USB encryption card supporting multiple users and multiple tasks and implementation method thereof

Abstract

The invention belongs to the technical field of information security, and particularly relates to a USB encryption card supporting multiple users and multiple tasks and an implementation method thereof. According to the method, a USB encryption card supporting multiple users and multiple tasks is adopted, modular design is adopted, and the USB encryption card comprises a management core board, multiple resource core boards and a bottom board. The management core board comprises a management CPU, a data transfer FPGA, an AI acceleration FPGA and a memory. The resource core board comprises a resource FPGA and peripheral circuits such as a clock and a power supply of the resource FPGA. And the management CPU comprises an AI-based resource scheduling module, an upper computer communication module, an encryption card cooperation module and an algorithm core configuration module. The USB encryption card solves the two problems that a USB encryption card usually only supports a single user and cannot encrypt and decrypt data of multiple users at the same time, and a plurality of encryption and decryption tasks for the single user are achieved in a serial data issuing mode and cannot be calculated at the same time, and efficiency is low.

Description

Technical Field

[0001] The present invention belongs to the technical field of information security, and more specifically, relates to a USB encryption card supporting multi-user and multi-task and an implementation method thereof. Background Art

[0002] USB encryption card is a security device that uses a standard USB interface and integrated encryption technology. It is widely used in government, military, finance, e-commerce and other fields, providing these industries with basic cryptographic services such as data encryption and decryption, signature verification, and key exchange.

[0003] Chinese invention patent CN116707970A discloses a network data encryption card and transmission method based on a hardware protocol, including a data transmission sending end and a receiving end connected to a transmission channel through respective network data encryption cards, and the network data encryption card includes: a receiving module, a cryptographic algorithm module and a sending module connected in sequence; the receiving module is used to receive data to be encrypted and decrypted, and transmit it to the cryptographic algorithm module; the cryptographic algorithm module performs real-time encryption and decryption on the received data based on the embedded national secret algorithm, and also embeds a homomorphic encryption algorithm to support the operation of key data ciphertext, and transmits it to the sending module; the sending module is used to output the encrypted and decrypted data.

[0004] Common USB encryption cards process multiple tasks by driving the data of multiple tasks into a serial data stream for encryption and decryption on the encryption card, which limits the speed of data encryption, especially affecting the efficiency of users processing large amounts of data. USB encryption cards often only support a single user and cannot encrypt and decrypt data of multiple users at the same time; and for a single multi-task requirement, the common processing method is to solve it by sending data serially for calculation, which cannot calculate multiple tasks at the same time and is inefficient. Summary of the invention

[0005] The present invention aims to overcome at least one defect of the above-mentioned prior art and provide a USB encryption card that supports multi-user and multi-tasking, so as to solve the problem that USB encryption cards often only support a single user and cannot encrypt and decrypt data of multiple users at the same time; and for the multi-tasking requirements of a single user, the common processing method is to solve it by serially sending data for encryption and decryption, which cannot encrypt and decrypt multiple tasks at the same time and is inefficient.

[0006] On the other hand, the present invention also provides a method for implementing a USB encryption card supporting multi-user and multi-tasking.

[0007] A USB encryption card supporting multi-user and multi-tasking adopts a modular design, including a management core board, multiple resource core boards and a base board; The management core board includes a management CPU, a data transfer FPGA, an AI acceleration FPGA, and a memory; Management CPU, responsible for encryption and decryption resource scheduling, intercommunication with the host computer, interconnection with other encryption cards and configuration of resource FPGA; The data transfer FPGA is responsible for the identification and forwarding of messages, including multiple USB user interfaces and an encryption card interconnection interface, which is used to interconnect two encryption cards. The data transfer FPGA includes a TCAM-based forwarding relationship table for recording the forwarding direction of the message. The AI-based resource scheduling module in the management CPU must add and delete this forwarding relationship table every time it allocates or deletes resources. AI acceleration FPGA, responsible for hardware acceleration of AI algorithms in the management CPU; Memory, responsible for storing and managing CPU system files and configuration files of algorithm cores; The resource core board includes a resource FPGA and peripheral circuits; Resource FPGA is responsible for executing the encryption algorithm of the encryption card.

[0008] Furthermore, the resource FPGA is divided into multiple mutually isolated reconfigurable areas, each reconfigurable area is used as a vFPGA to configure the algorithm core as required and execute the encryption algorithm, so that one resource FPGA can provide the same or different encryption and decryption for multiple users and multiple tasks at the same time; at the same time, a resource transfer module is constructed in the resource FPGA to be responsible for the transfer between each internal vFPGA and the data transfer FPGA; The resource FPGA has two configuration modes: if the vFPGA is configured, it is through the ICAP interface; if the FPGA is configured, it is through the selectmap interface.

[0009] Furthermore, the management CPU includes an AI-based resource scheduling module, a host computer communication module, an encryption card collaboration module, and an algorithm core configuration module: AI-based resource scheduling module, which uses AI to optimize and manage resource scheduling issues under multi-user and multi-task conditions, including the allocation and recovery of encryption and decryption resources; The host computer communication module realizes data intercommunication with the host computer. The message types of the data include the user's resource request, the encryption card's resource request response, the user's data to be encrypted and decrypted, the encryption card's encryption and decryption processing data, the encryption card's resource recovery request, and the user's resource recovery response; The encryption card collaboration module realizes the collaboration between the two encryption cards, facilitates the expansion of encryption and decryption resources of the encryption cards, and enables users to call the encryption and decryption resources in the two encryption cards at the same time; The algorithm core configuration module configures the corresponding algorithm core into the resource FPGA according to user requirements.

[0010] The present invention also includes a method for implementing a USB encryption card that supports multi-user and multi-tasking, the method comprising: S1. The user informs the encryption card of the resource request for this task through the host computer, and the resource request is transmitted to the management CPU through the data transfer FPGA for analysis, and the resource allocation result is obtained and uploaded to the host computer; S2. If the resource allocation result shows that collaborative processing is required between encryption cards, then: First, connect the two encryption cards through the encryption card interconnection interface and enter the collaborative mode. The encryption card connected to the host computer is automatically set as the master encryption card, and the other encryption card is the slave encryption card. The management CPU of the master encryption card performs unified resource scheduling. Then, the user calls the master encryption card for encryption and decryption, and then calls the slave encryption card for encryption and decryption; If the resource allocation result shows that there is no need for collaborative processing between encryption cards, the user directly calls the main encryption card for encryption and decryption; S3. The host computer sends the encrypted and decrypted data to the corresponding task.

[0011] Furthermore, the S1 specifically includes: S11, the user informs the encryption card of the resource request used for this task through the host computer, and the resource request is transmitted to the host computer communication module in the management CPU through the data transfer FPGA; S12, the host computer communication module of the management CPU parses the user's resource request; then, the requested number of vFPGAs and the algorithm type configured for each vFPGA are sent to the AI-based resource scheduling module; S13, the AI-based resource scheduling module in the management CPU analyzes the current resource usage to obtain the resource allocation result; if there are available resources, the information of available encryption and decryption resources corresponding to the request is returned to complete the resource allocation; if there are no available resources at present, a waiting time is predicted, and the user is informed to apply for resources after a waiting time; S14, the host computer communication module of the management CPU encapsulates the result of resource allocation into a resource response request message, and then sends it to the host computer via the data transfer FPGA; at the same time, the data transfer FPGA updates the corresponding relationship between the user and algorithm resource location information into the forwarding relationship table; S15. After the host computer receives the resource request response from the encryption card, if it shows that the resources have been allocated, it starts encryption and decryption; if it shows that the resources have not been allocated, it waits for a period of time and then reapplies.

[0012] Furthermore, the step of connecting the two encryption cards via the encryption card interconnection interface to enter the collaborative mode specifically includes: S21, connecting the two encryption cards through the encryption card interconnection interface, and the encryption card connected to the host computer is automatically set as the main encryption card; S22, the encryption card coordination module in the main encryption card management CPU sends a request message, which is forwarded by the data transfer FPGA of the main encryption card and the data transfer FPGA of the slave encryption card, and reaches the encryption card coordination module in the slave encryption card management CPU; S23, the encryption card coordination module in the slave encryption card management CPU sends available resource information, which is forwarded by the slave encryption card data transfer FPGA and the master encryption card data transfer FPGA, and reaches the encryption card coordination module in the master encryption card management CPU; S24. The encryption card coordination module in the main encryption card management CPU sends the resource information from the encryption card to the AI-based resource scheduling module for unified resource scheduling.

[0013] Furthermore, the user calling the main encryption card to perform encryption and decryption specifically includes: S31, the user sends the data to be encrypted and decrypted in the task and the allocated algorithm resource information package to the main encryption card through the host computer; S32, the data transfer FPGA in the main encryption card forwards the message to the corresponding resource FPGA according to the information recorded in the forwarding relationship table; S33, resource FPGA data transfer module forwards the message to the corresponding vFPGA according to the algorithm resource information; S34, the algorithm in the vFPGA encrypts and decrypts the data, and sends the encryption and decryption results and algorithm resource information in a package; S35, the data transfer module in the resource FPGA forwards the message to the data transfer FPGA, and then sends it to the corresponding user interface via the data transfer FPGA; S36. The host computer sends the received encryption and decryption results to the corresponding tasks.

[0014] Furthermore, the user calling the encryption and decryption from the encryption card specifically includes: S41, the user sends the data to be encrypted and decrypted in the task and the allocated algorithm resource information package to the main encryption card through the host computer; S42, the data transfer FPGA in the master encryption card forwards the message to the corresponding resource FPGA according to the information recorded in the forwarding relationship table; if the corresponding resource FPGA is in the slave encryption card, it is sent to the data transfer FPGA of the slave encryption card through the encryption card interconnection interface; S43, the data transfer FPGA of the encryption card sends the data to be encrypted and decrypted to the corresponding resource FPGA; S44, resource FPGA data transfer module forwards the message to the corresponding vFPGA according to the algorithm resource information; S45, the algorithm in the vFPGA encrypts and decrypts the data, and sends the encryption and decryption results and algorithm resource information in a package; S46, the data transfer module in the resource FPGA forwards the message to the data transfer FPGA, and then sends it to the corresponding user interface via the data transfer FPGA; S47, the host computer sends the received encryption and decryption results to the corresponding tasks.

[0015] Furthermore, encryption and decryption resource recovery is performed in real time during the process of S1-S3, specifically including: S51, the data transfer FPGA counts the calls of each task to the encryption card in real time, and sends the statistical results to the AI-based resource scheduling module in the management CPU at regular intervals; S52, the AI-based resource scheduling module in the management CPU analyzes the resource call statistics, determines the encryption and decryption resources that can be recycled, and sends the information of the recycled resources to the upper computer communication module; S53, the host computer communication module in the management CPU sends the resource recovery request to the host computer through the data transfer FPGA; S54, after receiving the resource recovery request, the host computer gives a response; S55, the upper computer communication module in the management CPU parses the resource recovery response forwarded by the data transfer FPGA, and sends the parsing result to the AI-based resource scheduling module; if the upper computer does not respond for a long time, it is regarded as resource recovery; S56. The AI-based resource scheduling module in the management CPU reserves or recycles the resources according to the response of the host computer; if the host computer agrees to recycle the resources, it updates its own statistics on the resources and notifies the data transfer FPGA to delete the forwarding association information of the resources to be recycled.

[0016] Compared with the prior art, the present invention has the following beneficial effects: (1) The present invention provides a USB encryption card supporting multiple users and multiple tasks and an implementation method thereof. The card is designed from two aspects: "internal segmentation" and "external expansion". Each resource FPGA in the encryption card is divided into multiple mutually isolated vFPGAs, and then the resource FPGAs are connected through a data transfer FPGA. At the same time, two encryption cards can expand resources through an interconnection interface, thereby realizing parallel processing of multiple encryption and decryption tasks for multiple users.

[0017] (2) The present invention provides a USB encryption card supporting multi-user and multi-tasking and its implementation method. For a single user, the present invention supports parallel processing of multiple encryption and decryption tasks, without the need to process multiple tasks serially like a traditional encryption card, thereby improving the speed of encryption and decryption; (3) The present invention provides a USB encryption card that supports multi-user and multi-tasking and its implementation method, which applies AI technology and uses AI to monitor the usage of encryption and decryption resources in real time, and dynamically adjusts resource allocation and recovery by analyzing historical data and real-time data. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1 This is the overall architecture diagram of the encryption card described in the present invention.

[0019] Figure 2 This is a schematic diagram of encryption card interconnection in Example 1 of the present invention. DETAILED DESCRIPTION

[0020] The present invention will be further described below in conjunction with the accompanying drawings and embodiments.

[0021] It should be noted that the following detailed descriptions are exemplary and are intended to provide further explanation of the present invention. Unless otherwise specified, all technical and scientific terms used herein have the same meanings as those commonly understood by those skilled in the art to which the present invention belongs.

[0022] It should be noted that the terms used herein are only for describing specific embodiments and are not intended to limit exemplary embodiments according to the present invention. As used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form. In addition, it should be understood that when the terms "comprising" and / or "including" are used in this specification, it indicates the presence of features, steps, operations, devices, components and / or combinations thereof.

[0023] In the absence of conflict, the embodiments of the present invention and the features of the embodiments may be combined with each other.

[0024] Example 1 Ginseng Figure 1 ,This embodiment provides a USB encryption card that supports multi-user and multi-tasking, adopts a modular design, and includes a management core board, multiple resource core boards and a base board; The management core board includes a management CPU, a data transfer FPGA, an AI acceleration FPGA, and a memory; The management CPU is responsible for the encryption and decryption resource scheduling, intercommunication with the host computer, interconnection with other encryption cards, and configuration of the resource FPGA; the encryption and decryption resource scheduling includes allocation and recovery.

[0025] The data transfer FPGA is responsible for the identification and forwarding of messages, including multiple USB user interfaces and an encryption card interconnection interface. The encryption card interconnection interface is used to interconnect two encryption cards, such as Figure 2 As shown; the data transfer FPGA includes a TCAM-based forwarding relationship table for recording the forwarding direction of the message; specifically, the AI-based resource scheduling module in the management CPU must add and delete this forwarding relationship table each time it allocates or deletes resources.

[0026] AI acceleration FPGA is responsible for hardware acceleration of AI algorithms in the management CPU.

[0027] The memory is responsible for storing the system files of the management CPU and the configuration files of the algorithm core; preferably, the memory is an NVMe memory.

[0028] The resource core board includes a resource FPGA and its peripheral circuits such as clock and power supply; The resource FPGA is responsible for executing the encryption algorithm of the encryption card. It executes the encryption algorithm of the encryption card in this field and can also execute the corresponding decryption by default.

[0029] Preferably, a resource FPGA is divided into multiple isolated reconfigurable areas, each reconfigurable area is used as a vFPGA (Virtualized FPGA) to configure the algorithm core as required and execute the encryption algorithm. This allows a resource FPGA to provide the same or different encryption and decryption for multiple users and multiple tasks at the same time; at the same time, a resource transfer module is built in the resource FPGA to be responsible for the transfer between each internal vFPGA and the data transfer FPGA; The resource FPGA includes two configuration modes: If the vFPGA is configured, it is done through the ICAP interface; if the FPGA is configured, it is done through the selectmap interface.

[0030] Furthermore, the management CPU includes an AI-based resource scheduling module, a host computer communication module, an encryption card collaboration module, and an algorithm core configuration module: The AI-based resource scheduling module is used for AI optimization and management of resource scheduling under multi-user and multi-task conditions. The resource scheduling under multi-task conditions includes the allocation and recovery of encryption and decryption resources. For example, if a user wants to use an encryption card, he needs to request resources from the encryption card first. At this time, the AI-based resource scheduling module needs to determine whether there are any available resources in the encryption card. If the user does not encrypt data for a long time, the AI-based resource scheduling module will determine whether the user has finished using the card based on historical data.

[0031] The host computer communication module realizes data intercommunication with the host computer; the message types of the data include the user's resource request, the encryption card's resource request response, the user's data to be encrypted and decrypted, the encryption card's encryption and decryption processing data, the encryption card's resource recovery request, and the user's resource recovery response; The encryption card collaboration module realizes the collaboration between the two encryption cards, facilitates the expansion of encryption and decryption resources of the encryption cards, and enables users to call the encryption and decryption resources in the two encryption cards at the same time; The algorithm core configuration module configures the corresponding algorithm core into the resource FPGA according to user requirements.

[0032] In summary, the present invention realizes multi-user multi-task parallel computing. In order to simultaneously meet the needs of multi-user multi-task parallel computing, this embodiment is designed from two aspects: "internal segmentation" and "external expansion".

[0033] (1) “Internal segmentation” refers to dividing a resource FPGA into multiple isolated reconfigurable areas. Each reconfigurable area acts as a vFPGA (Virtualized FPGA) to configure the algorithm core as required, so that a resource FPGA can provide the same or different encryption and decryption for multiple users and multiple tasks at the same time.

[0034] (2) “External expansion” means that the present invention adopts a modular design, and one encryption card can have multiple resource core boards (each resource core board has a resource FPGA). In addition, encryption cards can be cascaded and expanded through the encryption card interconnection interface.

[0035] This embodiment supports multiple users, each user occupies one user interface; each user can have multiple tasks; each task occupies one vFPGA; each vFPGA can be configured as one of multiple pre-set encryption algorithm cores.

[0036] The encryption and decryption resources of the encryption card are virtualized. The same user can use the vFPGA in the same resource FPGA, or use the vFPGA distributed in different resource FPGAs in the same encryption card. Even when two encryption cards are used for expansion, the same user can use the v encryption and decryption resources in different encryption cards.

[0037] The configuration of the resource FPGA is initiated by the algorithm core configuration module in the management CPU. There are two configuration methods. If the vFPGA is configured, the ICAP interface (Internal Configuration Access Port), that is, the internal configuration access interface, is used to partially reconfigure the FPGA; if a resource FPGA is configured globally, the selectmap interface is used. The selectmap interface is a parallel configuration interface used to directly program or configure the FPGA.

[0038] This embodiment also implements AI-based resource scheduling. In order to be able to handle resource scheduling problems in multi-user and multi-task scenarios in real time and dynamically, AI technology is introduced. AI is used to monitor the use of encryption and decryption resources in real time, and to dynamically adjust resource allocation and recycling by analyzing historical data and real-time data. AI-based resource scheduling involves resource allocation, resource recycling and AI acceleration: (4) Resource allocation: If the management CPU receives a resource request from the host computer, the AI-based resource scheduling module will analyze it from two aspects: one is how many resources are currently available, and the other is the number of resources requested by the user (the number of vFPGAs) and type (what algorithm the vFPGA is configured to execute). If the currently available resources can meet the user's needs, the user request will be approved, otherwise it will be rejected. At the same time, the management CPU will also inform the data transfer FPGA of the newly added resource allocation as a new forwarding basis.

[0039] (5) Resource recovery: The data transfer FPGA will count the algorithm plaintext data sent by the user and send the statistical results to the management CPU at regular intervals; the AI-based resource scheduling module in the management CPU will analyze the statistical results and infer the load of encryption and decryption resources in the current period of time, thereby inferring which encryption and decryption resources in the allocated state can be released, and notify the host computer communication module to confirm with the host computer whether the resource can be released.

[0040] (6) AI acceleration: The management CPU and AI acceleration FPGA together form a heterogeneous computing system, which divides the inference calculation process tasks in the AI ​​model calculation process into multiple stages, and performs pipeline design on the AI ​​acceleration FPGA. The parallel processing capability of the FPGA is used to perform hardware acceleration on the AI ​​model, thereby improving the inference speed of the AI ​​model in the management CPU.

[0041] Example 2 This embodiment provides a method for implementing a USB encryption card that supports multi-user and multi-tasking, the method comprising: S1. The user informs the encryption card of the resource request for this task through the host computer, and transmits it to the management CPU for analysis through the data transfer FPGA, obtains the resource allocation result and uploads it to the host computer. The resource request includes but is not limited to the requested number of vFPGAs, the encryption algorithm configured for the vFPGA, the address and other task related information used.

[0042] Specifically, the S1 specifically includes: S11, the user informs the encryption card of the resource request used for this task through the host computer, and the resource request is transmitted to the host computer communication module in the management CPU through the data transfer FPGA; S12, the host computer communication module of the management CPU parses the user's resource request; then, the requested number of vFPGAs and the algorithm type configured for each vFPGA are sent to the AI-based resource scheduling module; S13, the AI-based resource scheduling module in the management CPU analyzes the current resource usage to obtain the resource allocation result; if there are available resources, the information of available encryption and decryption resources corresponding to the request is returned to complete the resource allocation; if there are no available resources at present, a waiting time is predicted, and the user is informed to apply for resources after a waiting time; S14, the host computer communication module of the management CPU encapsulates the result of resource allocation into a resource response request message, and then sends it to the host computer via the data transfer FPGA; at the same time, the data transfer FPGA updates the corresponding relationship between the user and algorithm resource location information into the forwarding relationship table; S15. After the host computer receives the resource request response from the encryption card, if it shows that the resources have been allocated, it starts encryption and decryption; if it shows that the resources have not been allocated, it waits for a period of time and then reapplies.

[0043] S2. If the resource allocation result shows that collaborative processing is required between encryption cards, Figure 2 As shown, then: First, connect the two encryption cards through the encryption card interconnection interface and enter the collaborative mode. The encryption card connected to the host computer is automatically set as the master encryption card, and the other encryption card is the slave encryption card. The management CPU of the master encryption card performs unified resource scheduling. Specifically, the two encryption cards are connected through the encryption card interconnection interface to enter the collaborative mode, which specifically includes: S21, connect the two encryption cards through the encryption card interconnection interface, and the encryption card connected to the host computer is automatically set as the main encryption card; in the encryption card interconnection mode, only one encryption card is supported for communication with the user, that is, the main encryption card communicates with user 1 to user n; S22, the encryption card coordination module in the main encryption card management CPU sends a request message, which is forwarded by the data transfer FPGA of the main encryption card and the data transfer FPGA of the slave encryption card, and reaches the encryption card coordination module in the slave encryption card management CPU; S23, the encryption card coordination module in the slave encryption card management CPU sends available resource information, which is forwarded by the slave encryption card data transfer FPGA and the master encryption card data transfer FPGA, and reaches the encryption card coordination module in the master encryption card management CPU; S24. The encryption card coordination module in the main encryption card management CPU sends the resource information from the encryption card to the AI-based resource scheduling module for unified resource scheduling.

[0044] Then, the user calls the master encryption card for encryption and decryption, and then calls the slave encryption card for encryption and decryption; Specifically, the user calling the main encryption card to perform encryption and decryption specifically includes: S31, the user sends the data to be encrypted and decrypted in the task and the allocated algorithm resource information package to the main encryption card through the host computer, and the allocated algorithm resource information is the algorithm resource information that needs to be encrypted and decrypted; S32, the data transfer FPGA in the main encryption card forwards the message to the corresponding resource FPGA according to the information recorded in the forwarding relationship table; S33, resource FPGA data transfer module forwards the message to the corresponding vFPGA according to the algorithm resource information; S34, the algorithm in the vFPGA encrypts and decrypts the data, and sends the encryption and decryption results and algorithm resource information in a package; S35, the data transfer module in the resource FPGA forwards the message to the data transfer FPGA, and then sends it to the corresponding user interface via the data transfer FPGA; S36. The host computer sends the received encryption and decryption results to the corresponding tasks.

[0045] The user calling the encryption and decryption from the encryption card specifically includes: S41, the user sends the data to be encrypted and decrypted in the task and the allocated algorithm resource information package to the main encryption card through the host computer; S42, the data transfer FPGA in the master encryption card forwards the message to the corresponding resource FPGA according to the information recorded in the forwarding relationship table; if the corresponding resource FPGA is in the slave encryption card, it is sent to the data transfer FPGA of the slave encryption card through the encryption card interconnection interface; S43, the data transfer FPGA of the encryption card sends the data to be encrypted and decrypted to the corresponding resource FPGA; S44, resource FPGA data transfer module forwards the message to the corresponding vFPGA according to the algorithm resource information; S45, the algorithm in the vFPGA encrypts and decrypts the data, and sends the encryption and decryption results and algorithm resource information in a package; S46, the data transfer module in the resource FPGA forwards the message to the data transfer FPGA, and then sends it to the corresponding user interface via the data transfer FPGA; S47, the host computer sends the received encryption and decryption results to the corresponding tasks.

[0046] If the resource allocation result shows that there is no need for collaborative processing between encryption cards, the user directly calls the main encryption card for encryption and decryption.

[0047] S3. The host computer sends the encrypted and decrypted data to the corresponding task.

[0048] Preferably, encryption and decryption resource recovery is performed in real time during the process of S1-S3, specifically including: S51, the data transfer FPGA counts the calls of each task to the encryption card in real time, and sends the statistical results to the AI-based resource scheduling module in the management CPU at regular intervals; S52, the AI-based resource scheduling module in the management CPU analyzes the resource call statistics, determines the encryption and decryption resources that can be recycled, and sends the information of the recycled resources to the upper computer communication module; S53, the host computer communication module in the management CPU sends the resource recovery request to the host computer through the data transfer FPGA; S54, after receiving the resource recovery request, the host computer gives a response; S55, the upper computer communication module in the management CPU parses the resource recovery response forwarded by the data transfer FPGA, and sends the parsing result to the AI-based resource scheduling module; if the upper computer does not respond for a long time, it is regarded as resource recovery; S56. The AI-based resource scheduling module in the management CPU reserves or recycles the resources according to the response of the host computer; if the host computer agrees to recycle the resources, it updates its own statistics on the resources and notifies the data transfer FPGA to delete the forwarding association information of the resources to be recycled.

[0049] Obviously, the above embodiments of the present invention are merely examples for clearly illustrating the technical solution of the present invention, and are not intended to limit the specific implementation methods of the present invention. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the claims of the present invention shall be included in the protection scope of the claims of the present invention.

Claims

1. A USB encryption card supporting multi-user and multi-tasking, characterized in that: Including management core board, multiple resource core boards and base board; The management core board includes a management CPU, a data transfer FPGA, an AI acceleration FPGA, and a memory; Management CPU, responsible for encryption and decryption resource scheduling, intercommunication with the host computer, interconnection with other encryption cards and configuration of resource FPGA; The data transfer FPGA is responsible for the identification and forwarding of the message, including multiple USB user interfaces and an encryption card interconnection interface, and the encryption card interconnection interface is used to interconnect two encryption cards; the data transfer FPGA includes a forwarding relationship table based on TCAM, which is used to record the forwarding direction of the message; AI acceleration FPGA, responsible for hardware acceleration of AI algorithms in the management CPU; Memory, responsible for storing and managing CPU system files and configuration files of algorithm cores; The resource core board includes a resource FPGA and peripheral circuits; Resource FPGA is responsible for executing the encryption algorithm of the encryption card.

2. A USB encryption card supporting multi-user and multi-tasking according to claim 1, characterized in that: The resource FPGA is divided into multiple isolated reconfigurable areas, each of which acts as a vFPGA to configure the algorithm core as required and execute the encryption algorithm; at the same time, a resource transfer module is constructed in the resource FPGA to be responsible for the transfer between each internal vFPGA and the data transfer FPGA; The resource FPGA includes two configuration modes: If the vFPGA is configured, it is done through the ICAP interface; if the FPGA is configured, it is done through the selectmap interface.

3. A USB encryption card supporting multi-user and multi-tasking according to claim 2, characterized in that: The management CPU includes an AI-based resource scheduling module, a host computer communication module, an encryption card coordination module, and an algorithm core configuration module: AI-based resource scheduling module, which uses AI to optimize and manage resource scheduling issues under multi-user and multi-task conditions; The host computer communication module realizes data intercommunication with the host computer. The message types of the data include the user's resource request, the encryption card's resource request response, the user's data to be encrypted and decrypted, the encryption card's encryption and decryption processing data, the encryption card's resource recovery request and the user's resource recovery response; The encryption card collaboration module realizes the collaboration between two encryption cards and facilitates the expansion of encryption and decryption resources of encryption cards; The algorithm core configuration module configures the corresponding algorithm core into the resource FPGA according to user requirements.

4. A method for implementing a USB encryption card that supports multi-user and multi-tasking, characterized in that: The method comprises: S1. The user informs the encryption card of the resource request for this task through the host computer, and the resource request is transmitted to the management CPU through the data transfer FPGA for analysis, and the resource allocation result is obtained and uploaded to the host computer; S2. If the resource allocation result shows that collaborative processing is required between encryption cards, then: First, connect the two encryption cards through the encryption card interconnection interface and enter the collaborative mode. The encryption card connected to the host computer is automatically set as the master encryption card, and the other encryption card is the slave encryption card. The management CPU of the master encryption card performs unified resource scheduling. Then, the user calls the master encryption card for encryption and decryption, and then calls the slave encryption card for encryption and decryption; If the resource allocation result shows that there is no need for collaborative processing between encryption cards, the user directly calls the main encryption card for encryption and decryption; S3. The host computer sends the encrypted and decrypted data to the corresponding task.

5. The method for implementing a USB encryption card supporting multi-user and multi-tasking according to claim 4, characterized in that: The S1 specifically includes: S11, the user informs the encryption card of the resource request used for this task through the host computer, and the resource request is transmitted to the host computer communication module in the management CPU through the data transfer FPGA; S12, the host computer communication module of the management CPU parses the user's resource request; then, the requested number of vFPGAs and the algorithm type configured for each vFPGA are sent to the AI-based resource scheduling module; S13, the AI-based resource scheduling module in the management CPU analyzes the current resource usage to obtain the resource allocation result; if there are available resources, the information of available encryption and decryption resources corresponding to the request is returned to complete the resource allocation; if there are no available resources at present, a waiting time is predicted, and the user is informed to apply for resources after a waiting time; S14, the host computer communication module of the management CPU encapsulates the result of resource allocation into a resource response request message, and then sends it to the host computer via the data transfer FPGA; at the same time, the data transfer FPGA updates the corresponding relationship between the user and algorithm resource location information into the forwarding relationship table; S15. After the host computer receives the resource request response from the encryption card, if it shows that the resources have been allocated, it starts encryption and decryption; if it shows that the resources have not been allocated, it waits for a period of time and then reapplies.

6. The method for implementing a USB encryption card supporting multi-user and multi-tasking according to claim 5, characterized in that: The step of connecting the two encryption cards via the encryption card interconnection interface to enter the collaborative mode specifically includes: S21, connecting the two encryption cards through the encryption card interconnection interface, and the encryption card connected to the host computer is automatically set as the main encryption card; S22, the encryption card coordination module in the main encryption card management CPU sends a request message, which is forwarded by the data transfer FPGA of the main encryption card and the data transfer FPGA of the slave encryption card, and reaches the encryption card coordination module in the slave encryption card management CPU; S23, the encryption card coordination module in the slave encryption card management CPU sends available resource information, which is forwarded by the slave encryption card data transfer FPGA and the master encryption card data transfer FPGA, and reaches the encryption card coordination module in the master encryption card management CPU; S24. The encryption card coordination module in the main encryption card management CPU sends the resource information from the encryption card to the AI-based resource scheduling module for unified resource scheduling.

7. The method for implementing a USB encryption card supporting multi-user and multi-tasking according to claim 6, characterized in that: The user calling the main encryption card to perform encryption and decryption specifically includes: S31, the user sends the data to be encrypted and decrypted in the task and the allocated algorithm resource information package to the main encryption card through the host computer; S32, the data transfer FPGA in the main encryption card forwards the message to the corresponding resource FPGA according to the information recorded in the forwarding relationship table; S33, resource FPGA data transfer module forwards the message to the corresponding vFPGA according to the algorithm resource information; S34, the algorithm in the vFPGA encrypts and decrypts the data, and sends the encryption and decryption results and algorithm resource information in a package; S35, the data transfer module in the resource FPGA forwards the message to the data transfer FPGA, and then sends it to the corresponding user interface via the data transfer FPGA; S36. The host computer sends the received encryption and decryption results to the corresponding tasks.

8. The method for implementing a USB encryption card supporting multi-user and multi-tasking according to claim 6, characterized in that: The user calling the encryption and decryption from the encryption card specifically includes: S41, the user sends the data to be encrypted and decrypted in the task and the allocated algorithm resource information package to the main encryption card through the host computer; S42, the data transfer FPGA in the master encryption card forwards the message to the corresponding resource FPGA according to the information recorded in the forwarding relationship table; if the corresponding resource FPGA is in the slave encryption card, it is sent to the data transfer FPGA of the slave encryption card through the encryption card interconnection interface; S43, the data transfer FPGA of the encryption card sends the data to be encrypted and decrypted to the corresponding resource FPGA; S44, resource FPGA data transfer module forwards the message to the corresponding vFPGA according to the algorithm resource information; S45, the algorithm in the vFPGA encrypts and decrypts the data, and sends the encryption and decryption results and algorithm resource information in a package; S46, the data transfer module in the resource FPGA forwards the message to the data transfer FPGA, and then sends it to the corresponding user interface via the data transfer FPGA; S47, the host computer sends the received encryption and decryption results to the corresponding tasks.

9. The method for implementing a USB encryption card supporting multi-user and multi-tasking according to claim 4, characterized in that: During the S1-S3 process, encryption and decryption resources are recycled in real time, including: S51, the data transfer FPGA counts the calls of each task to the encryption card in real time, and sends the statistical results to the AI-based resource scheduling module in the management CPU at regular intervals; S52, the AI-based resource scheduling module in the management CPU analyzes the resource call statistics, determines the encryption and decryption resources that can be recycled, and sends the information of the recycled resources to the upper computer communication module; S53, the host computer communication module in the management CPU sends the resource recovery request to the host computer through the data transfer FPGA; S54, after receiving the resource recovery request, the host computer gives a response; S55, the upper computer communication module in the management CPU parses the resource recovery response forwarded by the data transfer FPGA, and sends the parsing result to the AI-based resource scheduling module; if the upper computer does not respond for a long time, it is regarded as resource recovery; S56. The AI-based resource scheduling module in the management CPU reserves or recycles the resources according to the response of the host computer; if the host computer agrees to recycle the resources, it updates its own statistics on the resources and notifies the data transfer FPGA to delete the forwarding association information of the resources to be recycled.

Images