TLS application oriented storage and calculation system and acceleration method
By designing the existence system for TLS applications, the hardware accelerates the encryption and compression tasks of the TLS handshake stage, solving the performance overhead caused by the TLS protocol in the high concurrency connection scenario, and realizes more efficient CPU resource utilization and throughput Rate improvement.
Patent Information
- Application Number
- CN202411510554.6
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-10-28
- Publication Date
- 2025-01-21
AI Technical Summary
The performance overhead brought by the TLS protocol in handling large number of concurrent connections has become a bottleneck in system performance, especially in terms of CPU load.
A deposit system for TLS applications is designed, including the register control module, address replacement module, and data processing engine. It accelerates the encryption and compression tasks of the TLS handshake phase through hardware to reduce the CPU load.
Significantly improves the throughput of computationally intensive public key encryption and data compression/decompression, reduces CPU load, and improves the system's ability to handle more concurrent connections.
Smart Images
Figure CN119341748A_ABST
Abstract
Description
Technical Field
[0001] The present invention belongs to the technical field of data reading and writing, and specifically relates to a storage and computing system and an acceleration method for TLS applications. Background Art
[0002] With the rapid development of information technology, the Internet has become an indispensable part of people's lives and work. In order to protect the security of data transmission, the Transport Layer Security (TLS) protocol is widely used in Internet communications; TLS protects data by using encryption algorithms to prevent data from being eavesdropped or tampered with during transmission.
[0003] However, as network traffic continues to grow, the implementation of the TLS protocol has brought significant performance overhead. In scenarios such as web servers that need to handle a large number of concurrent TLS connections, the high demand for central processing units (CPUs) for TLS operations has become a bottleneck for system performance.
[0004] The industry has done a lot of software and protocol optimization to optimize TLS performance, including session reuse, OCSP stapling, TLS1.3 protocol, etc. Although these software-level optimizations have improved TLS performance to a certain extent, as Moore's Law gradually slows down, relying solely on software optimization can no longer meet the growing performance requirements. Summary of the invention
[0005] The present invention provides a storage and computing system and acceleration method for TLS applications, which improves the throughput of computationally intensive public key encryption and data compression / decompression in a Web server and reduces the CPU load.
[0006] In order to achieve the above object, the technical solution adopted by the present invention is: The first aspect of the present invention provides a storage and computing system for TLS applications, comprising a register control module CSR, an address substitution module IOMMU and a data processing engine electrically connected to each other; the register control module CSR, the address substitution module IOMMU and the data processing engine are electrically connected to a main memory through a terminal device PICIE EP; The main memory is used to store receiving descriptors, sending descriptors and original data; The register control module CSR is used to store the Head value and storage address of the sending descriptor and the Tail value of the receiving descriptor; The address substitution module IOMMU is used to generate a physical address according to the address substitution request; The data processing engine is used to generate an address substitution request and send it to the address substitution module IOMMU, read the send descriptor or original data from the main memory according to the physical address; compress or decompress the original data, encrypt or decrypt it, and then write it into the main memory; In response to the completion of writing the original data into the main memory, the data processing engine generates a receiving descriptor and interrupt information; stores the receiving descriptor into the main memory, and registers the Tail value of the receiving descriptor and the interrupt information into the register control module CSR.
[0007] Further, the data processing engine generates an address substitution request of the send descriptor according to the Head value and storage address of the send descriptor; the address substitution module IOMMU generates a physical address and data length of the send descriptor according to the address substitution request of the send descriptor and feeds back to the data processing engine; The data processing engine reads the send descriptor from the main memory according to the physical address and data length of the send descriptor, parses the send descriptor to obtain the storage address and data length of the original data and generates an address substitution request for the original data; The address substitution module IOMMU generates the physical address and data length of the original data according to the address substitution request of the original data and feeds back to the data processing engine; The data processing engine reads the original data from the main memory according to the physical address and data length of the original data.
[0008] Further, the data processing engine includes a read-write descriptor control logic module, a descriptor parsing module, a DMA controller and an algorithm IP module; The read / write descriptor control logic module is electrically connected to the register control module CSR; the read / write descriptor control logic module is used to read the Head value and storage address of the sending descriptor, generate an address substitution request of the sending descriptor according to the Head value and storage address of the sending descriptor, and store the Tail value of the receiving descriptor into the register control module CSR; The descriptor parsing module is used to parse the sending descriptor to obtain the storage address and data length of the original data and generate an address replacement request for the original data; The DMA controller is used to exchange data with the main memory; The algorithm IP module is used to compress or decompress, encrypt or decrypt the original data.
[0009] Further, the DMA controller includes a read data module RDMA and a write data module WDMA; The read data module RDMA is used to read the send descriptor from the main memory according to the physical address and data length of the send descriptor, and read the original data from the main memory according to the physical address and data length of the original data; The data writing module WDMA writes the original data into the main memory after compression or decompression processing, encryption or decryption processing, and stores the receiving descriptor into the main memory.
[0010] Furthermore, the algorithm IP module is used to execute symmetric encryption and decryption algorithm IP, asymmetric encryption and decryption algorithm IP, data compression algorithm IP and data decompression algorithm IP.
[0011] Furthermore, the algorithm IP module is electrically connected to the DMA controller and the RAM register through a conversion interface; the conversion interface includes an upstream conversion interface and a downstream conversion interface; the upstream conversion interface is responsible for data conversion from the RAM register to the algorithm IP module; the downstream conversion interface is responsible for data conversion from the algorithm IP module to the RAM register.
[0012] Furthermore, the data bit width of the RAM register is 128 bits, the data input interface of the data compression algorithm IP in the algorithm IP module is 64 bits, the data input interface of the data decompression algorithm IP is 16 bits, and the data input interface of the data encryption and decryption algorithm IP is 32 bits; the data output interface of the data compression algorithm IP and the data decompression algorithm IP is 64 bits, and the output data bit width of the encryption and decryption algorithm IP is 32 bits.
[0013] Further, the register control module CSR includes an address register, a head register, a tail register and an interrupt register; The address register records the storage addresses of the tx-ring sending queue and the rx_ring receiving queue in the main memory; The Head register is used to store the Head value of the send descriptor; The Tail register is used to store the Tail value of the receive descriptor; The interrupt register is used to store the interrupt information.
[0014] A second aspect of the present invention provides a storage and computing acceleration method for TLS applications, wherein the storage and computing system described in the first aspect is used to execute the storage and computing method, including: In response to the main memory storing the sending descriptor and the original data; updating the Head value and the storage address of the sending descriptor stored in the register control module CSR; Generate an address substitution request of the send descriptor according to the Head value and storage address of the send descriptor and send it to the address substitution module IOMMU; generate a physical address and data length of the send descriptor according to the address substitution request of the send descriptor and feed it back to the data processing engine; Reading the send descriptor from the main memory according to the physical address and data length of the send descriptor, parsing the send descriptor to obtain the storage address and data length of the original data, generating an address substitution request for the original data, and sending the request to the address substitution module IOMMU; Generate the physical address and data length of the original data according to the address replacement request of the original data and feed it back to the data processing engine; Reading the original data from the main memory according to the physical address and data length of the original data, compressing or decompressing the original data, encrypting or decrypting the original data, and then writing it into the main memory; In response to the completion of writing the original data into the main memory, a receiving descriptor and interrupt information are generated; the receiving descriptor is stored in the rx_ring receiving queue in the main memory, and the Tail value and interrupt information of the receiving descriptor are registered in the register control module CSR.
[0015] Further, the original data is compressed or decompressed, encrypted or decrypted, and then written into the main memory, the process includes: The original data is compressed or decompressed, encrypted or decrypted and then written into the RAM register; the DMA controller reads the output data of the algorithm IP module from the RAM register and writes it into the main memory.
[0016] Further, an address substitution request of the send descriptor is generated according to the Head value and the storage address of the send descriptor, and the process includes: The storage address of the send descriptor is added with the offset 128 bits to obtain the real storage address of the send descriptor, and the address substitution request of the send descriptor is generated according to the Head value of the send descriptor and the real storage address.
[0017] Compared with the prior art, the present invention has the following beneficial effects: The data processing engine of the present invention generates an address substitution request and sends it to an address substitution module IOMMU; the address substitution module IOMMU generates a physical address according to the address substitution request; the data processing engine reads a sending descriptor or original data from a main memory according to the physical address, compresses or decompresses the original data, encrypts or decrypts the data, and then writes it to the main memory; the address substitution and processing logic of the data are moved to a dedicated hardware module, thereby optimizing the utilization of CPU and memory resources, so that the system can more efficiently process more concurrent connections.
[0018] The data processing engine of the present invention includes a read-write descriptor control logic module, a descriptor parsing module, a DMA controller and an algorithm IP module. The data processing engine can quickly process a large number of descriptors and data, thereby improving the system's ability to handle high-speed network traffic. Since most of the data processing process is completed at the hardware level, the delay at the software level is reduced, thereby reducing the delay in network communication as a whole. BRIEF DESCRIPTION OF THE DRAWINGS
[0019] Figure 1 A structural diagram of a storage and computing system for TLS applications provided in Example 1 of the present invention; Figure 2 This is a structural diagram of the data processing engine provided in Example 1 of the present invention. DETAILED DESCRIPTION
[0020] The present invention will be further described below in conjunction with the accompanying drawings. The following embodiments are only used to more clearly illustrate the technical solution of the present invention, and cannot be used to limit the protection scope of the present invention.
[0021] Example 1 like Figure 1 As shown, this embodiment provides a storage and computing system for TLS applications, including a register control module CSR, an address substitution module IOMMU and a data processing engine electrically connected to each other; the register control module CSR, the address substitution module IOMMU and the data processing engine are electrically connected to a main memory (memory) through a terminal device PICIE EP; the main memory is used to store a receiving descriptor, a sending descriptor and original data; The register control module CSR includes an address register, a Head register, a Tail register and an interrupt register; the address register records the storage addresses of the tx-ring sending queue and the rx_ring receiving queue in the main memory; the Head register is used to store the Head value of the sending descriptor; the Tail register is used to store the Tail value of the receiving descriptor; and the interrupt register is used to store the interrupt information.
[0022] The data processing engine generates an address substitution request of the sending descriptor according to the Head value and storage address of the sending descriptor; the address substitution module IOMMU generates a physical address and data length of the sending descriptor according to the address substitution request of the sending descriptor and feeds back to the data processing engine; The data processing engine reads the send descriptor from the main memory according to the physical address and data length of the send descriptor, parses the send descriptor to obtain the storage address and data length of the original data and generates an address substitution request for the original data; The address substitution module IOMMU generates the physical address and data length of the original data according to the address substitution request of the original data and feeds back to the data processing engine; The data processing engine reads the original data from the main memory according to the physical address and data length of the original data, compresses or decompresses the original data, encrypts or decrypts the original data, and then writes it into the main memory; In response to the completion of writing the original data into the main memory, the data processing engine generates a receiving descriptor and interrupt information; stores the receiving descriptor into the main memory, and registers the Tail value of the receiving descriptor and the interrupt information into the register control module CSR.
[0023] The data processing engine includes a read-write descriptor control logic module, a descriptor parsing module, a DMA controller and an algorithm IP module; The read / write descriptor control logic module is electrically connected to the register control module CSR; the read / write descriptor control logic module is used to read the Head value and storage address of the sending descriptor, generate an address substitution request of the sending descriptor according to the Head value and storage address of the sending descriptor, and store the Tail value of the receiving descriptor into the register control module CSR; The descriptor parsing module is used to parse the sending descriptor to obtain the storage address and data length of the original data and generate an address replacement request for the original data; The DMA controller is used to exchange data with the main memory; the DMA controller includes a read data module RDMA and a write data module WDMA; the read data module RDMA is used to read the send descriptor from the main memory according to the physical address and data length of the send descriptor, and read the original data from the main memory according to the physical address and data length of the original data; the write data module WDMA compresses or decompresses the original data, encrypts or decrypts the original data, and writes it to the main memory, and stores the receive descriptor in the main memory; The algorithm IP module is used to compress or decompress, encrypt or decrypt the original data; the algorithm IP module is used to execute symmetric encryption and decryption algorithm IP, asymmetric encryption and decryption algorithm IP, data compression algorithm IP and data decompression algorithm IP.
[0024] The algorithm IP module is electrically connected to the DMA controller and the RAM register through a conversion interface; the algorithm IP module compresses or decompresses the original data, encrypts or decrypts the data, and then writes it to the RAM register; the DMA controller reads the output data of the algorithm IP module from the RAM register and writes it to the main memory; the conversion interface includes an upstream conversion interface and a downstream conversion interface; the upstream conversion interface is responsible for data conversion from the RAM register to the algorithm IP module; the downstream conversion interface is responsible for data conversion from the algorithm IP module to the RAM register.
[0025] The data bit width of the RAM register is 128 bits. The data input interface of the data compression algorithm IP in the algorithm IP module is 64 bits, the data input interface of the data decompression algorithm IP is 16 bits, and the data input interface of the data encryption and decryption algorithm IP is 32 bits; the data output interface of the data compression algorithm IP and the data decompression algorithm IP is 64 bits, and the output data bit width of the encryption and decryption algorithm IP is 32 bits.
[0026] This embodiment significantly improves the data processing speed by hardware accelerating the encryption and compression tasks in the TLS handshake phase; offloads computationally intensive tasks from the CPU to a dedicated hardware accelerator, effectively reducing the CPU workload; and frees up CPU resources so that it can handle more tasks, thereby improving the processing power and performance of the entire system.
[0027] Example 2 This embodiment provides a storage and computing acceleration method for TLS applications. The storage and computing acceleration method is executed by using the storage and computing system described in Embodiment 1, including: In response to the main memory storing the sending descriptor and the original data; updating the Head value and the storage address of the sending descriptor stored in the register control module CSR; The storage address of the send descriptor is added with an offset of 128 bits to obtain the real storage address of the send descriptor, and an address substitution request of the send descriptor is generated according to the Head value of the send descriptor and the real storage address and sent to the address substitution module IOMMU; the physical address and data length of the send descriptor are generated according to the address substitution request of the send descriptor and fed back to the data processing engine.
[0028] The send descriptor is read from the main memory according to the physical address and data length of the send descriptor, the send descriptor is parsed to obtain the storage address and data length of the original data, and an address substitution request for the original data is generated and sent to the address substitution module IOMMU.
[0029] The physical address and data length of the original data are generated according to the original data address replacement request and fed back to the data processing engine; the original data is read from the main memory according to the physical address and data length of the original data, and the original data is compressed or decompressed, encrypted or decrypted, and then written into the main memory, the process includes: The original data is compressed or decompressed, encrypted or decrypted and then written into the RAM register; the DMA controller reads the output data of the algorithm IP module from the RAM register and writes it into the main memory.
[0030] In response to the completion of writing the original data into the main memory, a receiving descriptor and interrupt information are generated; the receiving descriptor is stored in the rx_ring receiving queue in the main memory, and the Tail value and interrupt information of the receiving descriptor are registered in the register control module CSR.
[0031] This embodiment can quickly process a large amount of descriptors and data, thereby improving the system's ability to handle high-speed network traffic; since most of the data processing process is completed at the hardware level, the delay at the software level is reduced, thereby reducing the overall delay in network communications.
[0032] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Furthermore, the present application may take the form of one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, etc.) containing computer-usable program code. M , optical storage, etc.).
[0033] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.
[0034] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.
[0035] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable device. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.
[0036] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the technical principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.
Claims
1. A storage and computing system for TLS applications, characterized in that: It includes a register control module CSR, an address substitution module IOMMU and a data processing engine which are electrically connected to each other; the register control module CSR, the address substitution module IOMMU and the data processing engine are electrically connected to the main memory through the terminal device PICIE EP; The main memory is used to store receiving descriptors, sending descriptors and original data; The register control module CSR is used to store the Head value and storage address of the sending descriptor and the Tail value of the receiving descriptor; The address substitution module IOMMU is used to generate a physical address according to the address substitution request; The data processing engine is used to generate an address substitution request and send it to the address substitution module IOMMU, read the send descriptor or original data from the main memory according to the physical address; compress or decompress the original data, encrypt or decrypt it, and then write it into the main memory; In response to the completion of writing the original data into the main memory, the data processing engine generates a receiving descriptor and interrupt information; stores the receiving descriptor into the main memory, and registers the Tail value of the receiving descriptor and the interrupt information into the register control module CSR.
2. The storage and computing system for TLS applications according to claim 1, characterized in that: The data processing engine generates an address substitution request of the sending descriptor according to the Head value and storage address of the sending descriptor; the address substitution module IOMMU generates a physical address and data length of the sending descriptor according to the address substitution request of the sending descriptor and feeds back to the data processing engine; The data processing engine reads the send descriptor from the main memory according to the physical address and data length of the send descriptor, parses the send descriptor to obtain the storage address and data length of the original data and generates an address substitution request for the original data; The address substitution module IOMMU generates the physical address and data length of the original data according to the address substitution request of the original data and feeds back to the data processing engine; The data processing engine reads the original data from the main memory according to the physical address and data length of the original data.
3. The storage and computing system for TLS applications according to claim 2, characterized in that: The data processing engine includes a read-write descriptor control logic module, a descriptor parsing module, a DMA controller and an algorithm IP module; The read / write descriptor control logic module is electrically connected to the register control module CSR; the read / write descriptor control logic module is used to read the Head value and storage address of the sending descriptor, generate an address substitution request of the sending descriptor according to the Head value and storage address of the sending descriptor, and store the Tail value of the receiving descriptor into the register control module CSR; The descriptor parsing module is used to parse the sending descriptor to obtain the storage address and data length of the original data and generate an address replacement request for the original data; The DMA controller is used to exchange data with the main memory; The algorithm IP module is used to compress or decompress, encrypt or decrypt the original data.
4. The storage and computing system for TLS applications according to claim 3, characterized in that: The DMA controller includes a read data module RDMA and a write data module WDMA; The read data module RDMA is used to read the send descriptor from the main memory according to the physical address and data length of the send descriptor, and read the original data from the main memory according to the physical address and data length of the original data; The data writing module WDMA writes the original data into the main memory after compression or decompression processing, encryption or decryption processing, and stores the receiving descriptor into the main memory.
5. The storage and computing system for TLS applications according to claim 3, characterized in that: The algorithm IP module is used to execute symmetric encryption and decryption algorithm IP, asymmetric encryption and decryption algorithm IP, data compression algorithm IP and data decompression algorithm IP.
6. The storage and computing system for TLS applications according to claim 3, characterized in that: The algorithm IP module is electrically connected to the DMA controller and the RAM register through a conversion interface; the conversion interface includes an upstream conversion interface and a downstream conversion interface; the upstream conversion interface is responsible for data conversion from the RAM register to the algorithm IP module; the downstream conversion interface is responsible for data conversion from the algorithm IP module to the RAM register.
7. The storage and computing system for TLS applications according to claim 6, characterized in that: The data bit width of the RAM register is 128 bits. The data input interface of the data compression algorithm IP in the algorithm IP module is 64 bits, the data input interface of the data decompression algorithm IP is 16 bits, and the data input interface of the data encryption and decryption algorithm IP is 32 bits; the data output interface of the data compression algorithm IP and the data decompression algorithm IP is 64 bits, and the output data bit width of the encryption and decryption algorithm IP is 32 bits.
8. The storage and computing system for TLS applications according to claim 1, characterized in that: The register control module CSR includes address register, head register, tail register and interrupt register; The address register records the storage addresses of the tx-ring sending queue and the rx_ring receiving queue in the main memory; The Head register is used to store the Head value of the send descriptor; The Tail register is used to store the Tail value of the receive descriptor; The interrupt register is used to store the interrupt information.
9. A storage and computing acceleration method for TLS applications, characterized in that: The storage and calculation method is performed using the storage and calculation system according to any one of claims 1 to 8, comprising: In response to the main memory storing the sending descriptor and the original data; updating the Head value and the storage address of the sending descriptor stored in the register control module CSR; Generate an address substitution request of the send descriptor according to the Head value and storage address of the send descriptor and send it to the address substitution module IOMMU; generate a physical address and data length of the send descriptor according to the address substitution request of the send descriptor and feed it back to the data processing engine; Reading the send descriptor from the main memory according to the physical address and data length of the send descriptor, parsing the send descriptor to obtain the storage address and data length of the original data, generating an address substitution request for the original data, and sending the request to the address substitution module IOMMU; Generate the physical address and data length of the original data according to the address replacement request of the original data and feed it back to the data processing engine; Reading the original data from the main memory according to the physical address and data length of the original data, compressing or decompressing the original data, encrypting or decrypting the original data, and then writing it into the main memory; In response to the completion of writing the original data into the main memory, a receiving descriptor and interrupt information are generated; the receiving descriptor is stored in the rx_ring receiving queue in the main memory, and the Tail value and interrupt information of the receiving descriptor are registered in the register control module CSR.
10. The storage and calculation acceleration method according to claim 9, characterized in that: The original data is compressed or decompressed, encrypted or decrypted, and then written to the main memory. The process includes: The original data is compressed or decompressed, encrypted or decrypted and then written into the RAM register; the DMA controller reads the output data of the algorithm IP module from the RAM register and writes it into the main memory.