cache consistency protocol and includes multiple central processing units as source nodes and multiple distributed caches as destination nodes, and the method includes: obtaining a data read request sent by a target central processing unit for reading target data; if the currently used security mechanism is a preset first-class security mechanism, then authenticating the target central processing unit; the first-class security mechanism is used to characterize the authentication of the node sending the request, the encrypted transmission of data between nodes, and the encrypted storage of data in each distributed cache; if the authentication result indicates that the authentication is passed, then determining whether the plaintext data stored in a preset buffer after pre-decrypting the local target cache line is the target data; if it is the target data and any distributed cache is not the local cache of the target central processing unit, then replacing the ciphertext data in the target cache line with the plaintext data, and encrypting the plaintext data with a preset encryption algorithm before transmitting it to the target central processing unit.

[0117] Beneficial effects: The present application discloses a data transmission method applied to a multi-processor computing architecture, wherein the multi-processor computing architecture is set up based on a cache consistency protocol and includes multiple central processing units as source nodes and multiple distributed caches as destination nodes. Specifically, when the central processing unit needs to read data, it can send a data read request to the corresponding distributed cache. When any distributed cache obtains a data read request sent by the target central processing unit for reading target data, it first needs to determine the security mechanism used by the current system. That is, different security mechanisms can be adopted in the multi-processor computing architecture for tasks with different security requirements, wherein the first type of security mechanism refers to the need to authenticate the node sending the request, transmit data in ciphertext between nodes, and store data in ciphertext in each distributed cache. In other words, if the currently used security mechanism is the preset first type of security mechanism, the target central processing unit first needs to be authenticated to ensure that the identity of the central processing unit currently being accessed is legal. If the identity authentication is passed, it is determined whether the plaintext data stored in the preset buffer after pre-decrypting the local target cache line is the target data. It can be understood that under the first type of security mechanism, data is stored in each distributed cache in ciphertext form. When the central processing unit accesses the cache, the ciphertext data in the cache needs to be decrypted before it can be used, which will greatly affect the computing performance of the system. Therefore, the present application pre-decrypts the ciphertext data in the local target cache line and stores the plaintext data in the preset buffer. If the plaintext data stored in the preset buffer is the target data to be read by the target central processing unit, and the current distributed cache is not the local cache of the target central processing unit, the plaintext data can be used to replace the ciphertext data in the target cache line, and then according to the requirements of the first type of security mechanism, the plaintext data is encrypted using a preset encryption algorithm and then transmitted to the target central processing unit, so that data is also transmitted in ciphertext form at the link layer, further improving the security of system data and the computing performance of the system.

[0118] See also Figure 5 As shown, the embodiment of the present application discloses a specific data transmission method, wherein a preset trusted node information table is set in each of the distributed caches, and the preset trusted node information table stores a list of node identifiers of nodes that can be accessed and corresponding valid access periods, specifically including:

[0119] Step S21: obtaining a data read request sent by a target central processing unit for reading target data.

[0120] Step S22: If the currently used security mechanism is the preset first-type security mechanism, the data read request is parsed to obtain the target node identifier of the target central processor, and it is determined whether the target node identifier is located in the node identifier list.

[0121] In this embodiment, under the first type of security mechanism, the target CPU needs to be authenticated. Figure 6 As shown, each distributed cache (i.e., target node) is provided with a preset trusted node information table, which stores a list of node identifiers of nodes that are allowed to be accessed and the corresponding valid access period. That is, each distributed cache has a preset trusted node information table, which stores the UIDs (User Identification) of nodes that the distributed cache considers to be trusted, and together constitutes a list of node identifiers. The UIDs of these trusted nodes all have corresponding valid access periods. Specifically, the valid access period is determined by the countdown counter in the table entry where the trusted node UID is located. When the counter returns to zero, the trusted node UID in the table entry becomes invalid, and re-authentication is required.

[0122] In addition, it should be pointed out that when nodes in the cache consistency protocol send request transactions and responses to each other, the node's UID will be sent along with the request. Therefore, after the distributed cache obtains the data read request sent by the target CPU, it first needs to parse the data read request to obtain the target node identifier of the target CPU and determine whether the target node identifier is in its own node identifier list.

[0123] Step S23: If the target node identifier is in the node identifier list, determine whether the valid access period is currently met. If the valid access period is currently met, obtain an identity authentication result indicating that the authentication is successful.

[0124] In this embodiment, it can be understood that what is stored in the preset trusted node information table is a list of node identifiers of nodes that the distributed cache allows to access. Then, if the target node identifier is in the node identifier list, the target central processor is considered to be trusted. It is further necessary to determine whether the corresponding valid access period is currently met. If it is also within the valid access period, an identity authentication result indicating that the authentication is passed is obtained, and the transaction can be processed smoothly.

[0125] On the contrary, the above method also includes: if the target node identifier is not in the node identifier list, an identity authentication result indicating that the authentication has not passed is obtained; or, if the target node identifier is in the node identifier list, but the valid access period is not currently met, an identity authentication result indicating that the authentication has not passed is obtained. That is, if the target node identifier is not in the node identifier list, it means that the target central processor is not trustworthy, and an identity authentication result indicating that the authentication has not passed is obtained. In addition, if the target node identifier is in the node identifier list, but the valid access period is not currently met, that is, the access period of the target central processor has expired, an identity authentication result indicating that the authentication has not passed is also obtained.

[0126] Furthermore, in the case where the identity authentication fails, the above method also includes: if the identity authentication result indicates that the authentication fails, the data read request is stored in a preset request temporary storage area, and the target node identifier is sent to a preset node trusted management unit, so as to obtain the latest node identifier sent by the node trusted management unit based on the target node identifier, so as to re-authenticate the target central processor based on the latest node identifier. That is to say, if the identity authentication result indicates that the authentication fails, the data read request is stored in a preset request temporary storage area, and the target node identifier is sent to a preset node trusted management unit. It should be pointed out that if Figure 6 As shown, the node trusted management unit is mainly responsible for generating and issuing UIDs for each node. After receiving the information, the node trusted management unit can generate the latest node identifier, so that the target central processor can be re-authenticated based on the latest node identifier.

[0127] Specifically, the sending of the target node identifier to a preset node trusted management unit so as to obtain the latest node identifier sent by the node trusted management unit based on the target node identifier so as to re-authenticate the target central processor based on the latest node identifier includes: sending the target node identifier to a preset node trusted management unit so that the node trusted management unit determines whether the target node identifier exists in its own trusted node identifier table; if the target node identifier does not exist in the trusted node identifier table of the node trusted management unit itself, obtaining an alarm message sent by the node trusted management unit; if the target node identifier exists in the trusted node identifier table of the node trusted management unit itself, generating an latest node identifier based on the physical address of the target central processor by the node trusted management unit, and sending the latest node identifier to the target central processor and any one of the distributed caches; obtaining the latest node identifier resent by the target central processor so as to re-authenticate the target central processor based on the latest node identifier.

[0128] First of all, it should be pointed out that there are three main situations in which the identity authentication fails: first, the request transaction is forged, so the node UID it carries is fake, so the target node fails to authenticate the node; second, the request transaction is indeed issued by a trusted node, but the UID of the node may not be stored in the node identifier list of the target node for some reason, so the target node fails to authenticate the node; third, the request transaction is indeed issued by a trusted node, but the UID of the node has expired, so the target node fails to authenticate the node. Therefore, the distributed cache needs to send the target node identifier to the preset node trusted management unit so that the node trusted management unit can determine whether the target node identifier exists in its own trusted node identifier table. The purpose of doing so is to confirm whether the identity authentication fails in the latter two situations. After the node trusted management unit receives the UID of the source node from the target node, it starts to retrieve its own trusted node identifier table. If it belongs to the latter two situations, then the UID of the source node will be in the trusted node identifier table. If it is the first situation, the UID of the source node cannot exist in the trusted node identifier table, which means that the request transaction is forged, and a corresponding alarm message can be issued.

[0129] Furthermore, when the target node identifier exists in the trusted node identifier table of the node trusted management unit itself, the node trusted management unit can generate the latest node identifier based on the physical address of the target central processor, and send the latest node identifier to the target central processor and any distributed cache at the same time; then the target central processor will resend the latest node identifier to the distributed cache, and the distributed cache will re-authenticate the target central processor based on the latest node identifier. After the authentication is passed, the valid access period of the UID of the target central processor in the node identifier list will be reset, and the data reading request in the preset request buffer area will continue to be processed.

[0130] The generating of the latest node identifier based on the physical address of the target CPU by the node trusted management unit specifically includes: generating a random number by the node trusted management unit, and performing a hash operation on the random number and the physical address of the target CPU, so as to use the hash operation result as the latest node identifier. Figure 6 As shown, in a specific implementation, the node trusted management unit generates a random number, and performs a hash operation on the random number and the physical address (MAC address) of the target central processor, thereby using the hash operation result as the latest node identifier.

[0131] Step S24: If the identity authentication result indicates that the authentication is successful, it is determined whether the plaintext data stored in the preset buffer after pre-decrypting the local target cache line is the target data.

[0132] Step S25: If it is the target data and any of the distributed caches is not the local cache of the target CPU, the ciphertext data in the target cache line is replaced with the plaintext data, and the plaintext data is encrypted using a preset encryption algorithm before being transmitted to the target CPU.

[0133] For more specific processing procedures of the above steps S21, S24 and S25, reference may be made to the corresponding contents disclosed in the aforementioned embodiments, which will not be described in detail here.

[0134] It can be seen that the embodiment of the present application mainly discloses the process of identity authentication for the target central processor. Among them, a preset trusted node information table is set in each distributed cache, and the preset trusted node information table stores a list of node identifiers that are allowed to access the node and the corresponding valid access period. When nodes in the cache consistency protocol send request transactions and responses to each other, the UID of the node will be sent along with the request. Therefore, after the distributed cache obtains the data read request sent by the target central processor, it is necessary to determine whether the UID is in the node identifier list and whether it is currently in the valid access period. If so, the transaction is processed sequentially. Otherwise, the data read request is temporarily stored, and the target node identifier is sent to the preset node trusted management unit to regenerate the latest node identifier through the node trusted management unit, so as to authenticate based on the latest node identifier. In this process, it can also be determined whether the request transaction is forged, and further an alarm is issued.

[0135] See also Figure 7 As shown, an embodiment of the present application discloses a data transmission device, which is applied to any distributed cache in a multi-processor computing architecture, wherein the multi-processor computing architecture is set based on a cache consistency protocol and includes multiple central processing units as source nodes and multiple distributed caches as destination nodes, and the device includes:

[0136] A request acquisition module 11 is used to acquire a data read request sent by a target central processor for reading target data;

[0137] The identity authentication module 12 is used to authenticate the target central processor if the currently used security mechanism is a preset first-class security mechanism; the first-class security mechanism is used to authenticate the node sending the request, transmit data in ciphertext between nodes, and store data in ciphertext in each distributed cache;

[0138] The judgment module 13 is used to judge whether the plaintext data stored in the preset buffer after pre-decrypting the local target cache line is the target data if the identity authentication result indicates that the authentication is passed;

[0139] The data transmission module 14 is used to replace the ciphertext data in the target cache line with the plaintext data if it is the target data and any distributed cache is not the local cache of the target central processor, and encrypt the plaintext data using a preset encryption algorithm before transmitting it to the target central processor.

[0140] Beneficial effects: The present application discloses a data transmission device applied to a multi-processor computing architecture, which is arranged based on a cache consistency protocol and includes multiple central processing units as source nodes and multiple distributed caches as destination nodes. Specifically, when the central processing unit needs to read data, it can send a data read request to the corresponding distributed cache. Therefore, when any distributed cache obtains a data read request sent by the target central processing unit for reading target data, it is necessary to determine the security mechanism used by the current system. That is, different security mechanisms can be adopted for tasks with different security requirements in the multi-processor computing architecture, wherein the first type of security mechanism refers to the need to authenticate the node sending the request, transmit data in ciphertext between nodes, and store data in ciphertext in each distributed cache. In other words, if the currently used security mechanism is the preset first type of security mechanism, the target central processing unit must first be authenticated to ensure that the identity of the central processing unit currently being accessed is legal. If the identity authentication is passed, it is determined whether the plaintext data stored in the preset buffer after pre-decrypting the local target cache line is the target data. It can be understood that under the first type of security mechanism, data is stored in each distributed cache in ciphertext form. When the central processing unit accesses the cache, the ciphertext data in the cache needs to be decrypted before it can be used, which will greatly affect the computing performance of the system. Therefore, the present application pre-decrypts the ciphertext data in the local target cache line and stores the plaintext data in the preset buffer. If the plaintext data stored in the preset buffer is the target data to be read by the target central processing unit, and the current distributed cache is not the local cache of the target central processing unit, the plaintext data can be used to replace the ciphertext data in the target cache line, and then according to the requirements of the first type of security mechanism, the plaintext data is encrypted using a preset encryption algorithm and then transmitted to the target central processing unit, so that data is also transmitted in ciphertext form at the link layer, further improving the security of system data and the computing performance of the system.

[0141] Since the embodiments of the device part correspond to the embodiments of the method part, the embodiments of the device part refer to the description of the embodiments of the method part, which will not be described here. In addition, the invention has the same beneficial effects as the above-mentioned data transmission method.

[0142] Figure 8 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. Specifically, it may include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 is used to store a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the data transmission method performed by the electronic device disclosed in any of the aforementioned embodiments.

[0143] In this embodiment, the power supply 23 is used to provide working voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and the external device, and the communication protocol it follows is any communication protocol that can be applied to the technical solution of the present application, and is not specifically limited here; the input and output interface 25 is used to obtain external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs and is not specifically limited here.

[0144] Among them, the processor 21 may include one or more processing cores, such as a 4-core processor, an 8-core processor, etc. The processor 21 can be implemented in at least one hardware form of DSP (Digital Signal Processing), FPGA (Field-Programmable Gate Array), and PLA (Programmable Logic Array). The processor 21 may also include a main processor and a coprocessor. The main processor is a processor for processing data in the awake state, also known as a CPU (Central Processing Unit); the coprocessor is a low-power processor for processing data in the standby state. In some embodiments, the processor 21 may be integrated with a GPU (Graphics Processing Unit), which is responsible for rendering and drawing the content to be displayed on the display screen. In some embodiments, the processor 21 may also include an AI (Artificial Intelligence) processor, which is used to process computing operations related to machine learning.

[0145] In addition, the memory 22, as a carrier for storing resources, can be a read-only memory, a random access memory, a disk or an optical disk, etc. The resources stored thereon include an operating system 221, a computer program 222 and data 223, etc. The storage method can be temporary storage or permanent storage.

[0146] Among them, the operating system 221 is used to manage and control the hardware devices and computer programs 222 on the electronic device 20, so as to realize the operation and processing of the massive data 223 in the memory 22 by the processor 21, which can be Windows, Unix, Linux, etc. In addition to including a computer program that can be used to complete the data transmission method performed by the electronic device 20 disclosed in any of the aforementioned embodiments, the computer program 222 can also further include a computer program that can be used to complete other specific tasks. In addition to data transmitted from an external device received by the electronic device, the data 223 can also include data collected by its own input and output interface 25, etc.

[0147] Furthermore, an embodiment of the present application also discloses a computer-readable storage medium, in which a computer program is stored. When the computer program is loaded and executed by a processor, the steps of the data transmission method disclosed in any of the aforementioned embodiments are implemented.

[0148] Furthermore, an embodiment of the present application also discloses a computer program product, including a computer program / instruction, which, when executed by a processor, implements the steps of the data transmission method disclosed in any of the aforementioned embodiments.

[0149] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0150] Those skilled in the art may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented with electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in terms of function in the above description. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0151] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a compact disc read-only memory (CD-ROM), or any other form of storage medium known in the art.

[0152] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0153] The above is a detailed introduction to a data transmission method, device, equipment, medium and computer program product provided by the present invention. Specific examples are used in this article to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea; at the same time, for a person skilled in the art, according to the idea of ​​the present invention, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present invention.

Claims

1. A data transmission method, characterized in that: Applied to any distributed cache in a multi-processor computing architecture, the multi-processor computing architecture is set up based on a cache consistency protocol and includes multiple central processing units as source nodes and multiple distributed caches as destination nodes, the method comprising: Obtaining a data read request sent by a target central processing unit for reading target data; If the currently used security mechanism is a preset first-class security mechanism, the target central processor is authenticated; the first-class security mechanism is used to represent the authentication of the node sending the request, the encrypted transmission of data between nodes, and the encrypted storage of data in each distributed cache; If the identity authentication result indicates that the authentication is passed, determining whether the plaintext data stored in the preset buffer after pre-decrypting the local target cache line is the target data; If it is the target data and any of the distributed caches is not the local cache of the target CPU, the ciphertext data in the target cache line is replaced by the plaintext data, and the plaintext data is encrypted by a preset encryption algorithm before being transmitted to the target CPU.

2. The data transmission method according to claim 1, characterized in that: Also includes: If the currently used security mechanism is a preset second-type security mechanism, the target data stored in the distributed cache is transmitted to the target central processor based on the second-type security mechanism; wherein the second-type security mechanism is used to represent identity authentication of the node sending the request, encrypted data transmission between nodes, and plaintext storage of data in each distributed cache; If the currently used security mechanism is a preset third-type security mechanism, the target data stored in the distributed cache is transmitted to the target central processor based on the third-type security mechanism; wherein the third-type security mechanism is used to characterize identity authentication of the node sending the request, plaintext transmission of data between nodes, and plaintext storage of data in each distributed cache; If the security mechanism currently used is the preset fourth-type security mechanism, the target data stored in the distributed cache is transmitted to the target central processor based on the fourth-type security mechanism; wherein the fourth-type security mechanism is used to characterize that no identity authentication is performed on the node sending the request, data is transmitted in plain text between nodes, and data is stored in plain text in each distributed cache.

3. The data transmission method according to claim 1, characterized in that: After determining whether the plaintext data stored in the preset buffer after pre-decrypting the local target cache line is the target data, the method further includes: If it is the target data and any of the distributed caches is a local cache of the target central processor, the ciphertext data in the target cache line is replaced with the plaintext data, and the plaintext data is transmitted to the target central processor.

4. The data transmission method according to claim 1, characterized in that: After determining whether the plaintext data stored in the preset buffer after pre-decrypting the local target cache line is the target data, the method further includes: If the plaintext data stored in the preset buffer is not the target data, locally determining the cache line where the target data is located, and decrypting the ciphertext data in the cache line where the target data is located to obtain the plaintext data; The plaintext data is encrypted using a preset encryption algorithm and then transmitted to the target central processing unit.

5. The data transmission method according to claim 1, characterized in that: A preset trusted node information table is provided in each of the distributed caches, and the preset trusted node information table stores a list of node identifiers of nodes that are allowed to be accessed and corresponding valid access periods; Accordingly, the identity authentication of the target central processor includes: Parsing the data read request to obtain a target node identifier of the target central processor, and determining whether the target node identifier is located in the node identifier list; If the target node identifier is in the node identifier list, it is determined whether the valid access period is currently met. If the valid access period is currently met, an identity authentication result indicating that the authentication is successful is obtained.

6. The data transmission method according to claim 5, characterized in that: Also includes: If the target node identifier is not in the node identifier list, an identity authentication result indicating that the authentication has failed is obtained; Or, if the target node identifier is in the node identifier list but the valid access period is not currently satisfied, an identity authentication result indicating that the authentication has failed is obtained.

7. The data transmission method according to claim 6, characterized in that: Also includes: If the identity authentication result indicates that the authentication has not passed, the data read request is stored in a preset request temporary storage area, and the target node identifier is sent to a preset node trusted management unit so as to obtain the latest node identifier sent by the node trusted management unit based on the target node identifier, so as to re-authenticate the target central processor based on the latest node identifier.

8. The data transmission method according to claim 7, characterized in that: The sending of the target node identifier to a preset node trusted management unit so as to obtain a latest node identifier sent by the node trusted management unit based on the target node identifier, so as to re-authenticate the target central processor based on the latest node identifier, includes: Sending the target node identifier to a preset node trusted management unit so that the node trusted management unit determines whether the target node identifier exists in its own trusted node identifier table; If the target node identifier does not exist in the trusted node identifier table of the node trusted management unit itself, obtaining an alarm message sent by the node trusted management unit; If the target node identifier exists in the trusted node identifier table of the node trusted management unit itself, the node trusted management unit generates a latest node identifier based on the physical address of the target central processor, and sends the latest node identifier to the target central processor and any one of the distributed caches; The latest node identifier resent by the target central processor is obtained to re-authenticate the target central processor based on the latest node identifier.

9. The data transmission method according to claim 8, characterized in that: The generating, by the node trusted management unit, a latest node identifier based on the physical address of the target central processor comprises: A random number is generated by the node trusted management unit, and a hash operation is performed on the random number and the physical address of the target central processor, so that the hash operation result is used as the latest node identifier.

10. The data transmission method according to any one of claims 1 to 9, characterized in that: Each of the distributed caches includes a plurality of cache lines; Correspondingly, before determining whether the plaintext data stored in the preset buffer after pre-decrypting the local target cache line is the target data, it also includes: Predicting the next target cache line to be read from multiple local cache lines according to a preset cache security preprocessing mechanism; The ciphertext data stored in the target cache line is decrypted to obtain plaintext data, and the plaintext data is stored in the preset buffer.

11. The data transmission method according to claim 10, characterized in that: The cache security preprocessing mechanism includes a first historical information table for recording the cache line address of the distributed cache each time it is accessed; a second historical information table for recording the moving direction of the cache line address of the distributed cache each time it is accessed relative to the cache line address of the last time it was accessed; a third historical information table for recording the moving distance of the cache line address of the distributed cache each time it is accessed relative to the cache line address of the last time it was accessed; a fourth historical information table for recording whether each cache line is predicted successfully; and a counter for recording the credibility of the prediction result.

12. The data transmission method according to claim 11, characterized in that: The counter comprises a first counter for recording the credibility of the moving direction prediction result; Correspondingly, predicting the next target cache line to be read from the local multiple cache lines according to the preset cache security preprocessing mechanism includes: Using the address of the cache line most recently accessed in the first history information table as a reference address; Predicting a target moving direction of a next cache line to be read relative to the reference address using an offset direction counter constructed based on the fourth history information table, the second history information table, and the first counter, and predicting a target moving distance of a next cache line to be read relative to the reference address using the third history information table; A next target cache line to be read is located from a plurality of local cache lines based on the target moving direction and the target moving distance.

13. The data transmission method according to claim 12, characterized in that: The cache security preprocessing mechanism also includes a register for predicting a cache line decryption range, and the counter also includes a second counter for recording the credibility of the access address prediction result; Correspondingly, after locating the next target cache line to be read from the local multiple cache lines based on the target moving direction and the target moving distance, the method further includes: inputting the current first credibility recorded by the second counter into the register, so that the register predicts the incremental cache line based on the current first credibility; Taking the target cache line as the center, adding the incremental cache lines before and after the target cache line to obtain a target decryption range; Correspondingly, decrypting the ciphertext data stored in the target cache line to obtain plaintext data, and storing the plaintext data in the preset buffer includes: The ciphertext data stored in the target decryption range is decrypted to obtain plaintext data, and the plaintext data is stored in the preset buffer.

14. The data transmission method according to claim 12, characterized in that: The method of predicting a target moving direction of a next cache line to be read relative to the reference address by using an offset direction counter constructed based on the fourth history information table, the second history information table, and the first counter includes: Determine the corresponding initial offset direction according to the current count of the offset direction counter; wherein the offset direction counter is constructed based on the fourth history information table, and after each access, if the moving direction prediction of the cache line is successful, then the offset direction counter is incremented by one, and if the moving direction prediction of the cache line fails, then the offset direction counter is decremented by one; Counting the ratios of different moving reverse directions in the second historical information table, if any ratio exceeds a preset ratio threshold, multiplying the current second credibility recorded by the first counter by the preset ratio threshold, and using the calculation result as the final credibility; A target moving direction of a next cache line to be read relative to the reference address is determined based on the final credibility and the initial offset direction.

15. The data transmission method according to claim 14, characterized in that: The determining, based on the final credibility and the initial offset direction, a target moving direction of the next cache line to be read relative to the reference address comprises: Determining whether the final credibility exceeds a preset credibility value; If the final credibility exceeds the preset credibility value, determining the initial offset direction as the target moving direction of the next cache line to be read relative to the reference address; If the final credibility does not exceed the preset credibility value, the opposite direction of the initial offset direction is determined as the target moving direction of the next cache line to be read relative to the reference address.

16. The data transmission method according to claim 12, characterized in that: The using the third history information table to predict a target moving distance of a next cache line to be read relative to the reference address includes: Determine a target ratio of different distance values ​​in the third historical information table, and use the target ratio as a weight coefficient for each distance value; A weighted average is calculated for each of the distance values ​​in the third history information table based on the weight coefficient, and the weighted average is used as a target moving distance of the next cache line to be read relative to the reference address.

17. A data transmission device, characterized in that: Applied to any distributed cache in a multi-processor computing architecture, the multi-processor computing architecture is set based on a cache consistency protocol and includes multiple central processing units as source nodes and multiple distributed caches as destination nodes, the device includes: A request acquisition module, used for acquiring a data read request sent by a target central processor for reading target data; An identity authentication module, used for authenticating the target central processor if the currently used security mechanism is a preset first-class security mechanism; the first-class security mechanism is used to represent the identity authentication of the node sending the request, the encrypted transmission of data between nodes, and the encrypted storage of data in each distributed cache; A judgment module, configured to judge whether the plaintext data stored in the preset buffer after pre-decrypting the local target cache line is the target data if the identity authentication result indicates that the authentication is passed; A data transmission module is used to replace the ciphertext data in the target cache line with the plaintext data if it is the target data and any distributed cache is not the local cache of the target central processor, and encrypt the plaintext data using a preset encryption algorithm before transmitting it to the target central processor.

18. An electronic device, characterized in that: include: Memory, used to store computer programs; A processor, configured to execute the computer program to implement the steps of the data transmission method according to any one of claims 1 to 16.

19. A computer-readable storage medium, characterized in that: Used to store computer programs; wherein, when the computer program is executed by a processor, the steps of the data transmission method according to any one of claims 1 to 16 are implemented.

20. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instructions are executed by a processor, the steps of the data transmission method according to any one of claims 1 to 16 are implemented.

Images