Method and device for securely storing and reading high-speed data based on FPGA

Abstract

The present application provides a method and device for securely storing and reading high-speed data based on FPGA. The present application allocates at least one data transmission channel between the external interface and the second FPGA for each type of user-side data through an MCU deployed in an electronic device, according to the data write rate of N types of user-side data received by the external interface obtained by the second FPGA, so that the second FPGA receives the user-side data of the type transmitted from the external interface through at least one data transmission channel corresponding to the user-side data of the type, temporarily stores the N types of user-side data in a first storage medium, encrypts the user-side data stored in the first storage medium through the first FPGA, and further sends the encrypted user-side data to the storage array of the electronic device for storage through the second FPGA, thereby improving the data transmission rate and the security of data transmission.

Description

Technical Field

[0001] The present application relates to the technical field of data information security storage, and in particular to a method and device for securely storing and reading high-speed data based on FPGA. Background Art

[0002] The current FPGA-based data storage method usually uses the FPGA to simply encode the data to be stored (for example, encrypting the data bits by rotating them left or right a certain number of times), and then stores it in the storage array of the electronic device. This data storage method has a slow data transmission rate and low data transmission security. Summary of the invention

[0003] In view of this, the present application provides a method and device for securely storing and reading high-speed data based on FPGA, so as to improve the data transmission rate and the security of data transmission.

[0004] The technical solutions provided by this application are as follows:

[0005] According to an embodiment of the first aspect of the present application, a method for securely storing and reading high-speed data based on FPGA is proposed. The method is applied to an electronic device, wherein the electronic device includes a storage array, a microcontroller unit MCU, a first storage medium, an external interface, a first FPGA, and a second FPGA; the method includes:

[0006] The second FPGA acquires data write rates of N types of user-side data received by the external interface, and sends the data write rates of the N types of user-side data to the MCU;

[0007] For each type of user-side data in the N types of user-side data, the MCU determines, according to the data write rate of the type of user-side data, at least one data transmission channel between the external interface and the second FPGA corresponding to the type of user-side data, and the sum of the data write rates supported by the at least one data transmission channel is not less than the data write rate of the type of user-side data;

[0008] For each type of user-side data among the N types of user-side data, the second FPGA receives the type of user-side data through at least one data transmission channel corresponding to the type of user-side data, and forwards the type of user-side data to the first storage medium;

[0009] The first FPGA encrypts N types of user-side data stored in the first storage medium to obtain encrypted user-side data;

[0010] The second FPGA stores the encrypted user-side data in the storage array, so that the encrypted user-side data stored in the storage array is read through the second FPGA.

[0011] Optionally, the second FPGA is connected to the external interface and to the storage array; a first storage medium for caching user-side data is deployed between the first FPGA and the second FPGA; and the MCU is communicatively connected to the first FPGA and the second FPGA, respectively.

[0012] Optionally, the method for the second FPGA to obtain data write rates of N types of user-side data received by the external interface includes:

[0013] The second FPGA determines, according to a counter deployed on the external interface, a data write rate of N types of user-side data received by the external interface;

[0014] Alternatively, the electronic device also includes a CPU, and the second FPGA determines the data write rate of N types of user-side data received by the external interface based on the data write request sent by the CPU, and the data write request carries the data write rate of the N types of user-side data to be written.

[0015] Optionally, before the first FPGA encrypts the user-side data stored in the first storage medium, the method further includes:

[0016] For each type of user-side data among N types of user-side data, the MCU determines the encryption computing resources provided by the first FPGA for this type of user-side data based on the data write rate of this type of user-side data, and the encryption computing resources include the number of computing cores enabled by the first FPGA, and the number of computing cores enabled by the first FPGA is positively correlated with the data write rate of this type of user-side data.

[0017] Optionally, the first FPGA further includes a security module, and the first FPGA encrypts the user-side data stored in the first storage medium to obtain the encrypted user-side data, including:

[0018] For each type of user-side data among the N types of user-side data, if the encryption algorithm used to encrypt the type of user-side data is a symmetric encryption algorithm, the first FPGA obtains the key data stored in the security module, and encrypts the type of user-side data stored in the first storage medium according to the key data based on the encryption computing resources corresponding to the type of user-side data, to obtain encrypted user-side data;

[0019] For each type of user-side data among the N types of user-side data, if the encryption algorithm used to encrypt the type of user-side data is an asymmetric encryption algorithm, the security module encrypts the type of user-side data stored in the first storage medium based on the stored key data and the encryption computing resources corresponding to the type of user-side data to obtain encrypted user-side data.

[0020] Optionally, the data in the first storage medium is stored in the form of data blocks. After the second FPGA sends the data write rate of the N types of user-side data to the MCU, the method further includes:

[0021] For each type of user-side data among the N types of user-side data, the MCU determines the data block size allocated to the type of user-side data in the first storage medium according to the data write rate of the type of user-side data, and the data block size used to store the type of user-side data in the first storage medium is positively correlated with the data write rate of the type of user-side data;

[0022] The forwarding of the type of user-side data to the first storage medium includes:

[0023] The user-side data of this type is forwarded to the data block allocated for the user-side data of this type in the first storage medium for storage.

[0024] Optionally, before the first FPGA encrypts the user-side data stored in the first storage medium, the method further includes:

[0025] For each type of user-side data among the N types of user-side data, the first FPGA detects whether the user-side data of the type forwarded by the second FPGA to the first storage medium reaches a size of a data block allocated for the user-side data of the type;

[0026] If so, the first FPGA encrypts the data block allocated for this type of user-side data and stored in the first storage medium.

[0027] Optionally, the electronic device further includes a CPU, and the reading the encrypted user-side data stored in the storage array through the second FPGA includes:

[0028] The second FPGA receives a data read request sent by the CPU, wherein the data read request carries data attributes of the user-side data to be read as indicated by the data read request, and the data attributes include data read rates of M types of encrypted user-side data;

[0029] The second FPGA determines the data reading rates of the M types of encrypted user-side data to be read according to the data reading request, and sends the data reading rates of the M types of encrypted user-side data to the MCU;

[0030] For each type of encrypted user-side data in the M types of data, the MCU determines, according to the data reading rate of the encrypted user-side data of the type, at least one data transmission channel between the external interface and the second FPGA corresponding to the encrypted user-side data of the type, and the sum of the data transmission rates supported by the at least one data transmission channel is not less than the data reading rate of the encrypted user-side data of the type;

[0031] The second FPGA forwards the M types of encrypted user-side data to the first storage medium;

[0032] The first FPGA decrypts the M types of encrypted user-side data stored in the first storage medium to obtain M types of target user-side data;

[0033] For each type of target user side data among the M types of target user side data, the second FPGA forwards the target user side data of this type obtained from the first storage medium to the external interface through at least one data transmission channel corresponding to the encrypted user side data matching the target user side data of this type, so as to complete the reading of the target user side data.

[0034] Optionally, before the first FPGA decrypts the M types of encrypted user-side data stored in the first storage medium, the method further includes:

[0035] For each type of encrypted user-side data among the M types of encrypted user-side data, the MCU determines the decryption computing resources provided by the first FPGA for the type of encrypted user-side data according to the data reading rate of the type of encrypted user-side data, and the decryption computing resources include the number of computing cores enabled by the first FPGA, and the number of computing cores enabled by the first FPGA is positively correlated with the data reading rate of the type of encrypted user-side data.

[0036] According to an embodiment of the second aspect of the present application, an electronic device is proposed, which includes a storage array, a microcontroller unit MCU, a first storage medium, an external interface, a first FPGA and a second FPGA, wherein the second FPGA is connected to the external interface and to the CPU and the storage array of the electronic device; a first storage medium for caching user-side data is deployed between the first FPGA and the second FPGA; the MCU is communicated with the first FPGA and the second FPGA respectively; and the electronic device is used to execute the method described in the first aspect.

[0037] It can be seen from the above technical scheme that the present application allocates at least one data transmission channel between the external interface and the second FPGA for each type of user-side data through the MCU deployed in the electronic device, according to the data write rate of N types of user-side data received by the external interface obtained by the second FPGA, so that the second FPGA receives the user-side data of this type transmitted from the external interface through at least one data transmission channel corresponding to the user-side data of this type, temporarily stores the N types of user-side data in the first storage medium, encrypts the user-side data stored in the first storage medium through the first FPGA, and further sends the encrypted user-side data to the storage array of the electronic device through the second FPGA for storage, thereby improving the data transmission rate and the security of data transmission. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] The accompanying drawings, which are incorporated in and constitute a part of the specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0039] Figure 1 A flowchart of a method for securely storing and reading high-speed data based on FPGA provided in an embodiment of the present application;

[0040] Figure 2 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application;

[0041] Figure 3 A schematic diagram of specific connection of electronic equipment components provided in an embodiment of the present application;

[0042] Figure 4 A schematic diagram of a process for dynamically adjusting the first FPGA and the second FPGA resources by the MCU provided in an embodiment of the present application;

[0043] Figure 5 A schematic diagram of a data writing process provided in an embodiment of the present application;

[0044] Figure 6 A schematic diagram of the data reading process provided in an embodiment of the present application. DETAILED DESCRIPTION

[0045] In order to enable those skilled in the art to better understand the technical solutions provided by the embodiments of the present application and to make the above-mentioned purposes, features and advantages of the embodiments of the present application more obvious and understandable, the technical solutions in the embodiments of the present application are further described in detail below in conjunction with the accompanying drawings.

[0046] Please refer to Figure 1 , Figure 1 A flowchart of a method for securely storing and reading high-speed data based on a field programmable gate array (FPGA) provided in an embodiment of the present application, wherein the method is applied to electronic equipment.

[0047] Exemplarily, the electronic device may be a high-speed data acquisition and encryption storage device or a secure data recorder, etc., which is not limited in the present application.

[0048] Below through Figure 2 The structure of the electronic device proposed in this application is briefly described.

[0049] Please refer to Figure 2 , Figure 2 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application.

[0050] like Figure 2 As shown, the electronic device includes a storage array, a micro control unit (MCU: Micro Controller Unit), a first storage medium, an external interface, a first FPGA and a second FPGA.

[0051] In this embodiment, the second FPGA is connected to the external interface and to the storage array; a first storage medium for caching user-side data is deployed between the first FPGA and the second FPGA; and the MCU is respectively communicated with the first FPGA and the second FPGA.

[0052] This concludes Figure 2 Description.

[0053] like Figure 1 As shown, the method specifically includes:

[0054] Step 101: The second FPGA obtains data writing rates of N types of user-side data received by an external interface, and sends the data writing rates of the N types of user-side data to the MCU.

[0055] In this embodiment, the second FPGA may send the acquired data write rates of N types of user-side data received by the external interface to the MCU.

[0056] As an embodiment, the type of the external interface may be a 10 Gigabit network port, SRIO, etc., which is not limited in the present application.

[0057] In this embodiment, there may be many types of user-side data, such as video stream data, high-speed radar data, etc., and this application does not impose any restrictions on this.

[0058] As an embodiment, the method for the second FPGA to obtain the data write rate of N types of user-side data received by the external interface may include the following two cases:

[0059] (1) The second FPGA determines the data writing rate of N types of user-side data received by the external interface according to the counter deployed on the external interface.

[0060] In this embodiment, the second FPGA can perform rate detection on each type of user-side data received by the external interface according to a counter deployed at the external interface to obtain data write rates of N types of user-side data received by the external interface.

[0061] In this case, the second FPGA does not receive a write request, but dynamically monitors the data write rate of the user-side data received by the external interface.

[0062] It should be noted that since there may be multiple different types of data being written at the same time, the second FPGA can count the data writing rates of different types of data, but the second FPGA cannot know the specific types of each data. For example, the second FPGA can obtain the data writing rates of N types of data from the external interface, but the second FPGA can only distinguish that there are N different types of data, but cannot determine the specific types of these N types of data.

[0063] (2) The electronic device also includes a CPU, and the second FPGA determines a data write rate of N types of user-side data received by the external interface according to a data write request sent by the CPU, wherein the data write request carries the data write rate of the N types of user-side data to be written.

[0064] In this embodiment, the data write request may be triggered by the CPU to initiate to the second FPGA according to a user instruction, such as when storing a target file.

[0065] In this embodiment, the CPU can be directly connected to the second FPGA or indirectly connected through a bus interface. The second FPGA can determine the data write rate of N types of user-side data received by the external interface based on the attribute information of the data to be written carried in the data write request sent by the CPU.

[0066] The attribute information may include the size of the data to be written, the data type, the data writing rate, and the data encryption and decryption method, etc., and this application does not impose any restrictions on this.

[0067] In this case, the second FPGA can obtain the data write rates of the N types of user-side data received by the external interface according to the received write request.

[0068] After determining the data write rates of the N types of user-side data received by the external interface through the above method, the second FPGA can send the data write rates of the N types of user-side data to the MCU.

[0069] At this point, the description of step 101 ends, and step 102 is executed next.

[0070] Step 102: For each type of user-side data among the N types of user-side data, the MCU determines at least one data transmission channel between the external interface corresponding to the type of user-side data and the second FPGA according to the data write rate of the type of user-side data.

[0071] In this embodiment, a separate data transmission channel can be allocated for each type of data to avoid data transmission confusion caused by multiple types of data being transmitted through the same data transmission channel. For the same type of data, if its data writing rate is fast, it may be difficult to complete high-speed data writing through one data transmission channel, and multiple data transmission channels can be allocated for the data of this type according to the data writing rate of the data of this type.

[0072] In this embodiment, after receiving the data write rates of N types of user-side data sent by the second FPGA, the MCU can allocate at least one data transmission channel between the external interface and the second FPGA for each type of user-side data according to the data write rate of the type of user-side data.

[0073] As an embodiment, when allocating a data transmission channel corresponding to each type of user-side data, the number of data transmission channels corresponding to the type of user-side data may be positively correlated with the data writing rate of the type of user-side data. That is, the higher the data writing rate of the type of user-side data, the more data transmission channels are allocated to the type of user-side data.

[0074] As an embodiment, when allocating a data transmission channel corresponding to each type of user-side data, only one data transmission channel may be allocated to each type of user-side data, and the data transmission rate supported by the data transmission channel is positively correlated with the data writing rate of the type of user-side data. That is, the higher the data writing rate of the type of user-side data, the greater the data transmission rate supported by the data transmission channel allocated to the type of user-side data.

[0075] In this embodiment, no matter which of the above methods is used to allocate the data transmission channel corresponding to each type of user-side data, it is necessary to meet the condition that the sum of the data writing rates supported by at least one data transmission channel allocated to the user-side data is not less than the data writing rate of the user-side data of this type.

[0076] At this point, the description of step 102 ends, and step 103 is executed next.

[0077] Step 103: For each type of user-side data among the N types of user-side data, the second FPGA receives the type of user-side data through at least one data transmission channel corresponding to the type of user-side data, and forwards the type of user-side data to the first storage medium.

[0078] In this embodiment, the first storage medium may be a double data rate synchronous dynamic random access memory (DDR), or other storage media such as a solid state drive, a flash memory, etc., which is not limited in this application.

[0079] In this embodiment, after receiving each type of user-side data through at least one data transmission channel corresponding to the type of user-side data, the second FPGA may forward the type of user-side data to the first storage medium for temporary storage.

[0080] As an embodiment, the data in the first storage medium is stored in the form of data blocks. After the second FPGA sends the data write rate of N types of user-side data to the MCU, the method may further include:

[0081] For each type of user-side data among the N types of user-side data, the MCU determines, according to a data write rate of the user-side data of the type, a data block size allocated for the user-side data of the type in the first storage medium, and the data block size for storing the user-side data of the type in the first storage medium is positively correlated with the data write rate of the user-side data of the type;

[0082] Forwarding the type of user-side data to the first storage medium may specifically include:

[0083] The user-side data of this type is forwarded to the data block allocated for the user-side data of this type in the first storage medium for storage.

[0084] In this embodiment, the data in the first storage medium may be stored in the form of data blocks, and data blocks of different sizes may be allocated to different types of data to store the user-side data of that type.

[0085] In this embodiment, the size of the data block corresponding to each type of user-side data can also be determined by the MCU according to the data writing rate of the type of user-side data. Exemplarily, the size of the data block corresponding to the type of user-side data is positively correlated with the data writing rate of the type of user-side data.

[0086] At this point, the description of step 103 ends, and step 104 is executed next.

[0087] Step 104: The first FPGA encrypts the N types of user-side data stored in the first storage medium to obtain encrypted user-side data.

[0088] In this embodiment, after each type of user-side data is forwarded to the first storage medium for temporary storage in step 103 , the first FPGA may encrypt the N types of user-side data stored in the first storage medium.

[0089] As an embodiment, before the first FPGA encrypts the user-side data stored in the first storage medium, the MCU may pre-allocate encryption computing resources enabled when encrypting each type of user-side data to the first FPGA.

[0090] Specifically, for each type of user-side data among N types of user-side data, the MCU determines the encryption computing resources provided by the first FPGA for this type of user-side data based on the data write rate of this type of user-side data. The encryption computing resources include the number of computing cores enabled by the first FPGA, and the number of computing cores enabled by the first FPGA is positively correlated with the data write rate of this type of user-side data.

[0091] In this embodiment, the MCU can determine the encryption computing resources provided by the first FPGA for the type of user-side data according to the data write rate of each type of user-side data, such as the number of computing cores required to be enabled to encrypt the type of user-side data. The number of computing cores enabled by the first FPGA can be positively correlated with the data write rate of the type of user-side data, that is, the higher the data write rate of the type of user-side data, the more computing cores enabled by the first FPGA.

[0092] As an embodiment, the first FPGA may further include a security module. The first FPGA encrypts the user-side data stored in the first storage medium. The specific method of obtaining the encrypted user-side data may include:

[0093] For each type of user-side data among the N types of user-side data, if the encryption algorithm used to encrypt the type of user-side data is a symmetric encryption algorithm, the first FPGA obtains the key data stored in the security module, and encrypts the type of user-side data stored in the first storage medium based on the encryption computing resources corresponding to the type of user-side data according to the key data to obtain the encrypted user-side data;

[0094] For each type of user-side data among the N types of user-side data, if the encryption algorithm used to encrypt the type of user-side data is an asymmetric encryption algorithm, the security module encrypts the type of user-side data stored in the first storage medium based on the stored key data and the encryption computing resources corresponding to the type of user-side data to obtain encrypted user-side data.

[0095] In this embodiment, the encryption algorithm for encrypting user-side data is determined according to the type of the user-side data. For user-side data whose encryption algorithm is a symmetric encryption algorithm, the first FPGA can obtain key data from the security module and encrypt this type of user-side data based on the corresponding encryption computing resources according to the key data; for user-side data whose encryption algorithm is an asymmetric encryption algorithm, the security module can encrypt this type of user-side data based on the corresponding encryption computing resources according to the key data stored in itself.

[0096] In this embodiment, the process of encrypting the user-side data according to the key data is a common method in the related art and will not be described in detail here.

[0097] After each type of user-side data is encrypted, encrypted user-side data is obtained.

[0098] As an embodiment, since the data in the first storage medium is stored in the form of data blocks, before the first FPGA encrypts the user-side data stored in the first storage medium, the method may further include:

[0099] For each type of user-side data among the N types of user-side data, the first FPGA detects whether the user-side data of the type forwarded by the second FPGA to the first storage medium reaches a size of a data block allocated for the user-side data of the type;

[0100] If so, the first FPGA encrypts the data block allocated for the type of user-side data stored in the first storage medium.

[0101] In this embodiment, for each type of user-side data among the N types of user-side data, the first FPGA can detect whether the data block size corresponding to the type of user-side data is reached in the first storage medium. If so, it indicates that the type of user-side data has been completely stored in the first storage medium, and the type of user-side data can be encrypted at this time; if not, it indicates that the type of user-side data has not been completely stored in the first storage medium at this time, and it is necessary to wait until the type of user-side data is completely stored in the first storage medium before encrypting the data block.

[0102] At this point, the description of step 104 ends, and step 105 is executed next.

[0103] Step 105 : The second FPGA stores the encrypted user-side data in the storage array, so that the encrypted user-side data stored in the storage array is read by the second FPGA.

[0104] In this embodiment, after the first FPGA completes the step of encrypting each data block in the first storage medium to obtain the encrypted user-side data, the second FPGA can obtain the encrypted user-side data from the first storage medium and store the encrypted user-side data in the storage array to complete the encryption and storage of the user-side data.

[0105] After the encryption and storage of the user-side data are completed, when the encrypted user-side data needs to be read later, the encrypted user-side data stored in the storage array can be read through the second FPGA.

[0106] As an embodiment, when the encrypted user-side data needs to be read, the method further includes:

[0107] The second FPGA receives a data read request sent by the CPU, where the data read request carries data attributes of the user-side data to be read as indicated by the data read request, where the data attributes include data read rates of M types of encrypted user-side data;

[0108] The second FPGA determines the data reading rate of the M types of encrypted user-side data that need to be read according to the data reading request, and sends the data reading rate of the M types of encrypted user-side data to the MCU;

[0109] For each type of encrypted user-side data in the M types of data, the MCU determines at least one data transmission channel between the external interface corresponding to the type of encrypted user-side data and the second FPGA according to the data reading rate of the type of encrypted user-side data, and the sum of the data transmission rates supported by the at least one data transmission channel is not less than the data reading rate of the type of encrypted user-side data;

[0110] The second FPGA forwards the M types of encrypted user-side data to the first storage medium;

[0111] The first FPGA decrypts the M types of encrypted user-side data stored in the first storage medium to obtain M types of target user-side data;

[0112] For each type of target user side data among the M types of target user side data, the second FPGA forwards the type of target user side data obtained from the first storage medium to the external interface through at least one data transmission channel corresponding to the encrypted user side data matching the type of target user side data, so as to complete the reading of the target user side data.

[0113] In this embodiment, the data read request may be triggered by the CPU to send to the second FPGA according to a user instruction, such as when reading a target file. The data read request may carry data attributes of the user-side data to be read as indicated by the data read request.

[0114] As an embodiment, the data attributes may include the read data packet size, data type, data rate, and the decryption algorithm corresponding to the data type, etc., which is not limited in the present application.

[0115] As an embodiment, before the first FPGA decrypts the M types of encrypted user-side data stored in the first storage medium, the method may further include:

[0116] For each type of encrypted user-side data among the M types of encrypted user-side data, the MCU determines the decryption computing resources provided by the first FPGA for the type of encrypted user-side data based on the data reading rate of the type of encrypted user-side data. The decryption computing resources include the number of computing cores enabled by the first FPGA, and the number of computing cores enabled by the first FPGA is positively correlated with the data reading rate of the type of encrypted user-side data.

[0117] In this embodiment, similar to the writing process of writing data according to a write request, the reading process is actually the reverse process of the writing process. The specific reading and writing processes will be described in detail below and will not be repeated here.

[0118] This concludes the description of step 105.

[0119] So far, the end Figure 1 Description of the flowchart of the method for securely storing and reading high-speed data based on FPGA.

[0120] The present application allocates at least one data transmission channel between the external interface and the second FPGA for each type of user-side data through an MCU deployed in an electronic device according to the data write rate of N types of user-side data received by the external interface obtained by the second FPGA, so that the second FPGA receives the user-side data of this type transmitted from the external interface through at least one data transmission channel corresponding to the user-side data of this type, temporarily stores the N types of user-side data in a first storage medium, encrypts the user-side data stored in the first storage medium through the first FPGA, and further sends the encrypted user-side data to the storage array of the electronic device for storage through the second FPGA, thereby improving the data transmission rate and the security of data transmission.

[0121] At the same time, the present application also realizes error detection and correction of data through the error correction unit set in the FPGA, improves the reliability of data storage and transmission, ensures the integrity of the data, and the hardware implementation of FPGA has lower latency than the software implementation, which is suitable for application scenarios that require real-time response.

[0122] It is easy to understand that the method for securely storing and reading high-speed data based on FPGA proposed in this application can reliably encrypt data while transmitting high-speed data to prevent data tampering and leakage, and has broad application prospects in cloud computing and data centers, big data analysis, network security systems, the Internet of Things, and financial service scenarios.

[0123] The method for securely storing and reading high-speed data based on FPGA proposed in this application is described below through a specific embodiment.

[0124] Please refer to Figure 3 , Figure 3 A specific connection diagram of electronic equipment components provided in an embodiment of the present application.

[0125] like Figure 3As shown, the electronic device includes a CPU, a PCIe Switch for realizing connection and communication between multiple PCIe devices, and a storage array. At the same time, this embodiment adds a data security module in the electronic device. Specifically, the data security module includes two FPGAs, which are respectively recorded as a first FPGA and a second FPGA. DDR is deployed between the first FPGA and the second FPGA. In order to distinguish it from the memory DDR of the CPU, the DDR deployed between the first FPGA and the second FPGA is recorded as the first DDR. The first DDR is used to cache user-side data and is connected to the first FPGA and the second FPGA respectively through a high-speed bus. The data security module also includes an MCU, which is connected to the first FPGA and the second FPGA and is used to adjust the resources of the first FPGA and the second FPGA. The second FPGA is connected to an external interface and is used to receive user-side data transmitted by the high-speed interface. At the same time, the second FPGA is connected to the CPU and the storage array through the PCIe Switch. The first FPGA also includes a security module for providing an encryption key.

[0126] As an embodiment, the storage array may be an SSD array, which is not limited in the present application.

[0127] As an embodiment, the FPGA may select a high-performance FPGA chip, and this application does not impose any limitation on this.

[0128] As an embodiment, the newly added first DDR can select a high-speed, high-capacity storage medium, such as DDR3 or DDR4 memory, according to specific application requirements, and the present application does not impose any limitation on this.

[0129] As an embodiment, the high-speed bus may be an AXI or Avalon bus to ensure efficient data transmission, which is not limited in the present application.

[0130] Below Figure 3 The electronic equipment shown is based on the Figure 4 The process of dynamically adjusting the first FPGA and the second FPGA resources by the MCU provided in the embodiment of the present application is briefly described.

[0131] Please refer to Figure 4 , Figure 4 A schematic diagram of the process of dynamically adjusting the first FPGA and the second FPGA resources by the MCU provided in an embodiment of the present application.

[0132] It should be noted that only the data writing process can perform dynamic resource adjustment. During the data reading process, the data volume, rate and other parameters of the read data have been obtained in advance from the read request and do not need to be dynamically adjusted.

[0133] like Figure 4 As shown, after the second FPGA obtains the data write of N types of user-side data received by the external interface, the MCU configures the resources of the first FPGA and the second FPGA according to the data write of the N types of user-side data.

[0134] The configuration of the first FPGA includes: the MCU determines the encryption computing resources provided by the first FPGA for the user-side data according to the data writing rate of N types of user-side data, and the encryption computing resources include the number of computing cores enabled by the first FPGA.

[0135] The configuration of the second FPGA includes: the MCU determines at least N data transmission channels between the external interface and the second FPGA for N types of data according to the data write rates of the N types of data, so that the second FPGA receives user-side data through at least N data transmission channels.

[0136] At the same time, the MCU can also configure the data block size in the first DDR. The MCU determines the size of the data block corresponding to each type of data in the first DDR according to the data write rate of each type of data among the N types of data. The size of the data block is positively correlated with the data write rate of this type of data.

[0137] After completing the resource configuration, the data encryption process is performed. During this process, the MCU can continuously monitor the resources of the first FPGA and the second FPGA, and dynamically adjust the resources of the first FPGA and the second FPGA when it is determined that the resources need to be adjusted.

[0138] This concludes Figure 4 Description of the resource dynamic adjustment process diagram.

[0139] Combine the following Figure 5 Provide an overall description of the data writing process.

[0140] Please refer to Figure 5 , Figure 5 A schematic diagram of the data writing process provided in an embodiment of the present application.

[0141] like Figure 5 As shown, after receiving the user-side data through the external interface, the second FPGA caches it in the first DDR.

[0142] At this time, the first FPGA can detect whether the data written into the first DDR reaches the size of the data block corresponding to the type of data. If so, the data block is encrypted according to the encryption method; if not, the second FPGA continues to receive data from the external interface.

[0143] After it is determined that the encryption is completed, the encrypted user-side data is written into the storage array SSD through the second FPGA, completing the encryption and storage process of the user-side data, that is, the writing process of the user-side data.

[0144] This concludes Figure 5 Description of the data writing process in .

[0145] Combine the following Figure 6 Describe the data reading process.

[0146] Please refer to Figure 6 , Figure 6 A schematic diagram of the data reading process provided in an embodiment of the present application.

[0147] like Figure 6 As shown, after the second FPGA obtains the data from the storage array SSD, it caches the data in the first DDR.

[0148] At this time, the first FPGA can detect whether the data stored in the first DDR reaches the size of the data block corresponding to this type of data. If so, the data block is decrypted according to the encryption method corresponding to this type of data; if not, the second FPGA continues to obtain data from the storage array SSD.

[0149] After determining that the decryption is completed, the second FPGA sends the decrypted user-side data through the external interface, completing the decryption and reading process of the user-side data.

[0150] This concludes Figure 6 Description of the data reading process in .

[0151] This concludes the description of this embodiment.

[0152] The above are only preferred embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the scope of protection of the present application.

Claims

1. A method for securely storing and reading high-speed data based on FPGA, characterized in that: The method is applied to an electronic device, the electronic device comprising a storage array, a microcontroller unit MCU, a first storage medium, an external interface, a first FPGA and a second FPGA; the method comprises: The second FPGA acquires data write rates of N types of user-side data received by the external interface, and sends the data write rates of the N types of user-side data to the MCU; For each type of user-side data in the N types of user-side data, the MCU determines, according to the data write rate of the type of user-side data, at least one data transmission channel between the external interface and the second FPGA corresponding to the type of user-side data, and the sum of the data write rates supported by the at least one data transmission channel is not less than the data write rate of the type of user-side data; For each type of user-side data among the N types of user-side data, the second FPGA receives the type of user-side data through at least one data transmission channel corresponding to the type of user-side data, and forwards the type of user-side data to the first storage medium; The first FPGA encrypts N types of user-side data stored in the first storage medium to obtain encrypted user-side data; The second FPGA stores the encrypted user-side data in the storage array, so that the encrypted user-side data stored in the storage array is read through the second FPGA.

2. The method according to claim 1, characterized in that The second FPGA is connected to the external interface and to the storage array; a first storage medium for caching user-side data is deployed between the first FPGA and the second FPGA; and the MCU is respectively connected to the first FPGA and the second FPGA for communication.

3. The method according to claim 1, characterized in that The method for the second FPGA to obtain the data writing rate of N types of user-side data received by the external interface includes: The second FPGA determines, according to a counter deployed on the external interface, a data write rate of N types of user-side data received by the external interface; Alternatively, the electronic device also includes a CPU, and the second FPGA determines the data write rate of N types of user-side data received by the external interface based on the data write request sent by the CPU, and the data write request carries the data write rate of the N types of user-side data to be written.

4. The method according to claim 1, characterized in that: Before the first FPGA encrypts the user-side data stored in the first storage medium, the method further includes: For each type of user-side data among N types of user-side data, the MCU determines the encryption computing resources provided by the first FPGA for this type of user-side data based on the data write rate of this type of user-side data, and the encryption computing resources include the number of computing cores enabled by the first FPGA, and the number of computing cores enabled by the first FPGA is positively correlated with the data write rate of this type of user-side data.

5. The method according to claim 4, characterized in that The first FPGA further includes a security module, and the first FPGA encrypts the user-side data stored in the first storage medium to obtain the encrypted user-side data, including: For each type of user-side data among the N types of user-side data, if the encryption algorithm used to encrypt the type of user-side data is a symmetric encryption algorithm, the first FPGA obtains the key data stored in the security module, and encrypts the type of user-side data stored in the first storage medium according to the key data based on the encryption computing resources corresponding to the type of user-side data, to obtain encrypted user-side data; For each type of user-side data among the N types of user-side data, if the encryption algorithm used to encrypt the type of user-side data is an asymmetric encryption algorithm, the security module encrypts the type of user-side data stored in the first storage medium based on the stored key data and the encryption computing resources corresponding to the type of user-side data to obtain encrypted user-side data.

6. The method according to claim 1, characterized in that The data in the first storage medium is stored in the form of data blocks. After the second FPGA sends the data write rate of the N types of user-side data to the MCU, the method further includes: For each type of user-side data among the N types of user-side data, the MCU determines the data block size allocated to the type of user-side data in the first storage medium according to the data write rate of the type of user-side data, and the data block size used to store the type of user-side data in the first storage medium is positively correlated with the data write rate of the type of user-side data; The forwarding of the type of user-side data to the first storage medium includes: The user-side data of this type is forwarded to the data block allocated for the user-side data of this type in the first storage medium for storage.

7. The method according to claim 6, characterized in that Before the first FPGA encrypts the user-side data stored in the first storage medium, the method further includes: For each type of user-side data among the N types of user-side data, the first FPGA detects whether the user-side data of the type forwarded by the second FPGA to the first storage medium reaches a size of a data block allocated for the user-side data of the type; If so, the first FPGA encrypts the data block allocated for this type of user-side data and stored in the first storage medium.

8. The method according to claim 1, characterized in that: The electronic device further includes a CPU, and the reading of the encrypted user-side data stored in the storage array through the second FPGA includes: The second FPGA receives a data read request sent by the CPU, wherein the data read request carries data attributes of the user-side data to be read as indicated by the data read request, and the data attributes include data read rates of M types of encrypted user-side data; The second FPGA determines the data reading rates of the M types of encrypted user-side data to be read according to the data reading request, and sends the data reading rates of the M types of encrypted user-side data to the MCU; For each type of encrypted user-side data in the M types of data, the MCU determines, according to the data reading rate of the encrypted user-side data of the type, at least one data transmission channel between the external interface and the second FPGA corresponding to the encrypted user-side data of the type, and the sum of the data transmission rates supported by the at least one data transmission channel is not less than the data reading rate of the encrypted user-side data of the type; The second FPGA forwards the M types of encrypted user-side data to the first storage medium; The first FPGA decrypts the M types of encrypted user-side data stored in the first storage medium to obtain M types of target user-side data; For each type of target user side data among the M types of target user side data, the second FPGA forwards the target user side data of this type obtained from the first storage medium to the external interface through at least one data transmission channel corresponding to the encrypted user side data matching the target user side data of this type, so as to complete the reading of the target user side data.

9. The method according to claim 8, characterized in that Before the first FPGA decrypts the M types of encrypted user-side data stored in the first storage medium, the method further includes: For each type of encrypted user-side data among the M types of encrypted user-side data, the MCU determines the decryption computing resources provided by the first FPGA for the type of encrypted user-side data according to the data reading rate of the type of encrypted user-side data, and the decryption computing resources include the number of computing cores enabled by the first FPGA, and the number of computing cores enabled by the first FPGA is positively correlated with the data reading rate of the type of encrypted user-side data.

10. An electronic device, characterized in that: The electronic device includes a storage array, a microcontroller unit MCU, a first storage medium, an external interface, a first FPGA and a second FPGA, wherein the second FPGA is connected to the external interface and to the storage array; a first storage medium for caching user-side data is deployed between the first FPGA and the second FPGA; the MCU is respectively communicated with the first FPGA and the second FPGA; and the electronic device is used to execute the method as described in any one of claims 1 to 9.

Images