Data processing method, data processing device and related equipment

Abstract

An embodiment of the present application provides a data processing method, a data processing device, a processor and related devices thereof. The method is applied to a main processor core bound to a network card and configured with a cryptographic coprocessor. By receiving packets to be processed sequentially sent by a network end, network layer processing is then performed to obtain a data vector; the data vector is sequentially recorded in a circular buffer so that the main processor core and the slave processor core can obtain the data vector; after obtaining the data vector, the cryptographic coprocessor is used to perform encryption / decryption processing on the data indicated by the data vector to obtain first result data, and the result information is fed back to the circular buffer; based on the indication of the data vector in the circular buffer, the result data is sent to the network end; the result data includes the first result data and second result data obtained by the slave processor core performing encryption / decryption processing on the data indicated by the data vector using an encryption / decryption program, thereby realizing the full utilization of computing resources.

Description

Technical Field

[0001] Embodiments of the present application relate to the field of computer technology, and particularly to a data processing method, a data processing device and related equipment thereof. Background Art

[0002] With the continuous development of information technology, ensuring data security has become increasingly important. Among them, data security refers to the process of using technical means to identify the relative importance, sensitivity, compliance, etc. of various data sets such as files, databases, account information, etc. on the network, and taking appropriate security control measures to protect them. For example, protecting various data on the network through Internet Protocol Security (IPSec).

[0003] However, in the process of processing data on the network by IPSec, there is a large computing power requirement and a large consumption of computing resources, so that when processing a large data traffic, it is easy to cause a performance bottleneck in IPSec.

[0004] Under this background, how to make full use of computing resources to ensure the computing power requirement of IPSec and improve data processing efficiency has become a technical problem that needs to be solved urgently by those skilled in the art. Summary of the Invention

[0005] In view of this, embodiments of the present application provide a data processing method, a data processing device and related equipment thereof to achieve full utilization of computing resources and improve data processing efficiency.

[0006] To achieve the above object, embodiments of the present application provide the following technical solutions.

[0007] In a first aspect, embodiments of the present application provide a data processing method, which is applied to a main processor core bound to a network card, and the main processor core is configured with a cryptographic coprocessor. The method includes:

[0008] Receiving a to-be-processed data packet sequentially sent by a network side;

[0009] Performing network layer processing on the to-be-processed data packet to obtain a data vector;

[0010] Sequentially recording the data vector into a circular buffer so that the main processor core and a slave processor core in the computing architecture where the main processor core is located can obtain the data vector;

[0011] After obtaining the data vector, using the cryptographic coprocessor to perform encryption / decryption processing on the data indicated by the data vector to obtain a first result data, and feeding back result information to the circular buffer;

[0012] Based on the indication of the data vector in the circular buffer, the result data after performing encryption / decryption processing is sent to the network side; wherein, the result data includes the first result data and the second result data, and the second result data is obtained by the slave processor core using an encryption / decryption program to perform encryption / decryption processing on the data indicated by the data vector after obtaining the data vector, and after obtaining the second result data, result information is fed back to the circular buffer.

[0013] Optionally, the cryptographic coprocessor is configured with a direct memory access queue;

[0014] Before obtaining the data vector and using the cryptographic coprocessor to perform encryption / decryption processing on the data indicated by the data vector, it further includes:

[0015] Sending the obtained data vector to the direct memory access queue;

[0016] Using the cryptographic coprocessor to perform encryption / decryption processing on the data indicated by the data vector specifically means: using the cryptographic coprocessor to perform encryption / decryption processing on the data indicated by the data vector in the direct memory access queue.

[0017] Optionally, the circular buffer includes a head and a tail, and a head pointer indicating the position of the head is provided corresponding to the head, and a tail pointer indicating the position of the tail is provided corresponding to the tail;

[0018] The step of sequentially recording the data vector into the circular buffer includes:

[0019] Sequentially recording the data vector into the head position indicated by the head pointer of the circular buffer; wherein, for each data vector recorded, the head position indicated by the head pointer of the circular buffer advances by one position;

[0020] The step of sending the result data after performing encryption / decryption processing to the network side based on the indication of the data vector in the circular buffer includes:

[0021] According to the tail position indicated by the tail pointer, based on the indication of the data vector in the circular buffer, sending the result data after performing encryption / decryption processing to the network side; wherein, for each result data sent, the tail position indicated by the tail pointer of the circular buffer advances by one position.

[0022] Optionally, in the circular buffer, a status flag bit is set corresponding to the data vector, and the status flag bit is used to indicate the encryption / decryption processing status of the data indicated by the data vector;

[0023] After feeding back the result information to the circular buffer, update the status flag bit based on the result information; wherein, if the status flag bit is a first value, it indicates that the encryption / decryption process of the data indicated by the data vector is not completed; if the status flag bit is a second value, it indicates that the encryption / decryption process of the data indicated by the data vector is completed.

[0024] Optionally, based on the indication of the data vector in the circular buffer, the result data after performing the encryption / decryption process sent to the network side has the status flag bit of the corresponding data vector in the circular buffer as the second value.

[0025] Optionally, the main processor core obtains the data vector in the circular buffer based on the compare-and-swap (CAS) mechanism.

[0026] Optionally, when the slave processor core is configured with a cryptographic coprocessor, the second result data included in the result data is obtained by the slave processor core using the cryptographic coprocessor to perform the encryption / decryption process on the data indicated by the data vector after obtaining the data vector, and after obtaining the second result data, the result information is fed back to the circular buffer.

[0027] In a second aspect, an embodiment of the present application provides a data processing method applied to a slave processor core. The method includes:

[0028] Obtain a data vector in a circular buffer; wherein, the data vector is obtained by the main processor core located in the computing architecture where the slave processor core is located, receiving a to-be-processed data packet sent by a network side, performing network layer processing on the to-be-processed data packet, and sequentially recording the data vector into the circular buffer; the main processor core is bound to a network card and configured with a cryptographic coprocessor;

[0029] Use an encryption / decryption program to perform an encryption / decryption process on the data indicated by the obtained data vector to obtain second result data, and feed back the result information to the circular buffer.

[0030] Optionally, the slave processor core obtains the data vector in the circular buffer based on the compare-and-swap (CAS) mechanism.

[0031] Optionally, when the slave processor core is configured with a cryptographic coprocessor, the second result data is obtained by using the cryptographic coprocessor to perform the encryption / decryption process on the data indicated by the obtained data vector, and after obtaining the second result data, the result information is fed back to the circular buffer.

[0032] Optionally, in the circular buffer, a status flag bit is set corresponding to the data vector, and the status flag bit is used to indicate the encryption / decryption processing status of the data indicated by the data vector;

[0033] After the result information is fed back to the circular buffer, based on the result information, the status flag bit is updated; wherein, if the status flag bit is a first value, it indicates that the encryption / decryption processing of the data indicated by the data vector is not completed; if the status flag bit is a second value, it indicates that the encryption / decryption processing of the data indicated by the data vector is completed.

[0034] In a third aspect, an embodiment of the present application provides a data processing device, which is applied to a main processor core bound to a network card, and the main processor core is configured with a cryptographic coprocessor, including:

[0035] A receiving unit, configured to receive the to-be-processed data packets sequentially sent by the network side;

[0036] A processing unit, configured to perform network layer processing on the to-be-processed data packet to obtain a data vector;

[0037] A writing unit, configured to sequentially record the data vector into a circular buffer, so that the main processor core and the slave processor cores in the computing architecture where the main processor core is located can obtain the data vector;

[0038] A main execution unit, configured to, after obtaining the data vector, use the cryptographic coprocessor to perform encryption / decryption processing on the data indicated by the data vector to obtain first result data, and feed back the result information to the circular buffer;

[0039] A sending unit, configured to, based on the indication of the data vector in the circular buffer, send the result data after performing encryption / decryption processing to the network side; wherein, the result data includes the first result data and second result data, and the second result data is obtained by the slave processor core performing encryption / decryption processing on the data indicated by the data vector after obtaining the data vector, and after obtaining the second result data, feed back the result information to the circular buffer.

[0040] In a fourth aspect, an embodiment of the present application provides a data processing device, characterized in that it is applied to a slave processor core and includes:

[0041] An acquisition unit for acquiring a data vector in a circular buffer; wherein, the data vector is obtained by a main processor core located within the computing architecture where the slave processor core is located, receiving a data packet to be processed sent by a network side, performing network layer processing on the data packet to be processed, and sequentially recording the data vector into the circular buffer; the main processor core is bound to a network card and is configured with a cryptographic coprocessor;

[0042] A slave execution unit for performing encryption / decryption processing on the data indicated by the acquired data vector by using an encryption / decryption program to obtain second result data, and feeding back result information to the circular buffer.

[0043] In a fifth aspect, an embodiment of the present application provides a processor, including: a main processor core, a slave processor core, and an asynchronous engine; the main processor core is bound to a network card and is configured with a cryptographic coprocessor;

[0044] The main processor core is used to schedule the asynchronous engine and the cryptographic coprocessor to execute the data processing method as described in the first aspect above;

[0045] The slave processor core is used to execute the data processing method as described in the second aspect above based on the scheduling of the asynchronous engine by the main processor core.

[0046] Optionally, the main processor core and the slave processor core are allocated at least according to the initial state information of each processor core when the processor is initialized.

[0047] In a sixth aspect, an embodiment of the present application provides a chip, including the processor as described in the fifth aspect above.

[0048] In a seventh aspect, an embodiment of the present application provides a computing device, including the chip as described in the sixth aspect above.

[0049] In an eighth aspect, an embodiment of the present application provides a storage medium, where the storage medium stores one or more computer-executable instructions, and when the one or more computer-executable instructions are executed, the data processing method as described in the first aspect or the second aspect above is implemented.

[0050] In a ninth aspect, an embodiment of the present application provides a computer program product, including one or more computer-executable instructions, and when the one or more computer-executable instructions are executed, the data processing method as described in the first aspect or the second aspect above is implemented.

[0051] The data processing method provided by the embodiments of the present application can perform network layer processing on the to-be-processed data packets received from the network side based on the main processor core bound to the network card to obtain data vectors, and then can sequentially record the data vectors into the circular buffer, so that the main processor core and the slave processor cores located within the computing architecture where the main processor core is located can obtain the data vectors, thereby making full use of the main processor core and the slave processor cores to perform encryption / decryption processing, and improving the data processing efficiency.

[0052] Moreover, after obtaining the data vector, the main processor core can, based on the configured cryptographic co-processor, use the cryptographic co-processor to perform encryption / decryption processing on the data indicated by the data vector to obtain the first result data, and feedback the result information to the circular buffer, so as to implement the encryption / decryption processing of the data indicated by the data vector based on the hardware device (i.e., the cryptographic co-processor); after obtaining the data vector, the slave processor core can use the encryption / decryption program to perform encryption / decryption processing on the data indicated by the data vector to obtain the second result data, and feedback the result information to the circular buffer, so as to implement the encryption / decryption processing of the data indicated by the data vector based on the software program (i.e., the encryption / decryption program). Furthermore, based on the indication of the data vector in the circular buffer, the result data after the encryption / decryption processing is sent to the network side. It can be seen that the embodiments of the present application can simultaneously use the hardware computing resources and the software computing resources to perform the encryption / decryption processing, effectively ensuring the computing power requirements of IPSec. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the drawings required to be used in the description of the embodiments or the prior art. Obviously, the drawings in the following description are only the embodiments of the present application. For those of ordinary skill in the art, other drawings can be obtained according to the provided drawings without creative efforts.

[0054] Figure 1 It is a schematic diagram of the data transmission process between the two communication parties in IPSec.

[0055] Figure 2 It is a schematic diagram of the data processing process in the synchronous engine mode of VPP.

[0056] Figure 3 It is a schematic diagram of the data processing process in the "dpdk_cryptodev" asynchronous engine mode of VPP.

[0057] Figure 4 It is an optional flow schematic diagram of the data processing method provided by the embodiments of the present application.

[0058] Figure 5It is an optional structural schematic diagram of the circular buffer provided by the embodiments of the present application.

[0059] Figure 6 It is a schematic diagram of the data processing flow provided by the embodiments of the present application.

[0060] Figure 7 It is a schematic diagram of performance comparison provided by the embodiments of the present application.

[0061] Figure 8 It is an optional schematic diagram of the data processing device provided by the embodiments of the present application.

[0062] Figure 9 It is another optional schematic diagram of the data processing device provided by the embodiments of the present application.

[0063] Figure 10 It is an optional block diagram of the computing device provided by the embodiments of the present application. Detailed implementation manners

[0064] Next, the technical solutions in the embodiments of the present application will be clearly and completely described in conjunction with the accompanying drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present application.

[0065] Internet Protocol Security (IPSec) is a collection of protocols and services that provide security for IP networks. It is mainly used to establish a secure and protected private network on an insecure public network and is a commonly used technology in VPN (Virtual Private Network). IPSec establishes an IPsec tunnel between two or more private networks on the public network, enabling the two communicating parties to use this IPsec tunnel to ensure the security of the VPN connection through encryption and authentication algorithms. Specifically, the two communicating parties can establish a security association through key exchange to form an IPsec tunnel. The data flowing through the tunnel is protected by encryption and authentication mechanisms to prevent the data from being stolen and tampered with during transmission, ensuring the transmission security of the data.

[0066] Figure 1 An exemplary schematic diagram of the process of transmitting data between two communicating parties in IPSec is shown. As Figure 1As shown in the figure, the IPsec sender and the IPsec receiver first generate and share a symmetric key, and the generation and sharing of the symmetric key can be implemented based on a key exchange protocol. Furthermore, the IPsec sender uses the symmetric key and an encryption algorithm to encrypt the IP packet, that is, to encapsulate the original IP data, and obtains the encrypted IP packet. Then, the IPsec sender and the IPsec receiver respectively process the encrypted IP packet through the same verification algorithm and verification key to obtain the Integrity Check Value (ICV). Furthermore, the IPsec receiver compares whether the calculated ICV is the same as the ICV value of the IPsec sender. If they are the same, it means that the encrypted IP packet has not been tampered with during transmission. The IPsec receiver uses the same symmetric key as the IPsec sender and a decryption algorithm to decrypt the verified encrypted IP packet to obtain the original IP packet, that is, the original IP data. Among them, if the ICV calculated by the IPsec receiver is different from the ICV value of the IPsec sender, it means that the encrypted IP packet has been tampered with during transmission, and the encrypted IP packet can be directly discarded.

[0067] During the process of transmitting data between the two communication parties of IPSec, the part enclosed by the dotted line in the figure has a large computing power requirement and consumes a large amount of computing resources. When the data traffic transmitted between the IPSec sender and the receiver is large, it is easy to appear a performance bottleneck in data forwarding.

[0068] To solve the above problems, as an optional implementation, the synchronization engine in VPP (Vector Packet Processing) technology can be used for data processing.

[0069] It should be noted that VPP comes with an IPSec function, provides a framework for processing the IPSec data plane forwarding, and at the same time supports registering various encryption / decryption engines to provide algorithm support for IPSec.

[0070] VPP can abstract each functional block (that is, a software or hardware module responsible for executing specific network operation tasks, and these modules can involve all stages of packet processing, such as filtering, encryption, decryption, load balancing, etc.) into a directed graph node (node). By inputting a set of data vectors at each node, the data vectors can be processed in the same way inside the node to maximize the efficiency of the CPU instruction cache. Among them, after each node completes the execution of one or a class of fixed functions, all nodes can be organized into a tree graph. Starting from the entry node, when a node finishes processing the data vector, the data vector is sent to the next node for processing according to the processing logic, and is passed from the receiving node to the sending node, or discarded midway.

[0071] Moreover, to ensure the cache hit rate of data, VPP can bind the receive queue (RX queue) of the network card to a fixed processor thread. In a multi-core processor, all threads can form a one-to-one correspondence with the processor cores. Therefore, during the entire software operation cycle, the packet reception of the network card can be processed by a fixed processor core. Moreover, all processor cores, whether bound to the network card or not, have the function of processing other VPP nodes.

[0072] When performing data processing, the crypto engine provided by VPP can be divided into a synchronous engine and an asynchronous engine. In the synchronous engine mode, the caller's invocation of the data processing algorithm function is synchronous, that is, when the called function returns, the data has been processed; in the asynchronous engine mode, the caller's invocation of the data processing algorithm function is asynchronous, that is, when the called function returns, the data has been arranged to be processed by other modules, and the processing result will be notified to the caller later by polling or interrupt.

[0073] Among them, Figure 2 An exemplary schematic diagram of the data processing flow in the synchronous engine mode of VPP is shown. As Figure 2 shown, when processing the network traffic of IPSec based on the synchronous engine mode of VPP, for a multi-core processor, to improve the network data processing performance, the data processing work of the network card can be assigned to a specific processor core X, that is, only the processor core bound to the network card can receive the packets sent from the network side. Among them, Figure 2 the interval of the dotted line shown is the thread of processing core X. On the thread of processing core X, four stages are experienced: receiving the packets sent from the network side (i.e., packet reception) processed by this processor core, network layer processing of the packets, encryption / decryption operations, and sending the processed packets to the network side (i.e., packet transmission). Among them, network layer processing can include packet fragmentation and reassembly. For example, when a packet is too large, it needs to be divided into smaller segments at the network layer and the fragmentation information is recorded so that other segments can be correctly assembled when received later; data parsing, such as parsing network protocol headers such as IP, TCP / UDP, etc. to determine the destination address, source address, port number, and protocol type of the packet; route lookup, such as querying the routing table according to the destination address of the data to decide how to forward the packet; data security check, such as verifying the integrity and authentication information of the AH or ESP header encapsulated in the IPSec packet to ensure the confidentiality of the data and the authenticity of the source; establishment of the transmission tunnel, etc.

[0074] However, in the synchronous engine mode of VPP, only a single processor core X bound to the network card can execute the entire process of receiving and transmitting packets. Therefore, when the data traffic exceeds the processing capacity of this processor core X, even if other processor cores in the multi-core processor are in an idle state, they cannot share the processing tasks for this processor core X, which limits the concurrent ability of the multi-core processor and makes the computing resources of the multi-core processor unable to be effectively utilized.

[0075] To utilize the multi-threaded processing performance of the multi-core processor, as another alternative implementation, the asynchronous engine in VPP technology can be used for data processing.

[0076] It should be noted that VPP comes with two asynchronous engines, namely "sw_scheduler" and "dpdk_cryptodev". "sw_scheduler", that is, Software Scheduler, is mainly used to manage the input and output operations of the processor within VPP, decomposing the processing tasks of packets onto different processor cores to achieve high-performance data traffic scheduling in a multi-core environment. "dpdk_cryptodev" is the encryption device driver module of the DPDK (Data Plane Development Kit) data plane development kit. dpdk_cryptodev can provide a hardware-acceleration-based method for the processor to process the encryption / decryption operations of packets.

[0077] It should be further noted that the Data Plane Development Kit (hereinafter referred to as "DPDK") is a user-space network development platform that focuses on the performance optimization of high-speed network data paths and is usually used in high-performance network applications such as load balancing, firewalls, and switches. It provides a set of libraries and driver programs, enabling the processor to quickly process packets. Based on DPDK, packets can be received and transmitted to the network side. When a packet sent from the network side is received, the processing device can divide the packet into multiple groups of data vectors. This data vector is a memory area of a certain size, corresponding to memory address information, and each group of data vectors can contain at most 256 packet memory addresses. Among them, DPDK contains an important component VDEV (Virtual Device). VDEV is a virtual device driver that provides an abstraction layer that can be either a software abstraction or a hardware abstraction, allowing developers to create and configure virtual devices. These virtual devices can be abstract real hardware devices such as network cards and cryptographic coprocessors; software devices developed by users themselves such as openssl encryption / decryption algorithms, loopback interfaces, and internal queues.

[0078] Moreover, during the data processing, a high-performance, memory-based network packet queue structure, namely the Ring Buffer, is provided. Data vectors are stored in the Ring Buffer in a First-In-First-Out (FIFO) manner, such that the order of data writing corresponds to the order of data reading, enabling efficient data transfer between the kernel space and the user space, reducing context switching and memory copying in the kernel space, and significantly improving network throughput and latency.

[0079] In the DPDK environment, VPP can use the DPDK API (the application programming interface of DPDK) to create and manage devices with VDEVs. Developers can create multiple VDEV instances, each corresponding to a physical network interface or a software emulated interface, thereby enabling direct access to the hardware, reducing the overhead of the operating system, and achieving more efficient packet processing. VPP configures each network interface as a large, lock-free Ring Buffer through VDEVs, allowing the receive and send operations of packets to be carried out concurrently among multiple processor core threads of the processor, greatly enhancing the network processing ability.

[0080] Taking processor cores 0 to n of a processor as multiple processor cores, and taking the binding of processor core 0 to the network card as an example, the data processing flow in the "sw_scheduler" asynchronous engine mode of VPP is described. When processing IPSec network traffic in the "sw_scheduler" asynchronous engine mode of VPP, for improving the overall performance, it can be configured that only processor core 0 has the permission to send and receive packets to and from the network end. Thus, after receiving a packet sent from the network end, processor core 0 can perform network layer processing on the packet, that is, perform corresponding operations according to the rules of the network protocol stack, such as checking header information, route selection, etc., and combine the processed packets into data vectors, which are stored in a specially designed Ring Buffer. Among them, the Ring Buffer provides the extraction function of data vectors for processor cores 1 to n, enabling the encryption / decryption calculation tasks of the data vectors stored in the Ring Buffer to be shared by processor cores 1 to n, that is, non-blockingly allocate the data vectors to processor cores 1 to n to execute encryption / decryption processing using the encryption / decryption program and software algorithms. The encryption / decryption program can be a software program for performing data encryption / decryption operations.

[0081] Among them, Figure 3 Exemplarily shows a schematic diagram of the data processing flow in the "dpdk_cryptodev" asynchronous engine mode of VPP. As Figure 3As shown in the figure, when processing the network traffic of IPSec in the "dpdk_cryptodev" asynchronous engine mode of VPP, to improve the overall performance, it can be configured that the processor core 0 is bound to the network card and has the permission to receive data packets from the network end. Moreover, after receiving the data packets sent from the network end, the processor core 0 can perform network layer processing on the data packets, combine the processed data packets into data vectors, and send them to the VDEV abstracted by the cryptographic coprocessor managed by DPDK for encryption / decryption processing.

[0082] However, for the asynchronous engine mode of VPP, although the "sw_scheduler" asynchronous engine can send computing tasks to the processor cores 1 to n for execution, making use of the software computing capabilities of multiple processor cores, it does not utilize the cryptographic coprocessor. While the "dpdk_cryptodev" asynchronous engine only needs to use the core 0 bound to the network card to meet the need of delivering data to the cryptographic coprocessor, achieving the use of hardware computing resources, but the software computing resources of the other idle processor cores (i.e., the processor cores 1 to n) cannot be utilized. Obviously, both the "sw_scheduler" asynchronous engine and the "dpdk_cryptodev" asynchronous engine have a waste of computing resources and cannot achieve the simultaneous use of hardware resources and software resources.

[0083] In view of this, the embodiments of the present application provide a new data processing solution. By enabling both the main processor core bound to the network card and the slave processor cores within the computing architecture where the main processor core is located to obtain data vectors in the circular buffer, it is possible to make full use of the main processor core and the slave processor cores to perform encryption / decryption processing, thereby improving the data processing efficiency. Moreover, when the main processor core is configured with a cryptographic coprocessor, after obtaining the data vector, the main processor core can use the cryptographic coprocessor to perform encryption / decryption processing on the data indicated by the data vector. After obtaining the data vector, the slave processor cores can use the encryption / decryption program to perform encryption / decryption processing on the data indicated by the data vector, realizing the simultaneous use of hardware computing resources and software computing resources to perform encryption / decryption processing, effectively ensuring the computing power requirements of IPSec.

[0084] Based on the above idea, Figure 4 An optional flowchart of the data processing method according to the embodiments of the present application is exemplarily shown. As Figure 4 shown, it may include the following steps:

[0085] Step S100, the main processor core receives the data packets to be processed sequentially sent from the network end.

[0086] The main processor core can be a processor core configured to be bound to a network card in consideration of improving the overall performance of the processor. Moreover, the main processor core can be configured with a cryptographic coprocessor to provide hardware device-based encryption / decryption services, digest calculation services, etc. for the main processor core. Among them, a chip private key is fixedly set inside the cryptographic coprocessor, and this chip private key is not allowed to be read by any device other than the cryptographic coprocessor to ensure data security.

[0087] It can be understood that in a processor core equipped with a cryptographic coprocessor, since the device for performing data encryption / decryption operations is the cryptographic coprocessor, the processor core only needs to be responsible for data interaction with the cryptographic coprocessor, and only involves logical judgment and memory copy operations during the algorithm process, with a relatively low occupancy rate and relatively abundant computing power of its own. Therefore, to effectively utilize the idle computing power of this processor core, this processor core can be bound to the network card so that it can concurrently handle the reception and transmission of pending data packets sent from the network side and network layer processing work. Among them, the processor core bound to the network card can be called the "main processor core", and other processor cores within the computing architecture where the main processor core is located can be called "slave processor cores". As an optional implementation, the main processor core and the slave processor cores can be obtained by allocation according to the initial state information of each processor core during the initialization stage of the multi-core processor. Moreover, in a chip with a cryptographic coprocessor, the number of cryptographic coprocessors can be correspondingly matched with a processor core configured with a cryptographic coprocessor, so that the processor core configured with a cryptographic coprocessor can use hardware to perform data encryption / decryption operations, and other processor cores without a configured cryptographic coprocessor can use software (such as an encryption / decryption program) to perform data encryption / decryption operations. Among them, the main processor core must be configured with a cryptographic coprocessor.

[0088] Step S110, the main processor core performs network layer processing on the pending data packet to obtain a data vector.

[0089] By performing network layer processing on the pending data packet through the main processor core, a data vector can be obtained, and the data vector can correspondingly indicate the data memory address of the pending data packet.

[0090] Step S120, the main processor core sequentially records the data vector into the circular buffer.

[0091] During the data processing process using the VPP technology, based on the circular buffer provided by it for storing data vectors to reduce context switching and memory copy in the kernel space, improve network throughput and reduce latency, the main processor core can sequentially record the data vectors obtained by performing network layer processing on the pending data packets into the circular buffer according to the order of receiving the pending data packets.

[0092] It should be noted that the circular buffer in the embodiments of the present application can correspond to all processor cores in a multi-core processor, so that all processor cores can obtain data vectors from the circular buffer. That is to say, by sequentially recording data vectors into the circular buffer by the main processor, the main processor core can execute step S130, the main processor core can obtain data vectors from the circular buffer, and the slave processor cores within the computing architecture where the main processor core is located can execute step S140, and the slave processor cores can obtain data vectors from the circular buffer, thereby making full use of the main processor core and the slave processor cores to perform encryption / decryption processing and improving data processing efficiency.

[0093] Further, after obtaining the data vectors, the main processor core can execute step S150, and the slave processor cores can execute step S160.

[0094] Step S150: The main processor core uses a cryptographic coprocessor to perform encryption / decryption processing on the data indicated by the data vectors.

[0095] Step S160: The slave processor cores use an encryption / decryption program to perform encryption / decryption processing on the data indicated by the obtained data vectors.

[0096] When the main processor core is configured with a cryptographic coprocessor, the main processor core can use the cryptographic coprocessor to perform encryption / decryption processing on the data indicated by the obtained data vectors, thereby obtaining first result data and feeding back the result information to the circular buffer. The slave processor can use the encryption / decryption program to perform encryption / decryption processing on the data indicated by the obtained data vectors to obtain second result data and feed back the result information to the circular buffer.

[0097] It should be noted that as an optional implementation, when the slave processor core is configured with a cryptographic coprocessor, based on the function of the cryptographic coprocessor to perform encryption / decryption operations on data, the second result data obtained in step S160 can be obtained by the slave processor core using the cryptographic coprocessor to perform encryption / decryption processing on the data indicated by the obtained data vectors, and after obtaining the second result data, the result information is fed back to the circular buffer. Among them, when the cryptographic coprocessor is configured with a direct memory access queue, the slave processor core can send the obtained data vectors to the direct memory access queue, so that when using the cryptographic coprocessor to perform encryption / decryption processing on the data indicated by the obtained data vectors, specifically, the cryptographic coprocessor is used to perform encryption / decryption processing on the data indicated by the data vectors in the direct memory access queue.

[0098] Among them, the result information may be the encryption / decryption processing of the data indicated by the data vector, the failure of the encryption / decryption processing of the data indicated by the data vector, or the success of the encryption / decryption processing of the data indicated by the data vector. If the encryption / decryption processing of the data indicated by the data vector is in progress, it means that the encryption / decryption processing of the data indicated by the data vector is not completed; if the encryption / decryption processing of the data indicated by the data vector fails or succeeds, it means that the encryption / decryption processing of the data indicated by the data vector is completed.

[0099] It should be noted that in the embodiments of the present application, based on the main processor core using the cryptographic co-processor to perform encryption / decryption processing on the data indicated by the obtained data vector, after the main processing core sends the obtained data vector to the cryptographic co-processor, it can immediately return to perform other operations. And since the slave processor core uses its own encryption / decryption program to perform encryption / decryption processing on the data indicated by the obtained data vector, only after the slave processor core finishes the encryption / decryption processing of the data indicated by the obtained data vector can it return to perform the next operation.

[0100] Step S170, the main processor core sends the result data after performing encryption / decryption processing to the network side based on the indication of the data vector in the circular buffer.

[0101] Among them, when both the main processor core and the slave processor core feedback the result information to the circular buffer, the result data may include first result data and second result data.

[0102] It can be seen that the embodiments of the present application can perform network layer processing on the received network-side sent to-be-processed data packet based on the main processor core bound to the network card to obtain a data vector, and then can sequentially record the data vector into the circular buffer, so that the main processor core and the slave processor core located within the computing architecture where the main processor core is located can obtain the data vector, thereby making full use of the main processor core and the slave processor core to perform encryption / decryption processing and improving the data processing efficiency.

[0103] Moreover, after obtaining the data vector, the main processor core can utilize the configured cryptographic coprocessor to perform encryption / decryption processing on the data indicated by the data vector by means of the cryptographic coprocessor, obtaining first result data, and feeding back the result information to the circular buffer, thus implementing the encryption / decryption processing of the data indicated by the data vector based on the hardware device (i.e., the cryptographic coprocessor); after obtaining the data vector, the slave processor core can utilize the encryption / decryption program to perform encryption / decryption processing on the data indicated by the data vector, obtaining second result data, and feeding back the result information to the circular buffer, thus implementing the encryption / decryption processing of the data indicated by the data vector based on the software program (i.e., the encryption / decryption program). Furthermore, based on the indication of the data vector in the circular buffer, the result data after the encryption / decryption processing is sent to the network side. It can be seen that the embodiments of the present application can simultaneously utilize the hardware computing resources and the software computing resources to perform the encryption / decryption processing, effectively ensuring the computing power requirements of IPSec.

[0104] In some embodiments, for the convenience of the cryptographic coprocessor to perform encryption / decryption processing on the data indicated by the data vector, the cryptographic coprocessor of the embodiments of the present application may be provided with a direct memory access queue (DMA queue), and the direct memory access queue is used to store the data vector that the main processor core needs to be encrypted / decrypted by the cryptographic coprocessor.

[0105] Therefore, after the main processor core obtains the data vector from the circular buffer and before the main processor core utilizes the cryptographic coprocessor to perform encryption / decryption processing on the data indicated by the data vector, the main processor core may also send the obtained data vector to the direct memory access queue.

[0106] Based on the storage of the data vector in the direct memory access queue, the main processor core utilizes the cryptographic coprocessor to perform encryption / decryption processing on the data indicated by the data vector, which may specifically be: the main processor core utilizes the cryptographic coprocessor to perform encryption / decryption processing on the data indicated by the data vector in the direct memory access queue.

[0107] In some embodiments, Figure 5 Exemplarily shows an optional structural schematic diagram of the circular buffer of the embodiments of the present application, as Figure 5 shown, the circular buffer may include a head and a tail, and correspondingly, a head pointer indicating the position of the head may be provided for the head, and a tail pointer indicating the position of the tail may be provided for the tail, thus forming a closed-loop structure that can accommodate a fixed number of elements.

[0108] Based on the head-tail structure of the circular buffer, when sequentially recording data vectors into the circular buffer, the data vectors can be sequentially recorded into the head position indicated by the head pointer of the circular buffer. Wherein, for each data vector recorded, the head position indicated by the head pointer of the circular buffer advances by one position (in the direction indicated by the arrow in the figure). When sending the result data after performing encryption / decryption processing to the network side based on the indication of the data vectors in the circular buffer, it can be based on the tail position indicated by the tail pointer, and send the result data after performing encryption / decryption processing to the network side based on the indication of the data vectors in the circular buffer. Wherein, for each result data sent, the tail position indicated by the tail pointer of the circular buffer advances by one position (in the direction indicated by the arrow in the figure).

[0109] In some embodiments, to extract the processed result data from the circular buffer, in the circular buffer, a status flag bit can be set corresponding to the data vector, and the status flag bit is used to indicate the encryption / decryption processing status of the data indicated by the data vector. Thus, after the cryptographic co-processor or the slave processor core feeds back the result information to the circular buffer, the status flag bit can be updated based on the result information. Wherein, if the status flag bit is a first value (for example, 0), it can indicate that the encryption / decryption processing of the data indicated by the data vector is not completed. If the status flag bit is a second value (for example, 1), it can indicate that the encryption / decryption processing of the data indicated by the data vector is completed.

[0110] As an alternative implementation, based on the indication of the data vectors in the circular buffer, for the result data after performing encryption / decryption processing sent to the network side, in the circular buffer, the status flag bit of the corresponding data vector can be the second value, that is, in the circular buffer, only the result data of the data indicated by the data vector whose status flag bit indicates completion can be sent to the network side.

[0111] In some embodiments, since the circular buffer is a closed-loop structure, when the main processor core and the slave processor core share the circular buffer, to ensure data consistency of the circular buffer and avoid race conditions in a concurrent environment, the main processor core and the slave processor core can obtain the data vector in the circular buffer based on the Compare and Swap (CAS) mechanism. The CAS mechanism provides an atomic operation method to check whether the current value has changed. If it has not changed, the data is updated; otherwise, no operation is performed. Through the CAS operation, the threads of the processor core can compete without synchronization, improving the concurrent performance of the system.

[0112] To facilitate the understanding of the data processing method according to the embodiments of the present application, taking multiple processor cores from processor core 0 to processor core n as the processor cores of a processor, and processor core 0 is configured to be bound to a network card, and processor core 0 and processor core 1 are configured with a cryptographic coprocessor as an example, Figure 6 An exemplary schematic diagram of the data processing flow according to the embodiments of the present application is shown.

[0113] As Figure 6 shown, on the thread where processor core 0 is located, processor core 0 can execute the tasks of receiving and sending data packets and network layer processing. After processor core 0 sends the data vector obtained through network layer processing to the circular buffer facing all processor cores, processor cores 0 to n can all obtain the data vector in the circular buffer and perform encryption / decryption processing on the data.

[0114] Among them, since processor core 0 and processor core 1 are configured with cryptographic coprocessors, processor core 0 can send the data vector it obtains to the direct memory access queue 0 of the corresponding cryptographic coprocessor 0 for storage. Then, cryptographic coprocessor 0 can obtain the data vector in the direct memory access queue 0, perform encryption / decryption processing on the data indicated by the data vector to obtain the result data, and feedback the result information to the circular buffer. Similarly, processor core 1 can send the data vector it obtains to the direct memory access queue 1 of the corresponding cryptographic coprocessor 1 for storage. Then, cryptographic coprocessor 1 can obtain the data vector in the direct memory access queue 1, perform encryption / decryption processing on the data indicated by the data vector to obtain the result data, and feedback the result information to the circular buffer. After processor cores 2 to n obtain the data vector in the circular buffer, they can use the encryption / decryption program to perform encryption / decryption processing on the data indicated by the data vector to obtain the result data, and feedback the result information to the circular buffer.

[0115] To clearly understand the degree of performance improvement of the data processing method according to the embodiments of the present application, the data processing performed based on the data processing method according to the embodiments of the present application can be simulated and compared with the data processing in the "dpdk_cryptodev" mode and the data processing in the "sw_scheduler" mode to obtain Figure 7 the performance comparison schematic diagram shown, where the horizontal axis is the performance index of data processing, and the vertical axis is the data processing method adopted. Refer to Figure 7 shown, it can be seen that the data processing performance of the data processing method according to the embodiments of the present application is significantly higher than the data processing performance in the "dpdk_cryptodev" mode and the data processing performance in the "sw_scheduler" mode.

[0116] It can be seen that the data processing method according to the embodiment of the present application performs network layer processing on the to-be-processed data packet sent by the network side based on the main processor core bound to the network card, obtains a data vector, and then can sequentially record the data vector into the circular buffer, so that the main processor core and the slave processor cores located within the computing architecture where the main processor core is located can obtain the data vector, thereby making full use of the main processor core and the slave processor cores to perform encryption / decryption processing, and improving the data processing efficiency.

[0117] Moreover, after obtaining the data vector, the main processor core, based on the configured cryptographic coprocessor, can use the cryptographic coprocessor to perform encryption / decryption processing on the data indicated by the data vector, obtain the first result data, and feedback the result information to the circular buffer, realizing the encryption / decryption processing of the data indicated by the data vector based on the hardware device (i.e., the cryptographic coprocessor); after obtaining the data vector, the slave processor core can use the encryption / decryption program to perform encryption / decryption processing on the data indicated by the data vector, obtain the second result data, and feedback the result information to the circular buffer, realizing the encryption / decryption processing of the data indicated by the data vector based on the software program (i.e., the encryption / decryption program). Furthermore, based on the indication of the data vector in the circular buffer, the result data after the encryption / decryption processing is sent to the network side, so that the encryption / decryption processing is performed by simultaneously using the hardware computing resources and the software computing resources, effectively ensuring the computing power requirements of IPSec.

[0118] The embodiment of the present application provides a data processing device, and its structure can be seen Figure 8 as shown. The data processing device can be applied to the main processor core bound to the network card, and the main processor core is configured with a cryptographic coprocessor. The data processing device can be configured to execute the data processing method implemented by the main processor core provided by the embodiment of the present application. Among them, the content described below can be considered as the functional modules required for the data processing device to implement the data processing method provided by the embodiment of the present application, and the content described below can be mutually corresponding and referred to the content described above.

[0119] As Figure 8 shown, the data processing device may include: a receiving unit 81, a processing unit 82, a writing unit 83, a main execution unit 84, and a sending unit 85.

[0120] The receiving unit 81 is configured to receive the to-be-processed data packets sequentially sent by the network side;

[0121] The processing unit 82 is configured to perform network layer processing on the to-be-processed data packet to obtain a data vector;

[0122] A writing unit 83 for sequentially writing the data vector into a circular buffer so that the main processor core and slave processor cores within the computing architecture where the main processor core is located can obtain the data vector;

[0123] A main execution unit 84 for, after obtaining the data vector, using the cryptographic coprocessor to perform encryption / decryption processing on the data indicated by the data vector to obtain first result data and feeding back result information to the circular buffer;

[0124] A sending unit 85 for, based on the indication of the data vector in the circular buffer, sending the result data after performing encryption / decryption processing to a network side; wherein, the result data includes the first result data and second result data, and the second result data is obtained by the slave processor core performing encryption / decryption processing on the data indicated by the data vector after obtaining the data vector, and after obtaining the second result data, feeding back result information to the circular buffer.

[0125] Optionally, the cryptographic coprocessor is configured with a direct memory access queue;

[0126] Before the main execution unit 84, after obtaining the data vector and before using the cryptographic coprocessor to perform encryption / decryption processing on the data indicated by the data vector, further includes:

[0127] Sending the obtained data vector to the direct memory access queue;

[0128] The main execution unit 84 using the cryptographic coprocessor to perform encryption / decryption processing on the data indicated by the data vector specifically means: using the cryptographic coprocessor to perform encryption / decryption processing on the data indicated by the data vector in the direct memory access queue.

[0129] Optionally, the circular buffer includes a head and a tail, a head pointer indicating the position of the head is provided corresponding to the head, and a tail pointer indicating the position of the tail is provided corresponding to the tail;

[0130] The writing unit 83 sequentially writing the data vector into the circular buffer includes:

[0131] Sequentially writing the data vector into the head position indicated by the head pointer of the circular buffer; wherein, for each data vector written, the head position indicated by the head pointer of the circular buffer advances by one position;

[0132] The sending unit 85, based on the indication of the data vector in the circular buffer, sending the result data after performing encryption / decryption processing to a network side includes:

[0133] Based on the tail position indicated by the tail pointer and the indication of the data vector in the circular buffer, the result data after encryption / decryption processing is sent to the network side; wherein, for each result data sent, the tail position indicated by the tail pointer of the circular buffer advances by one position.

[0134] Optionally, in the circular buffer, a status flag bit is set corresponding to the data vector, and the status flag bit is used to indicate the encryption / decryption processing status of the data indicated by the data vector;

[0135] After the main execution unit 84 feeds back the result information to the circular buffer, based on the result information, the status flag bit is updated; wherein, if the status flag bit is the first value, it indicates that the encryption / decryption processing of the data indicated by the data vector is not completed; if the status flag bit is the second value, it indicates that the encryption / decryption processing of the data indicated by the data vector is completed.

[0136] Optionally, the result data after encryption / decryption processing sent by the sending unit 85 to the network side based on the indication of the data vector in the circular buffer has the status flag bit of the corresponding data vector as the second value in the circular buffer.

[0137] Optionally, the main processor core obtains the data vector in the circular buffer based on the compare-and-swap (CAS) mechanism.

[0138] Optionally, when the slave processor core is configured with a cryptographic co-processor, the second result data sent by the sending unit 85 is obtained by performing encryption / decryption processing on the data indicated by the obtained data vector using the cryptographic co-processor, and after obtaining the second result data, the result information is fed back to the circular buffer.

[0139] The embodiment of the present application further provides a data processing device, and its structure can be seen Figure 9 as shown. This data processing device can be applied to a slave processor core, and this data processing device can be configured to execute the data processing method implemented by the slave processor core provided in the embodiment of the present application. Among them, the content described below can be considered as the functional modules required for the data processing device to implement the data processing method provided in the embodiment of the present application, and the content described below can be mutually corresponding and referred to the content described above.

[0140] As Figure 9 shown, the data processing device may include: an acquisition unit 91 and a slave execution unit 92.

[0141] An acquisition unit 91, configured to acquire a data vector in a circular buffer; wherein, the data vector is obtained by a main processor core located in the computing architecture where the slave processor core is located, receiving a data packet to be processed sent by a network side, performing network layer processing on the data packet to be processed, and sequentially recording the data vector into the circular buffer; the main processor core is bound to a network card and is configured with a cryptographic coprocessor;

[0142] A slave execution unit 92, configured to use an encryption / decryption program to perform encryption / decryption processing on the data indicated by the acquired data vector to obtain second result data, and feed back result information to the circular buffer.

[0143] Optionally, the slave processor core acquires the data vector in the circular buffer based on a compare-and-swap (CAS) mechanism.

[0144] Optionally, when the slave processor core is configured with a cryptographic coprocessor, the second result data obtained by the slave execution unit 92 is obtained by performing encryption / decryption processing on the data indicated by the acquired data vector using the cryptographic coprocessor, and after obtaining the second result data, result information is fed back to the circular buffer.

[0145] Optionally, in the circular buffer, a status flag bit is set corresponding to the data vector, and the status flag bit is used to indicate the encryption / decryption processing status of the data indicated by the data vector;

[0146] After the slave execution unit 92 feeds back result information to the circular buffer, based on the result information, the status flag bit is updated; wherein, if the status flag bit is a first value, it indicates that the encryption / decryption processing of the data indicated by the data vector is not completed; if the status flag bit is a second value, it indicates that the encryption / decryption processing of the data indicated by the data vector is completed.

[0147] An embodiment of the present application further provides a processor, which can be configured to execute the data processing method provided by the embodiment of the present application. In an optional implementation, in combination with the foregoing description, the processor may include a main processor core, a slave processor core, and an asynchronous engine. The main processor core is bound to a network card and is configured with a cryptographic coprocessor. The functions and detailed structures of the main processor core, the slave processor core, the asynchronous engine, and the cryptographic coprocessor may refer to the corresponding parts of the foregoing description.

[0148] The main processor core is configured to schedule the asynchronous engine and the cryptographic coprocessor to execute the data processing method executed by the main processor core as provided by the embodiment of the present application;

[0149] The slave processor core is used to execute a data processing method executed by the slave processor core in an embodiment of the present application based on the scheduling of the asynchronous engine by the master processor core.

[0150] In some embodiments, the master processor core and the slave processor core are obtained by allocation according to at least the initial state information of each processor core when the processor is initialized.

[0151] An embodiment of the present application further provides a chip, including the processor provided in the embodiment of the present application.

[0152] An embodiment of the present application further provides a computing device. The computing device can implement the data processing method provided in the embodiment of the present application by setting the chip described above. As an alternative implementation, Figure 10 is an optional block diagram of the computing device provided in the embodiment of the present application, as Figure 10 shown, the electronic device may include: at least one processor 1, at least one communication interface 2, at least one memory 3, and at least one communication bus 4.

[0153] In the embodiment of the present application, the number of the processor 1, the communication interface 2, the memory 3, and the communication bus 4 is at least one, and the processor 1, the communication interface 2, and the memory 3 complete communication with each other through the communication bus 4.

[0154] Optionally, the communication interface 2 may be an interface of a communication module for network communication.

[0155] Optionally, the processor 1 may be a CPU (Central Processing Unit), GPU (Graphics Processing Unit), NPU (Embedded Neural Network Processor), FPGA (Field Programmable Gate Array), TPU (Tensor Processing Unit), AI chip, specific integrated circuit ASIC (Application Specific Integrated Circuit), or one or more integrated circuits configured to implement the embodiment of the present application, etc.

[0156] The memory 3 may include a high-speed RAM memory, and may also include a non-volatile memory, such as at least one disk memory.

[0157] Among them, the memory 3 stores one or more computer-executable instructions, and the processor 1 calls the one or more computer-executable instructions to execute the data processing method of the embodiment of the present application.

[0158] The embodiment of the present application further provides a storage medium, which stores one or more computer-executable instructions. When the one or more computer-executable instructions are executed, the data processing method as in the embodiment of the present application is implemented.

[0159] The embodiment of the present application further provides a computer program product, which includes one or more computer-executable instructions. When the one or more computer-executable instructions are executed, the data processing method as in the embodiment of the present application is implemented.

[0160] The above describes multiple embodiment solutions provided by the embodiment of the present application. Each optional manner described in each embodiment solution can be combined and cross-referenced with each other without conflict, so as to extend a variety of possible embodiment solutions, all of which can be considered as the embodiment solutions disclosed and made public by the embodiment of the present application.

[0161] Although the embodiment of the present application is disclosed as above, the present application is not limited thereto. Any person skilled in the art can make various changes and modifications without departing from the spirit and scope of the present application. Therefore, the protection scope of the present application should be subject to the scope defined by the claims.

Claims

1. A data processing method, characterized in that, Applied to the main processor core bound to the network card, and the main processor core is configured with a cryptographic co-processor. The main processor core is responsible for data interaction with the cryptographic co-processor, and the cryptographic co-processor is used to provide hardware device-based encryption / decryption services for the main processor core. The method includes: Receiving the data packets to be processed sequentially sent by the network side; Performing network layer processing on the data packets to be processed to obtain a data vector; Sequentially recording the data vector into a circular buffer so that the main processor core and the slave processor cores within the computing architecture where the main processor core is located can obtain the data vector in the circular buffer. The data vectors in the circular buffer are stored in a first-in-first-out manner. The main processor core and the slave processor cores are allocated according to the initial state information of each processor core during the initialization stage of the multi-core processor. The circular buffer corresponds to all the processor cores in the multi-core processor, so that all the processor cores can obtain data vectors in the circular buffer; After obtaining the data vector, using the cryptographic co-processor to perform encryption / decryption processing on the data indicated by the data vector to obtain first result data, and feeding back the result information to the circular buffer; Based on the indication of the data vector in the circular buffer, sending the result data after performing encryption / decryption processing to the network side; wherein, the result data includes the first result data and the second result data. The second result data is obtained by the slave processor core performing encryption / decryption processing on the data indicated by the data vector using the encryption / decryption program after obtaining the data vector, and after obtaining the second result data, feeding back the result information to the circular buffer.

2. The method according to claim 1, wherein The cryptographic co-processor is configured with a direct memory access queue; Before performing encryption / decryption processing on the data indicated by the data vector using the cryptographic co-processor after obtaining the data vector, it further includes: Sending the obtained data vector to the direct memory access queue; Performing encryption / decryption processing on the data indicated by the data vector using the cryptographic co-processor specifically means: using the cryptographic co-processor to perform encryption / decryption processing on the data indicated by the data vector in the direct memory access queue.

3. The method according to claim 1, characterized in that, The circular buffer includes a head and a tail. A head pointer indicating the position of the head is provided corresponding to the head, and a tail pointer indicating the position of the tail is provided corresponding to the tail; Sequentially recording the data vector into the circular buffer includes: Sequentially recording the data vector into the head position indicated by the head pointer of the circular buffer; wherein, for each data vector recorded, the head position indicated by the head pointer of the circular buffer advances by one position; Based on the indication of the data vector in the circular buffer, sending the result data after performing encryption / decryption processing to the network side includes: Based on the tail position indicated by the tail pointer, and based on the indication of the data vector in the circular buffer, the result data after performing encryption / decryption processing is sent to the network side; wherein, for each result data sent, the tail position indicated by the tail pointer of the circular buffer advances by one position.

4. The method according to claim 3, wherein In the circular buffer, a status flag bit is set corresponding to the data vector, and the status flag bit is used to indicate the encryption / decryption processing status of the data indicated by the data vector; After the result information is fed back to the circular buffer, based on the result information, the status flag bit is updated; wherein, if the status flag bit is the first value, it indicates that the encryption / decryption processing of the data indicated by the data vector is not completed; if the status flag bit is the second value, it indicates that the encryption / decryption processing of the data indicated by the data vector is completed.

5. The method according to claim 4, characterized in that Based on the indication of the data vector in the circular buffer, the result data after performing encryption / decryption processing and sent to the network side has the status flag bit of the corresponding data vector in the circular buffer as the second value.

6. The method according to claim 1, wherein The main processor core obtains the data vector in the circular buffer based on the compare-and-swap (CAS) mechanism.

7. The method according to claim 1, wherein When the slave processor core is configured with a cryptographic coprocessor, the second result data included in the result data is obtained by the slave processor core after obtaining the data vector and using the cryptographic coprocessor to perform encryption / decryption processing on the data indicated by the data vector, and after obtaining the second result data, the result information is fed back to the circular buffer.

8. A data processing method, characterized in that, Applied to the slave processor core, the method includes: Obtain the data vector in the circular buffer; wherein, the data vectors in the circular buffer are stored in a first-in-first-out manner, and the data vector is obtained by the main processor core located in the computing architecture where the slave processor core is located after receiving the data packet to be processed sent by the network side and performing network layer processing on the data packet to be processed, and the data vectors are sequentially recorded in the circular buffer; the circular buffer corresponds to all processor cores in the multi-core processor, so that all processor cores can obtain data vectors in the circular buffer; in the initialization stage of the multi-core processor, the main processor core and the slave processor core are allocated according to the initial state information of each processor core, the main processor core is bound to the network card and configured with a cryptographic coprocessor, the main processor core is responsible for data interaction with the cryptographic coprocessor, and the cryptographic coprocessor is used to provide encryption / decryption services based on hardware devices for the main processor core; Use the encryption / decryption program to perform encryption / decryption processing on the data indicated by the obtained data vector to obtain the second result data, and feed back the result information to the circular buffer.

9. The method according to claim 8, wherein The slave processor core obtains the data vector in the circular buffer based on the compare-and-swap (CAS) mechanism.

10. The method according to claim 8, wherein When the slave processor core is configured with a cryptographic coprocessor, the second result data is obtained by using the cryptographic coprocessor to perform encryption / decryption processing on the data indicated by the obtained data vector, and after obtaining the second result data, the result information is fed back to the circular buffer.

11. The method according to claim 8, wherein In the circular buffer, a status flag is set corresponding to the data vector, and the status flag is used to indicate the encryption / decryption processing status of the data indicated by the data vector; After feeding back the result information to the circular buffer, based on the result information, the status flag is updated; wherein, if the status flag is a first value, it indicates that the encryption / decryption processing of the data indicated by the data vector is not completed; if the status flag is a second value, it indicates that the encryption / decryption processing of the data indicated by the data vector is completed.

12. A data processing device, characterized in that, Applied to the main processor core bound to the network card, and the main processor core is configured with a cryptographic coprocessor. The main processor core is responsible for data interaction with the cryptographic coprocessor, and the cryptographic coprocessor is used to provide encryption / decryption services based on hardware devices for the main processor core, including: A receiving unit, configured to receive the to-be-processed data packets sequentially sent by the network side; A processing unit, configured to perform network layer processing on the to-be-processed data packets to obtain a data vector; A writing unit, configured to sequentially record the data vector into the circular buffer, so that the main processor core and the slave processor cores located within the computing architecture where the main processor core is located can obtain the data vector in the circular buffer. The data vectors in the circular buffer are stored in a first-in-first-out manner. The main processor core and the slave processor cores are allocated according to the initial state information of each processor core during the initialization stage of the multi-core processor. The circular buffer corresponds to all processor cores in the multi-core processor, so that all processor cores can obtain data vectors in the circular buffer; A main execution unit, configured to, after obtaining the data vector, use the cryptographic coprocessor to perform encryption / decryption processing on the data indicated by the data vector to obtain first result data, and feed back the result information to the circular buffer; A sending unit, configured to send the result data after performing encryption / decryption processing to the network side based on the indication of the data vector in the circular buffer; wherein, the result data includes the first result data and the second result data. The second result data is obtained by the slave processor core using an encryption / decryption program to perform encryption / decryption processing on the data indicated by the data vector after obtaining the data vector, and after obtaining the second result data, the result information is fed back to the circular buffer.

13. A data processing device, characterized in that, Applied to the slave processor core, including: An acquisition unit, configured to acquire a data vector in a circular buffer; wherein, the data vectors in the circular buffer are stored in a first-in-first-out manner, the data vector is obtained by a main processor core located in the computing architecture where the slave processor core is located, receiving a packet to be processed sent by a network side, performing network layer processing on the packet to be processed, and sequentially recording the data vector into the circular buffer, the circular buffer corresponding to all processor cores in a multi-core processor, so that all processor cores acquire data vectors in the circular buffer; in the initialization stage of the multi-core processor, the main processor core and the slave processor core are allocated according to the initial state information of each processor core; the main processor core is bound to a network card and is configured with a cryptographic coprocessor, the main processor core is responsible for data interaction with the cryptographic coprocessor, and the cryptographic coprocessor is used to provide encryption / decryption services based on hardware devices for the main processor core; A slave execution unit, configured to use an encryption / decryption program to perform encryption / decryption processing on the data indicated by the acquired data vector, obtain second result data, and feedback result information to the circular buffer.

14. A processor, characterized in that, Comprising: A main processor core, a slave processor core, and an asynchronous engine; the main processor core is bound to a network card and is configured with a cryptographic coprocessor; The main processor core is configured to schedule the asynchronous engine and the cryptographic coprocessor to execute the data processing method according to any one of claims 1-7; The slave processor core is configured to execute the data processing method according to any one of claims 8-11 based on the scheduling of the asynchronous engine by the main processor core.

15. A chip, characterized in that, Comprising the processor according to claim 14.

16. A computing device, characterized in that, Comprising the chip according to claim 15.

17. A storage medium, characterized in that, The storage medium stores one or more computer-executable instructions, and when the one or more computer-executable instructions are executed, the data processing method according to any one of claims 1-7 or claims 8-11 is implemented.

18. A computer program product, characterized in that, Comprising one or more computer-executable instructions, and when the one or more computer-executable instructions are executed, the data processing method according to any one of claims 1-7 or claims 8-11 is implemented.

Images