Data group packet transmission method and device

Abstract

The invention discloses a data packet transmission method and device, and the method comprises the following steps: obtaining a key message based on transmission data, and encrypting the transmission data through employing the key message to generate a ciphertext message; field formats of the key message and the ciphertext message are adjusted, the same field formats are combined to form new combined messages, an interval message is connected behind each combined message, and the combined messages and the interval messages are transmitted at the same time; and based on a multi-task core system, a transmission service core is allocated to the combined message, and an interruption service core is allocated to the interval message after the message is combined. The combined message combines the public overhead part of the key message and the ciphertext message, the reduced public overhead part reduces the occupied transmission bandwidth, meanwhile, the proportion of pps and CPU sent by a network card for communication between the isolation area and the non-secret area is reduced, and the data transmission rate is effectively improved. The multiple task cores process data transmission and interrupt requests in parallel, and the utilization rate of the service cores is effectively improved.

Description

Technical Field

[0001] The present application relates to the technical field of data transmission, and in particular to a data packet transmission method and device. Background Art

[0002] The patent with application number 2022109259497 proposes a global quantum security system in the form of hardware with a secret area, an isolation area, and a non-secret area, wherein an encryption and decryption module is deployed in the isolation area to perform encryption and decryption operations. The global quantum security system can be applied to a quantum security privacy computer. The quantum security privacy computer serves as a security terminal for users. The secret area sends the plaintext data to the encryption and decryption module for encryption. The encryption and decryption module sends the encrypted ciphertext and the encryption key to the non-secret area, respectively, and then sends them to the network from the communication area. The key is a small packet of fixed length. The length of the ciphertext is consistent with the length of the plaintext, and the length of the ciphertext sent each time can be different.

[0003] When a device (for example, a quantum security privacy computer) leaves the factory, all hardware configurations, such as CPU, memory, and other hardware, are completed. The isolation area and communication area of ​​the quantum security privacy computer are both configured as ARM boards, which are relatively low in memory, CPU core count, and other aspects compared to x86 devices. Therefore, with fixed hardware configurations, as the amount of data transmitted increases and the number of transmissions increases, too large a number of packets received / sent per second (Packet Per Second; pps) will consume CPU performance, making the fixed hardware configuration gradually unable to meet the performance requirements of sending data, resulting in data transmission congestion, transmission rates that do not meet expected rates, and serious packet loss.

[0004] For a device that has already been configured with hardware, it is obviously too costly to perform hardware modifications to improve device performance and increase data transmission rates. In addition, a large amount of data sent may only account for a portion of the total data transmission time. Therefore, how to reduce PPS and CPU performance consumption based on the existing hardware configuration without performing hardware modifications has become a technical issue worthy of attention in the current data transmission field. Summary of the invention

[0005] Purpose of the invention: The present application provides a data packet transmission method to solve the problems existing in the background technology.

[0006] Technical solution: The present invention provides a data packet transmission method, comprising the following steps:

[0007] Step 1: Obtain a key message based on the transmission data, and use the key message to encrypt the transmission data to generate a ciphertext message;

[0008] Step 2: Adjust the field formats of the key message and the ciphertext message, merge the same field formats, and form a new combined message. Each combined message is followed by an interval message, and the combined message and the interval message are transmitted simultaneously.

[0009] As an improvement of the present invention, in step 2, the specific process of adjusting the field format of the key message and the ciphertext message is:

[0010] Step 2-1: Adjust the field format of the key message in the following order: first link layer, security identifier, first destination IP identifier, first network data, and tail tag;

[0011] Step 2-1: Adjust the field format of the ciphertext message in the following order: second link layer, security identifier, second destination IP identifier, second network data, and tail tag;

[0012] Among them, the subfields of the first link layer include the destination MAC, source MAC and protocol type, the subfields of the first destination IP identifier include the first IP type and the first IP address, the subfields of the second link layer include the destination MAC, source MAC and protocol type, and the subfields of the second destination IP identifier include the second IP type and the second IP address.

[0013] As an improvement of the present invention, in step 2, the specific process of merging the same field formats to form a new combined message is:

[0014] Step 2-3: extract the same field formats in the key message and the ciphertext message, merge the same field formats, and arrange the different field formats in order. The field format of the new combined message is: combined link layer, security identifier, first destination IP identifier, first network data, second destination IP identifier, second network data, and tail tag;

[0015] The subfields of the combined link layer include the destination MAC, source MAC and protocol type.

[0016] As an improvement of the present invention, the method further comprises the following steps:

[0017] Step 3: Based on the multi-task core system, a transmission service core is allocated to the combined message, and an interrupt service core is allocated to the interval message after the combined message.

[0018] As an improvement of the present invention, the specific process of step 3 is as follows:

[0019] Step 3-1: The multi-service core system sorts all service cores according to processing performance, and selects the service core with the highest processing performance as the transmission service core of the combined message, for transmitting the combined message;

[0020] Step 3-2: The multi-service core system selects an idle service core from other service cores except the transmission service core as the interrupt service core of the interval message after the combined message, and is used to transmit the interval message.

[0021] As an improvement of the present invention, when the first IP address and the second IP address use the IPV4 protocol at the same time, the length of the combined message is between 123 and 1623 bytes.

[0022] As an improvement of the present invention, when the first IP address and the second IP address use the IPV6 protocol at the same time, the length of the combined message is between 147 and 1647 bytes.

[0023] As an improvement of the present invention, when the first IP address and the second IP address do not use the IPV4 protocol or the IPV6 protocol at the same time, the length of the combined message is between 135 and 1635 bytes.

[0024] As an improvement of the present invention, a data packet transmission device is also provided, comprising:

[0025] A confidential area is used to send the transmission data to the isolated area;

[0026] An isolation area, used to obtain a key message based on the transmission data, and use the key message to encrypt the transmission data to generate a ciphertext message; and used to adjust the field format of the key message and the ciphertext message, merge the same field format, and form a new combined message, each combined message is followed by an interval message;

[0027] The non-confidential area is used to allocate transmission service cores for combined messages and to allocate interruption service cores for interval messages after the combined messages.

[0028] As an improvement of the present invention, an embedded computer-readable storage medium is further provided, storing an embedded computer program, and when the embedded computer program is executed by a processor, the processor executes the steps of the method described above.

[0029] Beneficial effects:

[0030] 1. The combined message combines the public overhead of the key message and the ciphertext message. The reduced public overhead reduces the occupied transmission bandwidth. At the same time, through the corresponding data merging operation, the number of transmissions is reduced from two to one, which reduces the pps sent by the network card for communication between the isolation area and the non-confidential area. The CPU share of the isolation area and the non-confidential area is reduced, which effectively improves the data transmission rate.

[0031] 2. Multiple business cores perform concurrent processing of transmission and interruption, effectively improving the utilization of business cores in the multi-business core system, reducing data transmission queues, further improving system response rate, and increasing data transmission rate. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0033] Figure 1 A flow chart of the data packet transmission method of the present application;

[0034] Figure 2 This is a schematic diagram of the formats of key messages, ciphertext messages, and combined messages when this application uses the IPV4 protocol;

[0035] Figure 3 This is a schematic diagram of the formats of key messages, ciphertext messages, and combined messages when this application uses the IPV6 protocol;

[0036] Figure 4 This is a schematic diagram of the structure of the data packet transmission device of the present application. DETAILED DESCRIPTION

[0037] In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present application.

[0038] The terms "first", "second", etc. in this application are used to distinguish similar objects, and are not used to describe a specific order or sequence. It should be understood that the terms used in this way can be interchangeable under appropriate circumstances, so that the embodiments of the present application can be implemented in an order other than those illustrated or described here, and the objects distinguished by "first", "second", etc. are generally of the same type, and the number of objects is not limited. For example, the first object can be one or more.

[0039] The present invention provides a data packet transmission device, including a confidential area, an isolation area, and a non-confidential area. The system is used to execute the data packet transmission method of the present invention. In an embodiment of the present invention, Figure 1 As shown, the method of the present invention comprises the following steps:

[0040] Step 1: A key message is obtained based on the transmission data, and the transmission data is encrypted using the key message to generate a ciphertext message; the transmission data to be transmitted is in a plaintext state.

[0041] Step 2: Adjust the field formats of the key message and the ciphertext message, merge the same field formats, and form a new combined message. Each combined message is followed by an interval message, and the combined message and the interval message are transmitted simultaneously.

[0042] Specifically:

[0043] Step 2-1: Adjust the field format of the key message in the following order: first link layer, security identifier, first destination IP identifier, first network data, and tail tag; it should be noted that the destination IP identifier consists of IP type and IP address, which identifies the destination address to which the transmission data needs to be sent. The first destination IP identifier and the first network data are the destination IP identifier and network data content of the key message.

[0044] Step 2-2: Adjust the field format of the ciphertext message in the following order: second link layer, security identifier, second destination IP identifier, second network data, and tail; wherein the subfield of the first link layer includes the destination MAC, source MAC, and protocol type, the subfield of the first destination IP identifier includes the first IP type and the first IP address, the subfield of the second link layer includes the destination MAC, source MAC, and protocol type, and the subfield of the second destination IP identifier includes the second IP type and the second IP address. The second destination IP identifier and the second network data are the destination IP identifier and network data content of the ciphertext message.

[0045] Step 2-3: Extract the same field formats in the key message and the ciphertext message, merge the same field formats, arrange the different field formats in order, and the field format of the new combined message is: combined link layer, security identifier, first destination IP identifier, first network data, second destination IP identifier, second network data, tail tag; among which, the subfields of the combined link layer include destination MAC, source MAC and protocol type.

[0046] The format of the key message and ciphertext message after adjustment is as follows: Figure 2 and Figure 3As shown, the destination MAC, source MAC, and protocol type in the first link layer of a key message and the second link layer of the corresponding ciphertext message are the same, and the security identifier and tail tag of the key message and the corresponding ciphertext message are also the same. Among them, the security identifier is used to verify the security of the key message and the ciphertext message; the tail tag is used as a queue identifier for processing data in the non-confidential area. These same subfields are used as public overhead, and transmitting them twice will cause a waste of transmission bandwidth. When the device performance configuration is low, the pps is limited when transmitting data, and too much small packet data causes the transmission rate to decrease. The combined message merges the public overhead part of the key message and the ciphertext message. The reduced public overhead part reduces the occupied transmission bandwidth, and at the same time reduces the pps sent by the network card for communication between the isolation area and the non-confidential area. The CPU share of the isolation area and the non-confidential area is reduced, which effectively improves the data transmission rate.

[0047] In one embodiment of the present invention, when the first IP address and the second IP address use the IPV4 protocol at the same time, Figure 2 As shown, the key message before merging is fixed at 88 bytes, and the ciphertext message length is variable according to the length of the transmitted data in the plaintext state, ranging from 61 to 1561 bytes, mainly in small packets, and the length of the combined message after merging is between 123 and 1623 bytes.

[0048] In another embodiment of the present invention, when the first IP address and the second IP address use the IPV6 protocol at the same time, such as Figure 3 As shown in the figure, the key message before merging is fixed at 100 bytes, and the ciphertext message length is variable according to the length of the transmitted data in the plaintext state, ranging from 73 to 1573 bytes, mainly in small packets. The length of the combined message after merging is between 147 and 1647 bytes.

[0049] In another embodiment of the present invention, when the first IP address and the second IP address do not use the IPV4 protocol or the IPV6 protocol at the same time, the length of the combined message is between 135 and 1635 bytes (not shown in the figure).

[0050] In yet another embodiment of the present invention, when the amount of transmitted data increases and the number of data processing threads increases, it is necessary to improve the efficiency of system data processing. In order to improve the utilization rate of the service core in the multi-task core system, the method of the present invention may further include the following steps:

[0051] Step 3: Based on the multi-task core system, a transmission service core is allocated to the combined message, and an interrupt service core is allocated to the interval message after the combined message.

[0052] Specifically:

[0053] Step 3-1: The multi-service core system sorts all service cores according to processing performance, and selects the service core with the highest processing performance as the transmission service core of the combined message, for transmitting the combined message;

[0054] Step 3-2: The multi-service core system selects an idle service core from other service cores except the transmission service core as the interrupt service core of the interval message after the combined message, and is used to transmit the interval message.

[0055] Generally, a device may have multiple service cores, for example, six service cores numbered 0, 1, 2, 3, 4, and 5. Each service core has different processing capabilities. For example, core 0 may be the service core with the strongest processing performance (processing speed, for example, 2.6 GHz), and the processing capabilities of other service cores are relatively weak. Then, after sorting all services by processing performance, the service core with the highest processing performance is core 0. Core 0 is selected to transmit the combined message, and one of the remaining cores 1 to 5 is selected to transmit the interval message.

[0056] During the transmission of each segment of data, there will be an interrupt request as an identifier to separate the transmission of two segments of data. In an embodiment of the present invention, each combined message is followed by an interval message, and the interval message includes an interrupt request. The interrupt request is a data processing notification. The amount of interrupt request data is very small, but for the CPU, it also needs to be processed once. In general, data transmission and interrupt processing are both on the same business core, which is generally the business core with the strongest processing performance. This leads to a situation where one business core is running very full, but other business cores are very idle. Since the CPU performance required for interrupt processing is very small, the present application proposes to separate the transmission of data and the processing of interrupt requests to two business cores for processing.

[0057] In an embodiment of the present invention, Figure 4 As shown, a data packet transmission device is provided, comprising:

[0058] A confidential area is used to send the transmission data to the isolated area;

[0059] An isolation area, used to obtain a key message based on the transmission data, and use the key message to encrypt the transmission data to generate a ciphertext message; and used to adjust the field format of the key message and the ciphertext message, merge the same field format, and form a new combined message, each combined message is followed by an interval message, and the combined message and the interval message are transmitted simultaneously;

[0060] The non-confidential area is used to allocate transmission service cores for combined messages and to allocate interruption service cores for interval messages after the combined messages.

[0061] In an embodiment of the present invention, an embedded computer-readable storage medium is further provided, storing an embedded computer program, and when the embedded computer program is executed by a processor, the processor executes the steps of the method described above.

Claims

1. A data packet transmission method, characterized in that: The following steps are involved: Step 1: Obtain a key message based on the transmission data, and use the key message to encrypt the transmission data to generate a ciphertext message; Step 2: Adjust the field formats of the key message and the ciphertext message, merge the same field formats, and form a new combined message. Each combined message is followed by an interval message, and the combined message and the interval message are transmitted simultaneously.

2. The data packet transmission method according to claim 1, characterized in that: In step 2, the specific process of adjusting the field format of the key message and the ciphertext message is as follows: Step 2-1: Adjust the field format of the key message in the following order: first link layer, security identifier, first destination IP identifier, first network data, and tail tag; Step 2-1: Adjust the field format of the ciphertext message in the following order: second link layer, security identifier, second destination IP identifier, second network data, and tail tag; Among them, the subfields of the first link layer include the destination MAC, source MAC and protocol type, the subfields of the first destination IP identifier include the first IP type and the first IP address, the subfields of the second link layer include the destination MAC, source MAC and protocol type, and the subfields of the second destination IP identifier include the second IP type and the second IP address.

3. The data packet transmission method according to claim 2, characterized in that: In step 2, the specific process of merging the same field formats to form a new combined message is as follows: Step 2-3: extract the same field formats in the key message and the ciphertext message, merge the same field formats, and arrange the different field formats in order. The field format of the new combined message is: combined link layer, security identifier, first destination IP identifier, first network data, second destination IP identifier, second network data, and tail tag; The subfields of the combined link layer include the destination MAC, source MAC and protocol type.

4. The data packet transmission method according to claim 1, characterized in that: The method further comprises the following steps: Step 3: Based on the multi-task core system, a transmission service core is allocated to the combined message, and an interrupt service core is allocated to the interval message after the combined message.

5. The data packet transmission method according to claim 4, characterized in that: The specific process of step 3 is as follows: Step 3-1: The multi-service core system sorts all service cores according to processing performance, and selects the service core with the highest processing performance as the transmission service core of the combined message, for transmitting the combined message; Step 3-2: The multi-service core system selects an idle service core from other service cores except the transmission service core as the interrupt service core of the interval message after the combined message, and is used to transmit the interval message.

6. The data packet transmission method according to claim 2, characterized in that: When the first IP address and the second IP address use the IPV4 protocol at the same time, the length of the combined message is between 123 and 1623 bytes.

7. The data packet transmission method according to claim 2, characterized in that: When the first IP address and the second IP address use the IPV6 protocol at the same time, the length of the combined message is between 147 and 1647 bytes.

8. The data packet transmission method according to claim 2, characterized in that: When the first IP address and the second IP address do not use the IPv4 protocol or the IPv6 protocol at the same time, the length of the combined message is between 135 and 1635 bytes.

9. A data packet transmission device, characterized in that: include: A confidential area is used to send the transmission data to the isolated area; An isolation area, used to obtain a key message based on the transmission data, and use the key message to encrypt the transmission data to generate a ciphertext message; and, used to adjust the field formats of key messages and ciphertext messages, merge the same field formats, and form new combined messages, each of which is followed by an interval message; The non-confidential area is used to allocate transmission service cores for combined messages and to allocate interruption service cores for interval messages after the combined messages.

10. An embedded computer-readable storage medium storing an embedded computer program, wherein when the embedded computer program is executed by a processor, the processor executes the steps of the method according to any one of claims 1 to 8.

Images