Data processing method, data processing device and related equipment

Abstract

The embodiment of the invention provides a data processing method, a data processing device, a processor and related equipment, and the method is applied to a main processor core which is bound with a network card and is provided with a password coprocessor, and comprises the steps: receiving to-be-processed data packets sequentially sent by a network end, and then executing network layer processing to obtain a data vector; recording the data vectors into a ring buffer area in sequence, so that the main processor core and the slave processor core obtain the data vectors; after the data vector is acquired, data indicated by the data vector is encrypted / decrypted by using the cryptographic coprocessor to obtain first result data, and result information is fed back to the annular buffer area; sending the result data to a network end based on the indication of the data vector in the ring buffer; the result data comprises the first result data and the second result data obtained after the processor core carries out encryption / decryption processing on the data indicated by the data vector through the encryption / decryption program, and therefore full utilization of computing resources is achieved.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of computer technology, and specifically to a data processing method, a data processing device and related equipment. Background Art

[0002] With the continuous development of information technology, data security is becoming more and more important. Data security refers to the process of using technical means to identify the relative importance, sensitivity, compliance, etc. of various data sets such as files, databases, account information, etc. on the network, and taking appropriate security control measures to protect them. For example, Internet Protocol Security (IPSec) is used to protect various types of data on the network.

[0003] However, IPSec requires a lot of computing power when processing data on the network, and consumes a lot of computing resources, which easily leads to performance bottlenecks in IPSec when processing large data flows.

[0004] In this context, how to make full use of computing resources to ensure the computing power requirements of IPSec and improve data processing efficiency has become a technical problem that technical personnel in this field urgently need to solve. Summary of the invention

[0005] In view of this, an embodiment of the present application provides a data processing method, a data processing device and related equipment to fully utilize computing resources and improve data processing efficiency.

[0006] To achieve the above objectives, the embodiments of the present application provide the following technical solutions.

[0007] In a first aspect, an embodiment of the present application provides a data processing method, which is applied to a main processor core bound to a network card, and the main processor core is configured with a cryptographic coprocessor, and the method includes:

[0008] Receive the data packets to be processed sent by the network end in sequence;

[0009] Performing network layer processing on the data packet to be processed to obtain a data vector;

[0010] Recording the data vectors in a circular buffer in sequence, so that the master processor core and slave processor cores located in the computing architecture where the master processor core is located can obtain the data vectors;

[0011] After acquiring the data vector, using the cryptographic coprocessor, encrypting / decrypting the data indicated by the data vector to obtain first result data, and feeding the result information back to the ring buffer;

[0012] Based on the indication of the data vector in the ring buffer, the result data after the encryption / decryption processing is performed is sent to the network end; wherein the result data includes the first result data and the second result data, and the second result data is obtained by the slave processor core after acquiring the data vector and using the encryption / decryption program to perform encryption / decryption processing on the data indicated by the data vector, and after obtaining the second result data, the result information is fed back to the ring buffer.

[0013] Optionally, the cryptographic coprocessor is configured with a direct storage access queue;

[0014] After acquiring the data vector and before using the cryptographic coprocessor to perform encryption / decryption processing on the data indicated by the data vector, the method further includes:

[0015] Sending the acquired data vector to the direct storage access queue;

[0016] The utilizing the cryptographic coprocessor to perform encryption / decryption processing on the data indicated by the data vector specifically includes: utilizing the cryptographic coprocessor to perform encryption / decryption processing on the data indicated by the data vector in the direct storage access queue.

[0017] Optionally, the ring buffer includes a head and a tail, a head pointer indicating a position of the head is provided corresponding to the head, and a tail pointer indicating a position of the tail is provided corresponding to the tail;

[0018] The step of recording the data vectors into a ring buffer in sequence comprises:

[0019] The data vectors are recorded in sequence into the head position indicated by the head pointer of the ring buffer; wherein, each time a data vector is recorded, the head position indicated by the head pointer of the ring buffer advances by one position;

[0020] The step of sending the result data after performing the encryption / decryption processing to the network end based on the indication of the data vector in the ring buffer includes:

[0021] According to the tail position indicated by the tail pointer and based on the indication of the data vector in the ring buffer, the result data after encryption / decryption processing is sent to the network end; wherein, each time a result data is sent, the tail position indicated by the tail pointer of the ring buffer advances one position.

[0022] Optionally, in the ring buffer, a status flag is set corresponding to the data vector, and the status flag is used to indicate the encryption / decryption processing status of the data indicated by the data vector;

[0023] After the result information is fed back to the ring buffer, the status flag is updated based on the result information; wherein, if the status flag is a first value, it indicates that the encryption / decryption processing of the data indicated by the data vector is not completed; if the status flag is a second value, it indicates that the encryption / decryption processing of the data indicated by the data vector is completed.

[0024] Optionally, based on the indication of the data vector in the ring buffer, the result data after encryption / decryption processing is sent to the network end, and in the ring buffer, the status flag bit of the corresponding data vector is the second value.

[0025] Optionally, the main processor core obtains the data vector in the ring buffer based on a compare-and-swap (CAS) mechanism.

[0026] Optionally, when the slave processor core is configured with a cryptographic coprocessor, the second result data included in the result data is obtained by the slave processor core after acquiring the data vector and using the cryptographic coprocessor to perform encryption / decryption processing on the data indicated by the data vector, and after obtaining the second result data, the result information is fed back to the ring buffer.

[0027] In a second aspect, an embodiment of the present application provides a data processing method, which is applied to a slave processor core, and the method includes:

[0028] Acquire data vectors in the ring buffer; wherein the data vectors are the main processor core located in the computing architecture where the slave processor core is located, receive the data packets to be processed sent by the network end, perform network layer processing on the data packets to be processed, and sequentially record the data vectors in the ring buffer; the main processor core is bound to the network card and is configured with a cryptographic coprocessor;

[0029] The data indicated by the acquired data vector is encrypted / decrypted by using an encryption / decryption program to obtain second result data, and the result information is fed back to the ring buffer.

[0030] Optionally, the slave processor core obtains the data vector in the ring buffer based on a compare-and-swap (CAS) mechanism.

[0031] Optionally, when the slave processor core is configured with a cryptographic coprocessor, the second result data is obtained by using the cryptographic coprocessor to encrypt / decrypt the data indicated by the acquired data vector, and after obtaining the second result data, the result information is fed back to the ring buffer.

[0032] Optionally, in the ring buffer, a status flag is set corresponding to the data vector, and the status flag is used to indicate the encryption / decryption processing status of the data indicated by the data vector;

[0033] After the result information is fed back to the ring buffer, the status flag is updated based on the result information; wherein, if the status flag is a first value, it indicates that the encryption / decryption processing of the data indicated by the data vector is not completed; if the status flag is a second value, it indicates that the encryption / decryption processing of the data indicated by the data vector is completed.

[0034] In a third aspect, an embodiment of the present application provides a data processing device, which is applied to a main processor core bound to a network card, and the main processor core is configured with a cryptographic coprocessor, including:

[0035] A receiving unit, used for receiving data packets to be processed sent sequentially by the network end;

[0036] A processing unit, configured to perform network layer processing on the data packet to be processed to obtain a data vector;

[0037] a writing unit, configured to sequentially record the data vectors into a ring buffer so that the master processor core and slave processor cores located in the computing architecture where the master processor core is located obtain the data vectors;

[0038] a main execution unit, configured to, after acquiring the data vector, use the cryptographic coprocessor to perform encryption / decryption processing on the data indicated by the data vector to obtain first result data, and feed back the result information to the ring buffer;

[0039] A sending unit is used to send the result data after performing encryption / decryption processing to the network end based on the indication of the data vector in the ring buffer; wherein the result data includes the first result data and the second result data, and the second result data is obtained by the slave processor core after acquiring the data vector and using the encryption / decryption program to perform encryption / decryption processing on the data indicated by the data vector, and after obtaining the second result data, the result information is fed back to the ring buffer.

[0040] In a fourth aspect, an embodiment of the present application provides a data processing device, characterized in that it is applied to a slave processor core, including:

[0041] an acquisition unit, configured to acquire data vectors in a ring buffer; wherein the data vectors are received by a main processor core located in a computing architecture where the slave processor core is located, the main processor core receives a data packet to be processed sent by a network terminal, performs network layer processing on the data packet to be processed, and sequentially records the data vectors in a ring buffer; the main processor core is bound to a network card and is configured with a cryptographic coprocessor;

[0042] The slave execution unit is used to use an encryption / decryption program to perform encryption / decryption processing on the data indicated by the acquired data vector to obtain second result data, and feed back the result information to the ring buffer.

[0043] In a fifth aspect, an embodiment of the present application provides a processor, comprising: a main processor core, a slave processor core and an asynchronous engine; the main processor core is bound to a network card and is configured with a cryptographic coprocessor;

[0044] The main processor core is used to schedule the asynchronous engine and the cryptographic coprocessor to execute the data processing method as described in the first aspect above;

[0045] The slave processor core is used to schedule the asynchronous engine based on the master processor core to execute the data processing method as described in the second aspect above.

[0046] Optionally, the master processor core and the slave processor core are allocated at least according to initial state information of each processor core when the processor is initialized.

[0047] In a sixth aspect, an embodiment of the present application provides a chip, comprising the processor as described in the fifth aspect above.

[0048] In a seventh aspect, an embodiment of the present application provides a computing device, comprising the chip as described in the sixth aspect above.

[0049] In an eighth aspect, an embodiment of the present application provides a storage medium, which stores one or more computer-executable instructions. When the one or more computer-executable instructions are executed, the data processing method described in the first aspect or the second aspect above is implemented.

[0050] In a ninth aspect, an embodiment of the present application provides a computer program product, comprising one or more computer executable instructions, which, when executed, implement the data processing method as described in the first or second aspect above.

[0051] The data processing method provided in the embodiment of the present application can perform network layer processing on the data packets to be processed sent by the received network end based on the main processor core bound to the network card to obtain data vectors, and then the data vectors can be recorded in sequence into the ring buffer, so that the main processor core and the slave processor core located in the computing architecture where the main processor core is located can obtain the data vectors, thereby making full use of the main processor core and the slave processor core to perform encryption / decryption processing, thereby improving data processing efficiency.

[0052] Moreover, after obtaining the data vector, the main processor core can utilize the cryptographic coprocessor based on the configured cryptographic coprocessor to perform encryption / decryption processing on the data indicated by the data vector, obtain the first result data, and feed the result information back to the ring buffer, thereby realizing encryption / decryption processing of the data indicated by the data vector based on the hardware device (i.e., the cryptographic coprocessor); after obtaining the data vector, the slave processor core can utilize the encryption / decryption program to perform encryption / decryption processing on the data indicated by the data vector, obtain the second result data, and feed the result information back to the ring buffer, thereby realizing encryption / decryption processing of the data indicated by the data vector based on the software program (i.e., the encryption / decryption program). Furthermore, based on the indication of the data vector in the ring buffer, the result data after the encryption / decryption processing is sent to the network end. It can be seen that the embodiment of the present application can simultaneously utilize hardware computing resources and software computing resources to perform encryption / decryption processing, effectively ensuring the computing power requirements of IPSec. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.

[0054] Figure 1 It is a schematic diagram of the process of transmitting data between the communicating parties in IPSec.

[0055] Figure 2 This is a schematic diagram of the data processing flow in the synchronization engine mode of VPP.

[0056] Figure 3 This is a diagram of the data processing flow in the "dpdk_cryptodev" asynchronous engine mode of VPP.

[0057] Figure 4 It is an optional flow chart of the data processing method provided in the embodiment of the present application.

[0058] Figure 5It is a schematic diagram of an optional structure of a ring buffer provided in an embodiment of the present application.

[0059] Figure 6 It is a schematic diagram of the data processing flow provided in the embodiment of the present application.

[0060] Figure 7 It is a performance comparison diagram provided in the embodiments of the present application.

[0061] Figure 8 It is an optional schematic diagram of the data processing device provided in an embodiment of the present application.

[0062] Fig. 9 It is another optional schematic diagram of the data processing device provided in an embodiment of the present application.

[0063] Fig.10 It is an optional block diagram of a computing device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0064] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0065] Internet Protocol Security (IPSec) is a collection of protocols and services that provide security for IP networks. It is mainly used to establish a secure and protected private network on an insecure public network and is a commonly used technology in VPN (Virtual Private Network). IPSec establishes an IPsec tunnel between two or more private networks on the public network, allowing both communicating parties to use the IPSec tunnel to ensure the security of the VPN connection through encryption and verification algorithms. Specifically, the communicating parties can establish a security alliance through key exchange to form an IPSec tunnel. The data flowing through the tunnel is protected by encryption and verification mechanisms to prevent the data from being stolen and tampered with during transmission, thereby ensuring the security of data transmission.

[0066] Figure 1 The following is a schematic diagram showing the flow of data transmission between two communicating parties in IPSec. Figure 1As shown, the IPSec sender and the IPSec receiver first generate and share a symmetric key. The generation and sharing of the symmetric key can be implemented based on a key exchange protocol. Then, the IPSec sender uses the symmetric key to use an encryption algorithm to encrypt the IP message, that is, to encrypt and encapsulate the original IP data to obtain the IP message ciphertext. Then, the IPSec sender and the IPSec receiver process the IP message ciphertext using the same verification algorithm and verification key to obtain an integrity check value ICV (Integrity Check Value). Then, the IPSec receiver compares the calculated ICV with the ICV value of the IPSec sender to see if they are the same. If they are the same, it means that the IP message ciphertext has not been tampered with during transmission. The IPSec receiver uses the same symmetric key as the IPSec sender to use a decryption algorithm to decrypt the verified IP message ciphertext to obtain the IP message civilized text, that is, the original IP data. Among them, if the IPSec receiver compares the calculated ICV with the ICV value of the IPSec sender and the ICV value is different, it means that the IP message ciphertext has been tampered with during transmission, and the IP message ciphertext can be directly discarded.

[0067] In the process of data transmission between the two communicating parties of IPSec, the dotted-line part in the figure has a large computing power requirement and consumes a large amount of computing resources. When the data flow transmitted between the sender and the receiver of IPSec is large, performance bottlenecks in data forwarding are likely to occur.

[0068] To solve the above problem, as an optional implementation, a synchronization engine in VPP (Vector Packet Processing) technology may be used to perform data processing.

[0069] It should be noted that VPP has its own IPSec function, which provides a framework for processing IPSec data plane forwarding, and supports the registration of various encryption / decryption engines to provide algorithm support for IPSec.

[0070] VPP can abstract each functional block (i.e., software or hardware modules responsible for performing specific network operation tasks, which can involve various stages of data packet processing, such as filtering, encryption, decryption, load balancing, etc.) into a directed graph node, and input a set of data vectors at each node, so that the data vectors can be processed in the same way inside the node to maximize the efficiency of the CPU instruction cache. Among them, after each node completes the execution of one or a class of fixed functions, all nodes can be organized into a tree diagram, starting from the entry node. When a node processes the data vector, it sends the data vector to the next node for processing according to the processing logic, and passes it from the receiving node to the sending node, or discards it halfway.

[0071] Furthermore, to ensure the hit rate of data in the cache, VPP can bind the NIC's receive queue (RX queue) to a fixed processor thread, and in a multi-core processor, all threads can form a one-to-one correspondence with the processor core. Therefore, during the entire software running cycle, the NIC's data packet reception can be processed by a fixed processor core, and all processor cores, whether bound to the NIC or not, have the function of processing other VPP nodes.

[0072] When processing data, the crypto engine provided by VPP can be divided into synchronous engine and asynchronous engine. In the synchronous engine mode, the caller's call to the data processing algorithm function is synchronous, that is, when the called function returns, the data has been processed; in the asynchronous engine mode, the caller's call to the data processing algorithm function is asynchronous, that is, when the called function returns, the data has been arranged to other modules for data processing, and the processing results will be notified to the caller later through polling or interruption.

[0073] in, Figure 2 The following is an exemplary diagram of the data processing flow in the synchronous engine mode of VPP. Figure 2 As shown, when the VPP-based synchronization engine mode processes IPSec network traffic, for multi-core processors, in order to improve the network data processing performance, the data processing work of the network card can be assigned to a specific processor core X, that is, only the processor core bound to the network card can receive the data packet sent by the network end, where Figure 2 The dotted interval is the thread of the processor core X. On the thread of the processor core X, four stages are experienced: receiving the data packet sent by the network end (i.e., receiving the packet), processing the data packet at the network layer, encryption / decryption operation, and sending the processed data packet to the network end (i.e., sending the packet). Among them, the network layer processing may include the fragmentation and reassembly of the data packet. For example, when the data packet is too large, it is necessary to divide the data packet into smaller fragments at the network layer, and record the fragmentation information so that it can be correctly assembled when other fragments are received later; data parsing, such as parsing the IP, TCP / UDP and other network protocol headers to determine the destination address, source address, port number and protocol type of the data packet; route search, such as querying the routing table to determine how to forward the data packet according to the destination address of the data; data security check, such as verifying the integrity and identity authentication information of the AH or ESP header encapsulated in the IPSec data packet to ensure the confidentiality of the data and the authenticity of the source; establishment of a transmission tunnel, etc.

[0074] However, in the synchronous engine mode of VPP, only the single processor core X bound to the network card can execute the entire process from receiving to sending data packets. Therefore, when the data traffic exceeds the processing capacity of the processor core X, even if other processor cores in the multi-core processor are in idle state, they cannot share the processing tasks for the processor core X, which limits the concurrency capability of the multi-core processor and makes the computing resources of the multi-core processor unable to be effectively utilized.

[0075] To utilize the multi-threaded processing performance of a multi-core processor, as another optional implementation, the asynchronous engine in the VPP technology can be used for data processing.

[0076] It should be noted that VPP comes with two asynchronous engines, namely "sw_scheduler" and "dpdk_cryptodev". "sw_scheduler" is the Software Scheduler, which is mainly used to manage the input and output operations of the processor within VPP, decompose the processing tasks of data packets to different processor cores, and realize high-performance data traffic scheduling in a multi-core environment. "dpdk_cryptodev" is the encryption device driver module of the DPDK (Data Plane Development Kit). dpdk_cryptodev can provide a hardware-accelerated method for the processor to process the encryption / decryption operations of data packets.

[0077] It should be further explained that the Data Plane Development Kit (hereinafter referred to as "DPDK") is a user space network development platform that focuses on the performance optimization of high-speed network data paths. It is usually used in high-performance network applications such as load balancing, firewalls and switches, etc. It provides a set of libraries and driver programs that enable the processor to quickly process data packets. Based on DPDK, data packets can be sent and received to the network end. After receiving the data packets sent by the network end, the processing device can divide the data packets into multiple groups of data vectors. The data vectors are memory areas of a certain size, which correspond to memory address information. Each group of data vectors can contain up to 256 memory addresses of data packets. Among them, DPDK contains an important component VDEV (VirtualDevice). VDEV is a virtual device driver that provides an abstraction layer that can be both software abstraction and hardware abstraction, allowing developers to create and configure virtual devices. These virtual devices can be abstract real hardware devices or software devices developed by users themselves. Real hardware devices such as network cards, cryptographic coprocessors, etc.; software devices developed by users themselves such as OpenSSL encryption / decryption algorithms, loopback interfaces, and internal queues.

[0078] Moreover, in the data processing process, a high-performance, memory-based network packet queue structure, the Ring Buffer, is provided. Data vectors are stored in the Ring Buffer in a first-in-first-out (FIFO) manner, so that the order in which data is written corresponds to the order in which data is read, achieving efficient data transfer between kernel space and user space, reducing kernel space context switching and memory copying, and significantly improving network throughput and latency.

[0079] In the DPDK environment, VPP can use the DPDK API (DPDK application program interface) to create and manage devices using VDEV. Developers can create multiple VDEV instances, each corresponding to a physical network interface or a software simulation interface, so that they can directly access the hardware, reduce the operating system overhead, and achieve more efficient data packet processing. VPP configures each network interface as a large, lock-free ring buffer through VDEV, so that the reception and transmission of data packets can be performed concurrently between multiple processor core threads of the processor, greatly improving network processing capabilities.

[0080] Taking processor core 0 to processor core n as multiple processor cores of a processor, and processor core 0 is bound to a network card as an example, the data processing flow in the "sw_scheduler" asynchronous engine mode of VPP is described. When processing IPSec network traffic in the "sw_scheduler" asynchronous engine mode of VPP, in order to improve the overall performance, it can be configured that only processor core 0 has the authority to send and receive data packets to the network end. Therefore, after receiving the data packet sent by the network end, processor core 0 can perform network layer processing on the data packet, that is, perform corresponding operations according to the rules of the network protocol stack, such as checking header information, routing selection, etc., and combine the processed data packets into data vectors and store them in a specially designed ring buffer. Among them, the ring buffer provides a data vector extraction function for processor cores 1 to processor cores n, so that the encryption / decryption calculation task of the data vector stored in the ring buffer can be shared by processor cores 1 to processor cores n, that is, the data vector is non-blockingly distributed to processor cores 1 to processor cores n using an encryption / decryption program and a software algorithm to perform encryption / decryption processing. The encryption / decryption program can be a software program for performing data encryption / decryption operations.

[0081] in, Figure 3 The following is an exemplary diagram of the data processing flow in the "dpdk_cryptodev" asynchronous engine mode of VPP. Figure 3As shown in the figure, when processing IPSec network traffic in the "dpdk_cryptodev" asynchronous engine mode of VPP, in order to improve the overall performance, the processor core 0 can be configured to be bound to the network card and have the authority to receive data packets from the network end. Moreover, after receiving the data packets sent by the network end, the processor core 0 can perform network layer processing on the data packets, and combine the processed data packets into data vectors, and send them to the VDEV abstracted by the cryptographic coprocessor managed by DPDK for encryption / decryption processing.

[0082] However, for the asynchronous engine mode of VPP, although the "sw_scheduler" asynchronous engine can send computing tasks to processor cores 1 to n for execution, and utilize the software computing capabilities of multiple processor cores, it does not utilize the cryptographic coprocessor. The "dpdk_cryptodev" asynchronous engine only uses core 0 bound to the network card to meet the need to deliver data to the cryptographic coprocessor, realizing the use of hardware computing resources, while the software computing resources of other idle processor cores (i.e., processor cores 1 to n) cannot be used. Obviously, both the "sw_scheduler" asynchronous engine and the "dpdk_cryptodev" asynchronous engine waste computing resources and cannot achieve the simultaneous use of hardware resources and software resources.

[0083] In view of this, the embodiment of the present application provides a new data processing solution, by which the main processor core bound to the network card and the slave processor core located in the computing architecture where the main processor core is located obtain data vectors in the ring buffer, so as to make full use of the main processor core and the slave processor core to perform encryption / decryption processing and improve data processing efficiency. Moreover, in the case where the main processor core is configured with a cryptographic coprocessor, the main processor core can use the cryptographic coprocessor to perform encryption / decryption processing on the data indicated by the data vector after obtaining the data vector, and the slave processor core can use the encryption / decryption program to perform encryption / decryption processing on the data indicated by the data vector after obtaining the data vector, so as to realize the simultaneous use of hardware computing resources and software computing resources to perform encryption / decryption processing, and effectively ensure the computing power requirements of IPSec.

[0084] Based on the above ideas, Figure 4 The optional flow chart of the data processing method of the embodiment of the present application is shown as an example. Figure 4 As shown, the following steps may be included:

[0085] Step S100: the main processor core receives data packets to be processed sent sequentially by the network end.

[0086] The main processor core may be a processor core bound to a network card configured based on considerations of improving the overall performance of the processor, and the main processor core may be configured with a cryptographic coprocessor to provide hardware-based encryption / decryption services, digest calculation services, etc. for the main processor core. The cryptographic coprocessor is internally fixed with a chip private key, which is not allowed to be read by any device other than the cryptographic coprocessor to ensure data security.

[0087] It is understandable that in a processor core provided with a cryptographic coprocessor, since the device that performs data encryption / decryption operations is a cryptographic coprocessor, the processor core is only responsible for data interaction with the cryptographic coprocessor, and only involves logical judgment and memory copy operations in the algorithm process, and its occupancy rate is low, and its own computing power is relatively abundant. Therefore, in order to effectively utilize the idle computing power of the processor core, the processor core can be bound to the network card so that it can take into account the sending and receiving of the data packets to be processed sent by the network end and the network layer processing work. Among them, the processor core bound to the network card can be called the "master processor core", and the other processor cores in the computing architecture where the master processor core is located can be called the "slave processor core". As an optional implementation, the master processor core and the slave processor core can be allocated according to the initial state information of each processor core during the initialization phase of the multi-core processor. Moreover, in a chip with a cryptographic coprocessor, a processor core configured with a cryptographic coprocessor can be matched according to the number of cryptographic coprocessors, so that the processor core configured with the cryptographic coprocessor can perform data encryption / decryption operations using hardware, and other processor cores not configured with the cryptographic coprocessor can perform data encryption / decryption operations using software (such as encryption / decryption programs). Among them, the main processor core must be configured with a cryptographic coprocessor.

[0088] Step S110 : the main processor core performs network layer processing on the data packet to be processed to obtain a data vector.

[0089] A data vector may be obtained by the main processor core performing network layer processing on the data packet to be processed, and the data vector may correspond to a data memory address indicating the data packet to be processed.

[0090] In step S120 , the main processor core records the data vectors into a ring buffer in sequence.

[0091] In the process of data processing using VPP technology, based on the ring buffer provided by it for storing data vectors, in order to reduce context switching and memory copying in kernel space, improve network throughput and reduce latency, the main processor core can record the data vectors obtained by performing network layer processing on the data packets to be processed into the ring buffer in sequence according to the order in which the data packets to be processed are received.

[0092] It should be noted that the ring buffer of the embodiment of the present application can correspond to all processor cores in the multi-core processor, so that all processor cores can obtain data vectors in the ring buffer. In other words, by the main processor recording the data vectors in sequence into the ring buffer, the main processor core can execute step S130, the main processor core obtains the data vector in the ring buffer, and the slave processor core located in the computing architecture where the main processor core is located executes step S140, the slave processor core obtains the data vector in the ring buffer, thereby making full use of the main processor core and the slave processor core to perform encryption / decryption processing, thereby improving data processing efficiency.

[0093] Further, after acquiring the data vector, the master processor core may execute step S150 and the slave processor core may execute step S160.

[0094] Step S150: the main processor core uses the cryptographic coprocessor to perform encryption / decryption processing on the data indicated by the data vector.

[0095] Step S160: The slave processor core uses an encryption / decryption program to perform encryption / decryption processing on the data indicated by the acquired data vector.

[0096] In the case where the main processor core is configured with a cryptographic coprocessor, the main processor core can use the cryptographic coprocessor to perform encryption / decryption processing on the data indicated by the acquired data vector, thereby obtaining first result data, and feeding back the result information to the ring buffer. The slave processor can use the encryption / decryption program to perform encryption / decryption processing on the data indicated by the acquired data vector, thereby obtaining second result data, and feeding back the result information to the ring buffer.

[0097] It should be noted that, as an optional implementation, when the slave processor core is configured with a cryptographic coprocessor, based on the cryptographic coprocessor's role in performing encryption / decryption operations on data, the second result data obtained in step S160 can be obtained by the slave processor core using the cryptographic coprocessor to perform encryption / decryption processing on the data indicated by the acquired data vector, and after obtaining the second result data, the result information is fed back to the ring buffer. Wherein, when the cryptographic coprocessor is configured with a direct storage access queue, the slave processor core can send the acquired data vector to the direct storage access queue, so that when the cryptographic coprocessor is used to perform encryption / decryption processing on the data indicated by the acquired data vector, the cryptographic coprocessor can be used to perform encryption / decryption processing on the data indicated by the data vector in the direct storage access queue.

[0098] The result information may be that the encryption / decryption processing of the data indicated by the data vector is in progress, the encryption / decryption processing of the data indicated by the data vector fails, or the encryption / decryption processing of the data indicated by the data vector succeeds. If the encryption / decryption processing of the data indicated by the data vector is in progress, it indicates that the encryption / decryption processing of the data indicated by the data vector is not completed; if the encryption / decryption processing of the data indicated by the data vector fails or succeeds, it indicates that the encryption / decryption processing of the data indicated by the data vector is completed.

[0099] It should be noted that in the embodiment of the present application, the main processor core uses the cryptographic coprocessor to perform encryption / decryption processing on the data indicated by the acquired data vector, so that the main processor core can immediately return to perform other operations after sending the acquired data vector to the cryptographic coprocessor. Since the slave processor core uses its own encryption / decryption program to perform encryption / decryption processing on the data indicated by the acquired data vector, the slave processor core can only return to perform the next operation after completing the encryption / decryption processing on the data indicated by the acquired data vector.

[0100] Step S170: the main processor core sends the result data after performing the encryption / decryption processing to the network end based on the indication of the data vector in the ring buffer.

[0101] Wherein, in the case where both the master processor core and the slave processor core feed back the result information to the ring buffer, the result data may include first result data and second result data.

[0102] It can be seen that the embodiment of the present application can perform network layer processing on the data packets to be processed sent by the received network end based on the main processor core bound to the network card, obtain data vectors, and then record the data vectors in sequence into the circular buffer, so that the main processor core and the slave processor core located in the computing architecture where the main processor core is located can obtain the data vectors, thereby making full use of the main processor core and the slave processor core to perform encryption / decryption processing, thereby improving data processing efficiency.

[0103] Moreover, after obtaining the data vector, the main processor core can utilize the cryptographic coprocessor based on the configured cryptographic coprocessor to perform encryption / decryption processing on the data indicated by the data vector, obtain the first result data, and feed the result information back to the ring buffer, thereby realizing encryption / decryption processing of the data indicated by the data vector based on the hardware device (i.e., the cryptographic coprocessor); after obtaining the data vector, the slave processor core can utilize the encryption / decryption program to perform encryption / decryption processing on the data indicated by the data vector, obtain the second result data, and feed the result information back to the ring buffer, thereby realizing encryption / decryption processing of the data indicated by the data vector based on the software program (i.e., the encryption / decryption program). Furthermore, based on the indication of the data vector in the ring buffer, the result data after the encryption / decryption processing is sent to the network end. It can be seen that the embodiment of the present application can simultaneously utilize hardware computing resources and software computing resources to perform encryption / decryption processing, effectively ensuring the computing power requirements of IPSec.

[0104] In some embodiments, in order to facilitate the cryptographic coprocessor to perform encryption / decryption processing on the data indicated by the data vector, the cryptographic coprocessor of the embodiment of the present application may be provided with a direct storage access queue (DMA queue), which is used to store the data vectors that the main processor core needs to perform encryption / decryption processing by the cryptographic coprocessor.

[0105] Therefore, after the main processor core obtains the data vector from the ring buffer and before the main processor core uses the cryptographic coprocessor to perform encryption / decryption processing on the data indicated by the data vector, the main processor core can also send the obtained data vector to the direct storage access queue.

[0106] Based on the storage of data vectors by the direct storage access queue, the main processor core uses the cryptographic coprocessor to encrypt / decrypt the data indicated by the data vectors. Specifically, the main processor core uses the cryptographic coprocessor to encrypt / decrypt the data indicated by the data vectors in the direct storage access queue.

[0107] In some embodiments, Figure 5 The optional structural diagram of the ring buffer of the embodiment of the present application is shown as an example. Figure 5 As shown, the ring buffer may include a head (Head) and a tail (Tail), and a head pointer indicating the position of the head may be set corresponding to the head, and a tail pointer indicating the position of the tail may be set corresponding to the tail, thereby forming a closed-loop structure that accommodates a fixed number of elements.

[0108] Based on the head and tail structure of the ring buffer, when the data vectors are recorded in sequence into the ring buffer, the data vectors may be recorded in sequence into the head position indicated by the head pointer of the ring buffer. Wherein, each time a data vector is recorded, the head position indicated by the head pointer of the ring buffer advances by one position (in the direction indicated by the arrow in the figure). When the result data after the encryption / decryption processing is sent to the network end based on the indication of the data vector in the ring buffer, the result data after the encryption / decryption processing may be sent to the network end based on the tail position indicated by the tail pointer and the indication of the data vector in the ring buffer. Wherein, each time a result data is sent, the tail position indicated by the tail pointer of the ring buffer advances by one position (in the direction indicated by the arrow in the figure).

[0109] In some embodiments, in order to extract the processed result data from the circular buffer, a status flag may be set in the circular buffer corresponding to the data vector, and the status flag is used to indicate the encryption / decryption processing status of the data indicated by the data vector. Thus, after the cryptographic coprocessor or the slave processor core feeds back the result information to the circular buffer, the status flag may be updated based on the result information. If the status flag is a first value (e.g., 0), it may indicate that the encryption / decryption processing of the data indicated by the data vector is not completed. If the status flag is a second value (e.g., 1), it may indicate that the encryption / decryption processing of the data indicated by the data vector is completed.

[0110] As an optional implementation, based on the indication of the data vector in the ring buffer, the result data after executing the encryption / decryption processing is sent to the network end. In the ring buffer, the status flag of the corresponding data vector can be the second value, that is, in the ring buffer, only the result data indicated by the data vector whose status flag indicates that it is completed can be sent to the network end.

[0111] In some embodiments, since the ring buffer is a closed-loop structure, when the master processor core and the slave processor core share the ring buffer, in order to ensure the data consistency of the ring buffer and avoid race conditions in a concurrent environment, the master processor core and the slave processor core can obtain the data vector in the ring buffer based on a compare and swap (CAS) mechanism. Among them, the CAS mechanism provides an atomic operation method to check whether the current value has changed. If it has not changed, the data is updated, otherwise no operation is performed. Through the CAS operation, the threads of the processor core can compete in an asynchronous manner, thereby improving the concurrent performance of the system.

[0112] To facilitate understanding of the data processing method of the embodiment of the present application, it is taken as an example that processor cores 0 to n are multiple processor cores of a processor, and processor core 0 is configured to be bound to a network card, and processor core 0 and processor core 1 are configured with a cryptographic coprocessor. Figure 6 The data processing flow diagram of an embodiment of the present application is shown exemplarily.

[0113] like Figure 6 As shown, processor core 0 can perform data packet receiving and sending and network layer processing tasks on the thread where processor core 0 is located. After processor core 0 sends the data vector obtained after network layer processing to the ring buffer facing all processor cores, processor core 0 to processor core n can obtain the data vector in the ring buffer and perform data encryption / decryption processing.

[0114] Among them, since processor core 0 and processor core 1 are configured with cryptographic coprocessors, processor core 0 can send the data vector it obtains to the direct storage access queue 0 of the corresponding cryptographic coprocessor 0 for storage, and then the cryptographic coprocessor 0 can obtain the data vector in the direct storage access queue 0, perform encryption / decryption processing on the data indicated by the data vector, obtain the result data, and feed the result information back to the ring buffer. Similarly, processor core 1 can send the data vector it obtains to the direct storage access queue 1 of the corresponding cryptographic coprocessor 1 for storage, and then the cryptographic coprocessor 1 can obtain the data vector in the direct storage access queue 1, perform encryption / decryption processing on the data indicated by the data vector, obtain the result data, and feed the result information back to the ring buffer. After processor cores 2 to n obtain the data vector in the ring buffer, they can use the encryption / decryption program to perform encryption / decryption processing on the data indicated by the data vector, obtain the result data, and feed the result information back to the ring buffer.

[0115] In order to clearly understand the performance improvement of the data processing method of the embodiment of the present application, the data processing performed by the data processing method of the embodiment of the present application can be simulated and compared with the data processing in the "dpdk_cryptodev" mode and the data processing in the "sw_scheduler" mode, and the results are as follows: Figure 7 The performance comparison diagram is shown in the figure, where the horizontal axis is the performance index of data processing and the vertical axis is the data processing method used. Figure 7 As shown, it can be seen that the data processing performance of the data processing method in the embodiment of the present application is significantly higher than the data processing performance in the "dpdk_cryptodev" mode and the data processing performance in the "sw_scheduler" mode.

[0116] It can be seen that the data processing method of the embodiment of the present application, based on the main processor core bound to the network card, performs network layer processing on the data packets to be processed sent by the received network end to obtain data vectors, and then can record the data vectors in sequence into the ring buffer, so that the main processor core and the slave processor core located in the computing architecture where the main processor core is located obtain the data vectors, thereby making full use of the main processor core and the slave processor core to perform encryption / decryption processing, thereby improving data processing efficiency.

[0117] Furthermore, after obtaining the data vector, the main processor core can utilize the cryptographic coprocessor based on the configured cryptographic coprocessor to perform encryption / decryption processing on the data indicated by the data vector, obtain the first result data, and feed the result information back to the ring buffer, thereby realizing encryption / decryption processing on the data indicated by the data vector based on the hardware device (i.e., the cryptographic coprocessor); after obtaining the data vector, the slave processor core can utilize the encryption / decryption program to perform encryption / decryption processing on the data indicated by the data vector, obtain the second result data, and feed the result information back to the ring buffer, thereby realizing encryption / decryption processing on the data indicated by the data vector based on the software program (i.e., the encryption / decryption program). Furthermore, based on the indication of the data vector in the ring buffer, the result data after the encryption / decryption processing is sent to the network end, so that the encryption / decryption processing is performed by utilizing both hardware computing resources and software computing resources at the same time, effectively ensuring the computing power requirements of IPSec.

[0118] The present application embodiment provides a data processing device, the structure of which can be seen in Figure 8 As shown, the data processing device can be applied to a main processor core bound to a network card, and the main processor core is configured with a cryptographic coprocessor, and the data processing device can be configured to execute the data processing method implemented by the main processor core provided in the embodiment of the present application. Among them, the content described below can be regarded as the functional modules that the data processing device needs to set in order to implement the data processing method provided in the embodiment of the present application, and the content described below can be referred to in correspondence with the content described above.

[0119] like Figure 8 As shown, the data processing device may include: a receiving unit 81, a processing unit 82, a writing unit 83, a main execution unit 84 and a sending unit 85.

[0120] The receiving unit 81 is used to receive the data packets to be processed sent by the network end in sequence;

[0121] The processing unit 82 is used to perform network layer processing on the data packet to be processed to obtain a data vector;

[0122] A writing unit 83, configured to sequentially record the data vectors into a ring buffer so that the master processor core and slave processor cores in the computing architecture where the master processor core is located obtain the data vectors;

[0123] A main execution unit 84 is used for, after acquiring the data vector, using the cryptographic coprocessor to perform encryption / decryption processing on the data indicated by the data vector to obtain first result data, and feed back the result information to the ring buffer;

[0124] The sending unit 85 is used to send the result data after performing the encryption / decryption processing to the network end based on the indication of the data vector in the ring buffer; wherein the result data includes the first result data and the second result data, and the second result data is obtained by the slave processor core after obtaining the data vector and using the encryption / decryption program to perform encryption / decryption processing on the data indicated by the data vector, and after obtaining the second result data, the result information is fed back to the ring buffer.

[0125] Optionally, the cryptographic coprocessor is configured with a direct storage access queue;

[0126] The main execution unit 84, after acquiring the data vector and before using the cryptographic coprocessor to perform encryption / decryption processing on the data indicated by the data vector, further includes:

[0127] Sending the acquired data vector to the direct storage access queue;

[0128] The main execution unit 84 utilizes the cryptographic coprocessor to perform encryption / decryption processing on the data indicated by the data vector, specifically: utilizes the cryptographic coprocessor to perform encryption / decryption processing on the data indicated by the data vector in the direct storage access queue.

[0129] Optionally, the ring buffer includes a head and a tail, a head pointer indicating a position of the head is provided corresponding to the head, and a tail pointer indicating a position of the tail is provided corresponding to the tail;

[0130] The writing unit 83 records the data vectors into the ring buffer in sequence, including:

[0131] Recording the data vectors in sequence into the head position indicated by the head pointer of the ring buffer; wherein, each time a data vector is recorded, the head position indicated by the head pointer of the ring buffer advances by one position;

[0132] The sending unit 85 sends the result data after performing the encryption / decryption processing to the network end based on the indication of the data vector in the ring buffer, including:

[0133] According to the tail position indicated by the tail pointer and based on the indication of the data vector in the ring buffer, the result data after encryption / decryption processing is sent to the network end; wherein, each time a result data is sent, the tail position indicated by the tail pointer of the ring buffer advances one position.

[0134] Optionally, in the ring buffer, a status flag is set corresponding to the data vector, and the status flag is used to indicate the encryption / decryption processing status of the data indicated by the data vector;

[0135] After the main execution unit 84 feeds back the result information to the ring buffer, it updates the status flag based on the result information; wherein, if the status flag is a first value, it indicates that the encryption / decryption processing of the data indicated by the data vector is not completed; if the status flag is a second value, it indicates that the encryption / decryption processing of the data indicated by the data vector is completed.

[0136] Optionally, the sending unit 85 sends the result data after the encryption / decryption processing to the network end based on the indication of the data vector in the ring buffer, and the status flag bit of the corresponding data vector in the ring buffer is the second value.

[0137] Optionally, the main processor core obtains the data vector in the ring buffer based on a compare-and-swap (CAS) mechanism.

[0138] Optionally, when the slave processor core is configured with a cryptographic coprocessor, the second result data sent by the sending unit 85 is obtained by using the cryptographic coprocessor to encrypt / decrypt the data indicated by the acquired data vector, and after obtaining the second result data, the result information is fed back to the ring buffer.

[0139] The present application also provides a data processing device, the structure of which can be seen in Fig. 9 As shown, the data processing device can be applied to a slave processor core, and the data processing device can be configured to execute the data processing method implemented by the slave processor core provided in the embodiment of the present application. Among them, the content described below can be regarded as the functional modules that need to be set up by the data processing device to implement the data processing method provided in the embodiment of the present application, and the content described below can be referred to in correspondence with the content described above.

[0140] like Fig. 9 As shown, the data processing device may include: an acquisition unit 91 and a slave execution unit 92 .

[0141] The acquisition unit 91 is used to acquire data vectors in the ring buffer; wherein the data vectors are received by the main processor core in the computing architecture where the slave processor core is located, the main processor core receives the data packets to be processed sent by the network end, performs network layer processing on the data packets to be processed, and records the data vectors in sequence into the ring buffer; the main processor core is bound to the network card and is configured with a cryptographic coprocessor;

[0142] The slave execution unit 92 is used to use an encryption / decryption program to perform encryption / decryption processing on the data indicated by the acquired data vector to obtain second result data, and feed back the result information to the ring buffer.

[0143] Optionally, the slave processor core obtains the data vector in the ring buffer based on a compare-and-swap (CAS) mechanism.

[0144] Optionally, when the slave processor core is configured with a cryptographic coprocessor, the second result data obtained from the execution unit 92 is obtained by using the cryptographic coprocessor to encrypt / decrypt the data indicated by the acquired data vector, and after obtaining the second result data, the result information is fed back to the ring buffer.

[0145] Optionally, in the ring buffer, a status flag is set corresponding to the data vector, and the status flag is used to indicate the encryption / decryption processing status of the data indicated by the data vector;

[0146] After the result information is fed back to the ring buffer from the execution unit 92, the status flag is updated based on the result information; wherein, if the status flag is a first value, it indicates that the encryption / decryption processing of the data indicated by the data vector is not completed; if the status flag is a second value, it indicates that the encryption / decryption processing of the data indicated by the data vector is completed.

[0147] The embodiment of the present application also provides a processor, which can be configured to execute the data processing method provided by the embodiment of the present application. In an optional implementation, in combination with the foregoing description, the processor may include a main processor core, a slave processor core and an asynchronous engine, wherein the main processor core is bound to a network card and is configured with a cryptographic coprocessor. The functions and detailed structures of the main processor core, the slave processor core, the asynchronous engine and the cryptographic coprocessor may refer to the description of the corresponding parts of the foregoing.

[0148] The main processor core is used to schedule the asynchronous engine and the cryptographic coprocessor to execute the data processing method executed by the main processor core in the embodiment of the present application;

[0149] The slave processor core is used to schedule the asynchronous engine based on the master processor core to execute the data processing method performed by the slave processor core in the embodiment of the present application.

[0150] In some embodiments, the master processor core and the slave processor core are allocated at least according to initial state information of each processor core when the processor is initialized.

[0151] The embodiment of the present application also provides a chip, including the processor provided in the embodiment of the present application.

[0152] The present application also provides a computing device, which can implement the data processing method provided in the present application by configuring the chip described above. As an optional implementation, Fig.10 An optional block diagram of a computing device provided in an embodiment of the present application, such as Fig.10 As shown, the electronic device may include: at least one processor 1, at least one communication interface 2, at least one memory 3 and at least one communication bus 4.

[0153] In the embodiment of the present application, the number of the processor 1 , the communication interface 2 , the memory 3 , and the communication bus 4 is at least one, and the processor 1 , the communication interface 2 , and the memory 3 communicate with each other through the communication bus 4 .

[0154] Optionally, the communication interface 2 may be an interface of a communication module for performing network communication.

[0155] Optionally, processor 1 may be a CPU (central processing unit), a GPU (Graphics Processing Unit), an NPU (embedded neural network processor), an FPGA (Field Programmable Gate Array), a TPU (tensor processing unit), an AI chip, an application specific integrated circuit ASIC (Application Specific Integrated Circuit), or one or more integrated circuits configured to implement an embodiment of the present application.

[0156] The memory 3 may include a high-speed RAM memory, and may also include a non-volatile memory (non-volatile memory), such as at least one disk memory.

[0157] The memory 3 stores one or more computer executable instructions, and the processor 1 calls the one or more computer executable instructions to execute the data processing method of the embodiment of the present application.

[0158] An embodiment of the present application also provides a storage medium, which stores one or more computer-executable instructions. When the one or more computer-executable instructions are executed, the data processing method of the embodiment of the present application is implemented.

[0159] An embodiment of the present application also provides a computer program product, which includes one or more computer executable instructions, and when the one or more computer executable instructions are executed, the data processing method of the embodiment of the present application is implemented.

[0160] The above describes multiple implementation schemes provided by the embodiments of the present application. The various optional methods introduced in each implementation scheme can be combined and cross-referenced with each other without conflict, thereby extending a variety of possible implementation schemes, which can all be considered as implementation schemes disclosed and open in the embodiments of the present application.

[0161] Although the embodiments of the present application are disclosed above, the present application is not limited thereto. Any person skilled in the art may make various changes and modifications without departing from the spirit and scope of the present application. Therefore, the scope of protection of the present application shall be subject to the scope defined by the claims.

Claims

1. A data processing method, characterized in that: Applied to a main processor core bound to a network card, and the main processor core is configured with a cryptographic coprocessor, the method comprising: Receive data packets to be processed sent sequentially by the network end; Performing network layer processing on the data packet to be processed to obtain a data vector; Recording the data vectors in a circular buffer in sequence, so that the master processor core and slave processor cores located in the computing architecture where the master processor core is located can obtain the data vectors; After acquiring the data vector, using the cryptographic coprocessor, encrypting / decrypting the data indicated by the data vector to obtain first result data, and feeding the result information back to the ring buffer; Based on the indication of the data vector in the ring buffer, the result data after the encryption / decryption processing is performed is sent to the network end; wherein the result data includes the first result data and the second result data, and the second result data is obtained by the slave processor core after acquiring the data vector and using the encryption / decryption program to perform encryption / decryption processing on the data indicated by the data vector, and after obtaining the second result data, the result information is fed back to the ring buffer.

2. The method according to claim 1, characterized in that The cryptographic coprocessor is configured with a direct storage access queue; After acquiring the data vector and before using the cryptographic coprocessor to perform encryption / decryption processing on the data indicated by the data vector, the method further includes: Sending the acquired data vector to the direct storage access queue; The utilizing the cryptographic coprocessor to perform encryption / decryption processing on the data indicated by the data vector specifically includes: utilizing the cryptographic coprocessor to perform encryption / decryption processing on the data indicated by the data vector in the direct storage access queue.

3. The method according to claim 1, characterized in that The ring buffer includes a head and a tail, a head pointer indicating the position of the head is provided corresponding to the head, and a tail pointer indicating the position of the tail is provided corresponding to the tail; The step of recording the data vectors into a ring buffer in sequence comprises: Recording the data vectors in sequence into the head position indicated by the head pointer of the ring buffer; wherein, each time a data vector is recorded, the head position indicated by the head pointer of the ring buffer advances by one position; The step of sending the result data after performing the encryption / decryption processing to the network end based on the indication of the data vector in the ring buffer includes: According to the tail position indicated by the tail pointer and based on the indication of the data vector in the ring buffer, the result data after encryption / decryption processing is sent to the network end; wherein, each time a result data is sent, the tail position indicated by the tail pointer of the ring buffer advances one position.

4. The method according to claim 3, characterized in that In the ring buffer, a status flag is set corresponding to the data vector, and the status flag is used to indicate the encryption / decryption processing status of the data indicated by the data vector; After the result information is fed back to the ring buffer, the status flag is updated based on the result information; wherein, if the status flag is a first value, it indicates that the encryption / decryption processing of the data indicated by the data vector is not completed; if the status flag is a second value, it indicates that the encryption / decryption processing of the data indicated by the data vector is completed.

5. The method according to claim 4, characterized in that Based on the indication of the data vector in the ring buffer, the result data after the encryption / decryption processing is sent to the network end, and in the ring buffer, the status flag bit of the corresponding data vector is the second value.

6. The method according to claim 1, characterized in that The main processor core obtains the data vector in the ring buffer based on a compare-and-swap (CAS) mechanism.

7. The method according to claim 1, characterized in that When the slave processor core is configured with a cryptographic coprocessor, the second result data included in the result data is obtained by the slave processor core after acquiring the data vector and using the cryptographic coprocessor to perform encryption / decryption processing on the data indicated by the data vector, and after obtaining the second result data, the result information is fed back to the ring buffer.

8. A data processing method, characterized in that: Applied to a slave processor core, the method comprises: Acquire data vectors in the ring buffer; wherein the data vectors are the main processor core located in the computing architecture where the slave processor core is located, receive the data packets to be processed sent by the network end, perform network layer processing on the data packets to be processed, and sequentially record the data vectors in the ring buffer; the main processor core is bound to the network card and is configured with a cryptographic coprocessor; The data indicated by the acquired data vector is encrypted / decrypted by using an encryption / decryption program to obtain second result data, and the result information is fed back to the ring buffer.

9. The method according to claim 8, characterized in that The slave processor core obtains the data vector in the ring buffer based on a compare-and-swap (CAS) mechanism.

10. The method according to claim 8, characterized in that When the slave processor core is configured with a cryptographic coprocessor, the second result data is obtained by using the cryptographic coprocessor to encrypt / decrypt the data indicated by the acquired data vector, and after obtaining the second result data, the result information is fed back to the ring buffer.

11. The method according to claim 8, characterized in that In the ring buffer, a status flag is set corresponding to the data vector, and the status flag is used to indicate the encryption / decryption processing status of the data indicated by the data vector; After the result information is fed back to the ring buffer, the status flag is updated based on the result information; wherein, if the status flag is a first value, it indicates that the encryption / decryption processing of the data indicated by the data vector is not completed; if the status flag is a second value, it indicates that the encryption / decryption processing of the data indicated by the data vector is completed.

12. A data processing device, characterized in that: Applied to a main processor core bound to a network card, and the main processor core is configured with a cryptographic coprocessor, including: A receiving unit, used for receiving data packets to be processed sent sequentially by the network end; A processing unit, configured to perform network layer processing on the data packet to be processed to obtain a data vector; a writing unit, configured to sequentially record the data vectors into a ring buffer so that the master processor core and slave processor cores located in the computing architecture where the master processor core is located obtain the data vectors; a main execution unit, configured to, after acquiring the data vector, use the cryptographic coprocessor to perform encryption / decryption processing on the data indicated by the data vector to obtain first result data, and feed back the result information to the ring buffer; A sending unit is used to send the result data after performing encryption / decryption processing to the network end based on the indication of the data vector in the ring buffer; wherein the result data includes the first result data and the second result data, and the second result data is obtained by the slave processor core after acquiring the data vector and using the encryption / decryption program to perform encryption / decryption processing on the data indicated by the data vector, and after obtaining the second result data, the result information is fed back to the ring buffer.

13. A data processing device, characterized in that: Applicable to slave processor cores, including: an acquisition unit, configured to acquire data vectors in a ring buffer; wherein the data vectors are received by a main processor core located in a computing architecture where the slave processor core is located, the main processor core receives a data packet to be processed sent by a network terminal, performs network layer processing on the data packet to be processed, and sequentially records the data vectors in a ring buffer; the main processor core is bound to a network card and is configured with a cryptographic coprocessor; The slave execution unit is used to use an encryption / decryption program to perform encryption / decryption processing on the data indicated by the acquired data vector to obtain second result data, and feed back the result information to the ring buffer.

14. A processor, characterized in that: include: A main processor core, a slave processor core and an asynchronous engine; the main processor core is bound to a network card and is configured with a cryptographic coprocessor; The main processor core is used to schedule the asynchronous engine and the cryptographic coprocessor to execute the data processing method according to any one of claims 1 to 7; The slave processor core is used to schedule the asynchronous engine based on the master processor core to execute the data processing method as described in any one of claims 8-11.

15. The processor according to claim 14, characterized in that The master processor core and the slave processor core are allocated at least according to the initial state information of each processor core when the processor is initialized.

16. A chip, characterized in that: Comprising a processor as claimed in any one of claims 14-15.

17. A computing device, characterized in that Comprising the chip as claimed in claim 16.

18. A storage medium, characterized in that: The storage medium stores one or more computer-executable instructions, and when the one or more computer-executable instructions are executed, the data processing method according to any one of claims 1 to 7 or claims 8 to 11 is implemented.

19. A computer program product, characterized in that It comprises one or more computer executable instructions, and when the one or more computer executable instructions are executed, the data processing method according to any one of claims 1 to 7 or claims 8 to 11 is implemented.

Images