Message processing method, system and device

Abstract

The invention discloses a message processing method, system and device, and relates to the field of data processing and the technical field of communication. The method comprises the following steps: under the condition that a target message is received, detecting whether target negotiation data corresponding to message metadata carried by the target message is stored in a target cache or not through a data reading controller; when it is detected that the target negotiation data is stored in the target cache, sending the message metadata and the target negotiation data to a scheduling controller; sending the message metadata and the target negotiation data to any one of the N processing engines in an idle state through the scheduling controller; and processing the target message through the processing engine in the idle state according to the message metadata and the target negotiation data. According to the message processing method and device, the technical problem that in the prior art, when an IPSec message is processed through SA data, the message processing speed is low due to the fact that a large amount of SA data needs to be read from a memory is solved.

Description

Technical Field

[0001] The present application relates to the fields of data processing and communication technology, and in particular to a message processing method, system and device. Background Art

[0002] IPSec (Internet Protocol Security) is a set of communication rules or protocols for establishing secure connections on a network. The Internet Protocol is a universal standard that determines how data is transmitted over the Internet. IPSec builds on this by incorporating encryption and authentication to make this protocol more secure. IPSec uses asymmetric and symmetric encryption to provide speed and security during data transmission. In asymmetric encryption, the encryption key is public, while the decryption key is kept secret. Symmetric encryption uses the same public key to encrypt and decrypt data. IPSec establishes a secure connection through asymmetric encryption, then switches to symmetric encryption to speed up data transmission.

[0003] First, to use IPsec security services, a security association (SA) must be created between the communicating parties. SA data is a set of IPSec specifications negotiated between devices that establish an IPSec relationship. These specifications include preferences for authentication, encryption, and IPSec protocol types that should be used when establishing an IPSec connection. Since symmetric encryption and authentication are both computationally complex tasks, their performance is generally low if implemented in software based on a general-purpose CPU. Therefore, it is a common choice to use hardware acceleration chips or devices to share the pressure on the CPU.

[0004] However, an SA data must at least define an encryption algorithm and key, and an authentication algorithm and key. Mainstream symmetric encryption algorithms and authentication algorithms generally use 256-bit keys, so a one-way SA data requires 64 bytes to store only the key part. On this basis, since each message must be processed to read its corresponding SA data, when a device supports tens of thousands of SA data at the same time, the SA data itself puts a lot of pressure on the bandwidth of the memory, which in turn affects the speed of message processing.

[0005] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0006] The embodiments of the present application provide a message processing method, system and device to at least solve the technical problem in the prior art that when using SA data to process IPSec messages, the message processing speed is slow because a large amount of SA data needs to be read from the memory.

[0007] According to one aspect of an embodiment of the present application, a message processing method is provided, comprising: when a target message is received, detecting through a data reading controller whether target negotiation data corresponding to message metadata carried by the target message is stored in a target cache, wherein the target cache is used to cache negotiation data being used in a communication system, and the negotiation data represents data encryption protocol information negotiated and used by both parties in communication; when it is detected that the target negotiation data is stored in the target cache, sending the message metadata and the target negotiation data to a scheduling controller; sending the message metadata and the target negotiation data to any one of N processing engines in an idle state through the scheduling controller, wherein N is an integer greater than 1, and the N processing engines are used to process multiple messages in a parallel processing manner; processing the target message according to the message metadata and the target negotiation data through the processing engine in an idle state.

[0008] Optionally, after detecting through a data reading controller whether the target cache stores target negotiation data corresponding to the message metadata carried by the target message, the message processing method also includes: when it is detected that the target negotiation data is not stored in the target cache, sending the message metadata to any one of the M negotiation data receiving stations that is in an idle state, wherein M is an integer greater than 1, and the negotiation data receiving station is used to read the negotiation data in the target memory; reading the target negotiation data corresponding to the message metadata from the target memory through the negotiation data receiving station that is in an idle state, and sending the target negotiation data and the message metadata to the scheduling controller, and storing the target negotiation data in the target cache.

[0009] Optionally, the target cache includes multiple storage units, each of the multiple storage units is used to store a complete negotiation data, and the message processing method also includes: when the data reading controller receives the message metadata of the target message and detects that the target negotiation data of the target message is stored in the i-th storage unit, the counter of the i-th storage unit is incremented by one, wherein the increment operation represents the addition of a new message that needs to be processed using the target negotiation data in the i-th storage unit, and the i-th storage unit is any one of the multiple storage units; after detecting that the target message has been processed by any processing engine, the counter of the i-th storage unit is decremented by one, wherein the decrement operation represents the reduction of one message that needs to be processed using the target negotiation data in the i-th storage unit.

[0010] Optionally, the message processing method also includes: when it is detected that the current count of the counter of the i-th storage unit is 0, determining that there is no message in the communication system that needs to be processed using the target negotiation data in the i-th storage unit; performing a recycling operation on the i-th storage unit, wherein the recycling operation is used to control the i-th storage unit to delete the target negotiation data and allow storage of other negotiation data except the target negotiation data.

[0011] Optionally, the message metadata and target negotiation data are sent to any one of N processing engines that is in an idle state through a scheduling controller, including: determining a result cache area that is in an idle state as a first cache area from multiple result cache areas, wherein the result cache area is used to store metadata generated after each message is processed; obtaining a message identifier of the target message and an area identifier of the first cache area; forming a queue element with the message identifier and the area identifier; adding the queue element to an order-preserving queue corresponding to the target negotiation data, wherein the time when the j-th queue element in the order-preserving queue enters the order-preserving queue is earlier than the time when the j+1-th queue element enters the order-preserving queue, and j is an integer greater than or equal to 1; sending the queue element composed of the message identifier and the area identifier, the message metadata, and the target negotiation data to any one of the N processing engines that is in an idle state.

[0012] Optionally, after sending the queue element consisting of the message identifier and the area identifier, the message metadata and the target negotiation data to any one of the N processing engines that is in an idle state, the message processing method also includes: in the process of controlling the processing engine in the idle state to process the target message according to the message metadata and the target negotiation data, obtaining the target metadata generated by the target message during the processing process, wherein the target metadata is used to describe the processing result of the target message; writing the target metadata into the first cache area, and marking the state of the first cache area as the target state, wherein the target state indicates that the target message has been processed.

[0013] Optionally, the message processing method also includes: detecting whether the result cache area corresponding to the area identifier in the first queue element in the order-preserving queue is marked as a target state; when it is detected that the result cache area corresponding to the area identifier in the first queue element is marked as a target state, outputting the processing result of the message corresponding to the first queue element, and deleting the first queue element from the order-preserving queue; when it is detected that the result cache area corresponding to the area identifier in the first queue element is not marked as a target state, prohibiting the output of the processing result of the message corresponding to any queue element in the order-preserving queue.

[0014] According to another aspect of the present application, a message processing system is also provided, which includes: a target cache, used to cache negotiation data being used in a communication system, wherein the negotiation data represents data security information negotiated and used by the communicating parties; a data reading controller, used to detect whether the target negotiation data corresponding to the message metadata carried by the target message is stored in the target cache when the target message is received; when it is detected that the target negotiation data exists in the target cache, the message metadata and the target negotiation data are sent to a scheduling controller; a scheduling controller, used to send the message metadata and the target negotiation data to any one of N processing engines that is in an idle state, wherein N is an integer greater than 1, and the N processing engines are used to process multiple messages in parallel; N processing engines, wherein an idle processing engine among the N processing engines is used to process the target message based on the message metadata and the target negotiation data.

[0015] Optionally, the message processing system also includes: M negotiation data receiving stations, each of which is used to read the negotiation data in the target memory, where M is an integer greater than 1; a data reading controller, which is also used to send the message metadata to any one of the M negotiation data receiving stations that is in an idle state when it is detected that the target negotiation data does not exist in the target cache; the idle negotiation data receiving station is used to read the target negotiation data corresponding to the message metadata from the target memory, and send the target negotiation data and the message metadata to the scheduling controller, and store the target negotiation data in the target cache.

[0016] According to another aspect of the present application, a message processing device is also provided, which includes: a detection unit, which is used to detect, through a data reading controller, whether target negotiation data corresponding to the message metadata carried by the target message is stored in the target cache when a target message is received, wherein the target cache is used to cache the negotiation data being used in the communication system, and the negotiation data represents the data encryption protocol information negotiated and used by the communicating parties; a first processing unit, which is used to send the message metadata and the target negotiation data to a scheduling controller when it is detected that the target negotiation data is stored in the target cache; a second processing unit, which is used to send the message metadata and the target negotiation data to any one of N processing engines in an idle state through the scheduling controller, wherein N is an integer greater than 1, and the N processing engines are used to process multiple messages in parallel processing; and a third processing unit, which is used to process the target message according to the message metadata and the target negotiation data through a processing engine in an idle state.

[0017] In the present application, first, when a target message is received, a data reading controller is used to detect whether target negotiation data corresponding to the message metadata carried by the target message is stored in the target cache, wherein the target cache is used to cache the negotiation data being used in the communication system, and the negotiation data represents the data encryption protocol information negotiated and used by the two communicating parties. Then, when it is detected that the target negotiation data has been stored in the target cache, the message metadata and the target negotiation data are sent to the scheduling controller, and then the scheduling controller sends the message metadata and the target negotiation data to any one of the N processing engines in an idle state, wherein N is an integer greater than 1, and the N processing engines are used to process multiple messages in a distributed data processing manner. Finally, the target message is processed by the processing engine in an idle state according to the message metadata and the target negotiation data.

[0018] As can be seen from the above content, according to the technical solution of the present application, in the process of processing a message, each time the data reading controller reads a message metadata, it first detects whether the target negotiation data (such as SA data) corresponding to the message metadata is stored in the target cache. If the target negotiation data corresponding to the message metadata is stored in the target cache, the message metadata and the target negotiation data are directly sent to the scheduling controller, instead of the need to read the corresponding SA data in the memory (for example, DDR memory, the full name of DDR is Double Data Rate Synchronous Dynamic Random Access Memory, i.e., double rate synchronous dynamic random access memory) each time a message metadata is read as in the prior art, thereby achieving the purpose of using the local cache to hide the high latency of DDR memory reading, effectively improving the bandwidth utilization of DDR memory, and avoiding the problem of long data processing delay time. Especially when processing messages on a large scale, using the technical solution of the present application, a considerable proportion of the message metadata can be directly read from the target cache for SA data, and no longer querying SA data with the DDR memory, thereby achieving the technical effect of improving the overall message processing efficiency.

[0019] In addition, the present application also adopts a design method in which N processing engines process multiple messages in parallel. Compared with the method of using a single processing engine to process all messages, the technical solution of the present application can further improve the processing efficiency of the messages.

[0020] It can be seen that according to the technical solution of the present application, by using local cache to query SA data and using multiple processing engines to process multiple messages in parallel, the high latency problem of DDR memory reading SA data is avoided, the message processing efficiency is improved and the memory bandwidth pressure is reduced, thereby solving the technical problem of slow message processing speed caused by the need to read a large amount of SA data from the memory when using SA data to process IPSec messages in the prior art. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0022] Figure 1 is a flowchart of an optional message processing method according to an embodiment of the present application;

[0023] Figure 2 is a schematic diagram of an optional multi-processing engine processing messages in parallel according to an embodiment of the present application;

[0024] Figure 3 is a schematic diagram of a message processing system according to an embodiment of the present application;

[0025] Figure 4 It is a flowchart of an optional message processing device according to an embodiment of the present application. DETAILED DESCRIPTION

[0026] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0027] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0028] It should also be noted that the information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) collected by this application are information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of relevant data are in compliance with the relevant laws, regulations and standards of the relevant regions, necessary confidentiality measures are taken, and public order and good customs are not violated, and corresponding operation portals are provided for users to choose to authorize or refuse. For example, an interface is set up between this system and relevant users or organizations. Before obtaining relevant information, it is necessary to send an acquisition request to the aforementioned user or organization through the interface, and obtain relevant information after receiving the consent information fed back by the aforementioned user or organization.

[0029] In an optional embodiment, a message processing system can be used as the execution subject of the message processing method in the embodiment of the present application, wherein the message processing system can be a software system or an embedded system combining software and hardware. Of course, in addition to using the message processing system as the execution subject, other forms of devices and equipment can also be used as the execution subject of the message processing method in the embodiment of the present application, and the present application does not specifically limit the specific type of the execution subject.

[0030] For the convenience of description, the technical solution of the embodiment of the present application is explained below using the message processing system as the execution entity.

[0031] According to an embodiment of the present application, an embodiment of a message processing method is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0032] Figure 1is a flowchart of an optional message processing method according to an embodiment of the present application, such as Figure 1 As shown, the method comprises the following steps:

[0033] Step S101: when a target message is received, a data reading controller is used to detect whether target negotiation data corresponding to message metadata carried by the target message is stored in a target cache.

[0034] In step S101, the target cache is used to cache negotiation data currently being used in the communication system, where the negotiation data represents data encryption protocol information negotiated and used by both communicating parties.

[0035] Optionally, the above-mentioned negotiation data can be SA data, wherein SA data includes two parts, one part is static configuration data, such as algorithm keys, etc.; the other part is dynamic data, such as anti-replay counters, etc. Static data is read-only and does not need to be written back to SA memory; dynamic data needs to be written back, and can only be written back after the message is successfully processed. For example, attack messages intercepted by the anti-replay mechanism cannot trigger updates and write-backs.

[0036] Here, SA data is data determined by both parties of IPsec communication through a negotiation process when establishing a secure connection.

[0037] Optionally, the negotiation data may also be other data negotiated by the communicating parties except the SA data, for example, data such as the port number, connection duration, connection time, verification password, etc. agreed upon by the communicating parties.

[0038] In the case where the negotiation data is SA data, the data reading controller may be an SA reading controller for reading message metadata. In addition, the SA reading controller is also connected to an SA cache (corresponding to the target cache), wherein the SA cache is used to cache the SA data being used in the communication system, and the SA cache is a local high-speed cache.

[0039] Optionally, when the message processing system needs to process a message, it first reads the message metadata of the message to be processed from the message request queue through the SA read controller, and then detects whether the target SA data corresponding to the message metadata (corresponding to the above-mentioned target negotiation data) is stored in the SA cache, instead of directly querying the target SA data corresponding to the message metadata in the memory. This design can reduce the number of memory reads and reduce the bandwidth pressure of the memory.

[0040] It should be noted that message metadata refers to additional information related to the message itself in network communications. This information is used to describe the attributes, characteristics, status or context of the message to facilitate identification, classification, processing and routing during network transmission and processing. The purpose of message metadata is to improve communication efficiency, security and reliability.

[0041] Message metadata mainly includes the following information:

[0042] 1. Message identification: used to uniquely identify a message, usually including message ID, sequence number and other information.

[0043] 2. Sender and receiver information, such as the sender and receiver's addresses, port numbers, etc., used to determine the source and destination of the message.

[0044] 3. Message type: describes the content and format of the message, for example, whether it is a control message, data message, request message or response message.

[0045] 4. Message size: refers to the length or number of bytes of the message, which is used to determine the transmission and processing time of the message.

[0046] 5. Timestamp: records the sending and receiving time of the message, which is used to calculate delay and synchronization.

[0047] 6. Priority: It is used to determine the priority of the message so that high-priority messages can be processed first when the network is congested.

[0048] 7. Security information: For example, including encryption, authentication and authorization information, used to protect the security and integrity of the message.

[0049] 8. Routing information: describes the routing path and next-hop address of the message, and is used to guide the transmission of the message in the network.

[0050] 9. Status and error information: used to record the message transmission status, error code, etc., for fault diagnosis and processing.

[0051] Message metadata is used in all layers of the network protocol stack, such as the physical layer, link layer, network layer, transport layer, and application layer. By using message metadata properly, the efficiency and reliability of network communication can be improved.

[0052] Optionally, the message metadata includes, but is not limited to, the source IP, destination IP, protocol number (indicating the network layer protocol used by the message, for example, AH (protocol number 51) or ESP (protocol number 50) may be used in the IPSec protocol), SPI (Security Parameters Index), and other information carried in the header of the target message. The SPI is a unique identifier of the SA and is used to distinguish different SAs. For example, the message processing system can search for SA data from the target cache or target memory based on the SPI in the message metadata.

[0053] Step S102: When it is detected that the target negotiation data has been stored in the target cache, the message metadata and the target negotiation data are sent to the scheduling controller.

[0054] Optionally, if the SA read controller detects that the target SA data corresponding to the message metadata has been stored in the SA cache, the SA read controller will directly forward the message metadata and the target SA data to the scheduling controller, wherein the scheduling controller is used to send the message metadata and the target SA data of the target message to the processing engine, wherein the processing engine is used to perform encryption and decryption, identity authentication and other processing on the target message based on the message metadata and the target SA data of the target message.

[0055] Step S103: Send the message metadata and the target negotiation data to any one of the N processing engines that is in an idle state through the scheduling controller.

[0056] In step S103, N is an integer greater than 1, and the N processing engines are used to process multiple messages in a parallel processing manner.

[0057] Optionally, in the present application, N processing engines are provided for processing multiple messages in a parallel processing manner. For example, one processing engine can process one message in real time, and N processing engines can process N messages simultaneously.

[0058] It should be noted that in order to maximize the working efficiency of the N processing engines and improve the processing efficiency of messages, after receiving the message metadata and target SA data of the target message, the scheduling controller first determines the working status of each processing engine in the N processing engines (for example, the working status of each processing engine can be obtained based on the heartbeat data that each processing engine periodically reports to the scheduling controller), and then determines an idle processing engine from the N processing engines as the processing engine for processing the target message. In this way, the processing of the target message can enter the processing flow as quickly as possible without waiting.

[0059] It should also be noted that if all N processing engines are in working state, the scheduling controller will select the processing engine that switches from working state to idle state earliest as the processing engine for processing the target message.

[0060] Step S104: Process the target message according to the message metadata and the target negotiation data by the processing engine in the idle state.

[0061] The target message is a message associated with the message metadata.

[0062] Optionally, after receiving the message metadata and target SA data of the target message, the processing engine in the idle state may use the message metadata and the target SA data to perform encryption, decryption, identity authentication and other processing on the target message.

[0063] Based on the contents of the above steps S101 to S104, it can be known that in the present application, first, when the target message is received, the target cache is detected by the data reading controller whether the target negotiation data corresponding to the message metadata carried by the target message is stored, wherein the target cache is used to cache the negotiation data being used in the communication system, and the negotiation data represents the data encryption protocol information negotiated and used by the two communicating parties. Then, when it is detected that the target negotiation data has been stored in the target cache, the message metadata and the target negotiation data are sent to the scheduling controller, and then the scheduling controller sends the message metadata and the target negotiation data to any one of the N processing engines in an idle state, wherein N is an integer greater than 1, and the N processing engines are used to process multiple messages in a parallel processing manner. Finally, the target message is processed by the processing engine in an idle state according to the message metadata and the target negotiation data.

[0064] It can be seen from the above content that according to the technical solution of the present application, in the process of processing messages, each time the data reading controller reads a message metadata, it first detects whether the target negotiation data (such as SA data) corresponding to the message metadata is stored in the target cache. If the target negotiation data corresponding to the message metadata is stored in the target cache, the message metadata and the target negotiation data are directly sent to the scheduling controller, instead of reading the corresponding SA data in the DDR memory each time a message metadata is read as in the prior art, thereby achieving the purpose of using the local cache to hide the high latency of DDR memory reading, effectively improving the bandwidth utilization of the DDR memory, and avoiding the problem of long data processing delay time. Especially when processing messages on a large scale, using the technical solution of the present application, a considerable proportion of the message metadata can be directly read from the target cache as SA data, and no longer querying the DDR memory for SA data, thereby achieving the technical effect of improving the overall message processing efficiency.

[0065] In addition, the present application also adopts a design method in which N processing engines process multiple messages in parallel. Compared with the method of using one processing engine to process all messages, the technical solution of the present application can further improve the processing efficiency of the messages.

[0066] It can be seen that according to the technical solution of the present application, by using local cache to query SA data and using multiple processing engines to process multiple messages in parallel, the high latency problem of DDR memory reading SA data is avoided, the message processing efficiency is improved and the memory bandwidth pressure is reduced, thereby solving the technical problem of slow message processing speed caused by the need to read a large amount of SA data from the memory when using SA data to process IPSec messages in the prior art.

[0067] In an optional embodiment, after detecting through a data reading controller whether the target cache stores target negotiation data corresponding to the message metadata carried by the target message, the message processing method also includes: when it is detected that the target negotiation data is not stored in the target cache, sending the message metadata to any one of the M negotiation data receiving stations that is in an idle state, wherein M is an integer greater than 1, and the negotiation data receiving station is used to read the negotiation data in the target memory; reading the target negotiation data corresponding to the message metadata from the target memory through the negotiation data receiving station that is in an idle state, and sending the target negotiation data and the message metadata to the scheduling controller, and storing the target negotiation data in the target cache.

[0068] Optionally, if the scheduling controller fails to find the target SA data corresponding to the message metadata in the SA cache after reading the message metadata of the target message, the scheduling controller will send the message metadata to any idle SA receiving station among the M SA receiving stations (corresponding to the above-mentioned negotiation data receiving station, referred to as rcv_m for short). If there is no idle SA receiving station at this time, the message metadata will remain in the SA reading controller until an idle SA receiving station appears.

[0069] It should be noted that the SA receiving station is used to initiate an SA data read request to the SA memory (generally a DDR memory with higher latency, corresponding to the target memory mentioned above), wherein the SA memory stores the full amount of SA data. If the message metadata of the target message enters the SA receiving station, the SA receiving station will initiate an SA data read request for the target message to the SA memory. After the SA memory returns the target SA data corresponding to the target message to the SA receiving station, the SA receiving station will send the message metadata and target SA data of the target message to the scheduling controller on the one hand; on the other hand, the SA receiving station will also cache the target SA data in the SA cache, so that when the target SA data is used later, it can be directly queried from the SA cache without accessing the SA memory again, thereby minimizing the number of accesses to the SA memory and reducing the bandwidth pressure of the SA memory.

[0070] It should also be noted that the design of M SA receiving stations can also improve the efficiency of reading SA data. This design can satisfy the simultaneous query of SA data by M SA receiving stations to the SA memory, that is, at most M SA data can be queried from the SA memory at the same time.

[0071] In an optional embodiment, the target cache includes multiple storage units, each of the multiple storage units is used to store a complete negotiation data, and the message processing method also includes: when the data reading controller receives the message metadata of the target message and detects that the target negotiation data of the target message is stored in the i-th storage unit, the counter of the i-th storage unit is incremented by one, wherein the increment operation represents the addition of a new message that needs to be processed using the target negotiation data in the i-th storage unit, and the i-th storage unit is any one of the multiple storage units; after detecting that the target message is processed by any processing engine, the counter of the i-th storage unit is decremented by one, wherein the decrement operation represents the reduction of one message that needs to be processed using the target negotiation data in the i-th storage unit.

[0072] Optionally, the SA cache in the embodiment of the present application (corresponding to the target cache described above) is a specially designed cache, wherein the SA cache in the embodiment of the present application includes multiple storage units, for example, K storage units, where K is an integer greater than 1. Each storage unit is used to store a complete SA data, that is, K storage units store K SA data correspondingly.

[0073] Optionally, since the dynamic data in the SA cache needs to be updated and written back after the message is processed, in an embodiment of the present application, a counter (reference counter, refcnt for short) is set for each storage unit to track the status of the storage unit.

[0074] Optionally, after the SA reading controller receives the message metadata of a target message (message to be processed), if the target SA data of the target message is stored in the i-th storage unit, the counter of the i-th storage unit is incremented by one, indicating that a new message that needs to be processed using the target SA data in the i-th storage unit is added. Further, after the subsequent processing engine completes processing of the target message based on the target SA data in the i-th storage unit, the counter of the i-th storage unit is decremented by one, indicating that a message that needs to be processed using the target SA data in the i-th storage unit is reduced.

[0075] In an optional embodiment, when it is detected that the current count of the counter of the i-th storage unit is 0, it is determined that there is no message in the communication system that needs to be processed using the target negotiation data in the i-th storage unit; a recycling operation is performed on the i-th storage unit, wherein the recycling operation is used to control the i-th storage unit to delete the target negotiation data and allow storage of other negotiation data except the target negotiation data.

[0076] Optionally, if the current count of the counter of a storage unit is 0, it means that there is no message in the communication system that needs to be processed using the SA data in the storage unit. In order to maximize the utilization rate of the storage unit, the storage unit is recycled and the SA data currently stored in the storage unit is deleted, thereby realizing the timely release of the storage resources of the storage unit. After the storage resources are released, the storage unit can be used to store new SA data.

[0077] In an optional embodiment, the message metadata and target negotiation data are sent to any one of N processing engines that is in an idle state through a scheduling controller, including: determining a result cache area that is in an idle state from multiple result cache areas as a first cache area, wherein the result cache area is used to store metadata generated after each message is processed; obtaining a message identifier of the target message and an area identifier of the first cache area; forming a queue element with the message identifier and the area identifier; adding the queue element to an order-preserving queue corresponding to the target negotiation data, wherein the time when the jth queue element in the order-preserving queue enters the order-preserving queue is earlier than the time when the j+1th queue element enters the order-preserving queue, and j is an integer greater than or equal to 1; sending the queue element composed of the message identifier and the area identifier, the message metadata, and the target negotiation data to any one of the N processing engines that is in an idle state.

[0078] Optionally, for IPSec devices, such as IPSec acceleration devices (a device specifically designed to increase the speed of IPSec message processing), a very important requirement is the order preservation of messages, that is, the order in which messages belonging to the same SA data leave the device must be consistent with the order in which they enter the device (which can be understood as the first-in-first-out principle of message processing). However, messages belonging to the same SA data often have burst characteristics, that is, in a very short period of time, the device may receive several consecutive messages belonging to the same SA. Therefore, how to improve the bandwidth utilization efficiency of IPSec message processing and reduce message processing delays while ensuring order preservation is an important issue that hardware acceleration devices need to solve.

[0079] first, Figure 2 is a schematic diagram of an optional multi-processing engine processing messages in parallel according to an embodiment of the present application, such as Figure 2 As shown, the scheduling controller is connected to the processing engine array, wherein the processing engine array is composed of N processing engines, and the N processing engines can process multiple messages in parallel. Each processing engine can use SA data to perform encryption and decryption, identity authentication, anti-replay, message encapsulation, decapsulation and other processing on the message. The N processing engines are independent of each other and work in parallel.

[0080] Alternatively, if Figure 2 As shown, the scheduling controller is also connected to multiple result buffers (corresponding to the above-mentioned result cache area), wherein each result buffer is used to store metadata generated by the processing engine after processing each message, and the metadata is used to describe the relevant attributes of the message processing result.

[0081] Optionally, when the collaborative processing engine processes a message (assuming it is a target message), the scheduling controller first determines any idle buffer from multiple result buffers as the first cache area. If there is no idle buffer at present, the buffer will be selected as the first cache area after an idle buffer appears. The scheduling controller obtains the message id (i.e., message identifier) ​​of the target message and the buffer id (i.e., area identifier) ​​of the first cache area, and then combines the message id of the target message and the buffer id of the first cache area into a queue element, and adds the queue element to the order-preserving queue of the target SA data corresponding to the target message. It should be noted that since a message must belong to one SA data, the order-preserving queue corresponding to the target message can be determined by judging the ID of the target SA data of the target message. Among them, the order-preserving queue is Figure 2In the reordering queue, since there may be multiple SA data, each SA data has a corresponding separate order-preserving queue, so the number of order-preserving queues may also be multiple, thus forming a "reordering queue array".

[0082] It should also be noted that the time when the j-th queue element in an order-preserving queue enters the order-preserving queue is earlier than the time when the j+1-th queue element enters the order-preserving queue, j is an integer greater than or equal to 1. In short, the queue elements in the order-preserving queue also follow the first-in-first-out principle. The earlier the queue elements are generated, the earlier they enter the order-preserving queue, and the closer their position in the order-preserving queue is to the head. Only after the previous queue element leaves the order-preserving queue can the subsequent queue elements leave the order-preserving queue.

[0083] Finally, the scheduling controller sends the queue element consisting of the message ID and the area ID, the message metadata, and the target SA data to any idle processing engine among the N processing engines. If there is no idle processing engine, it needs to wait.

[0084] In an optional embodiment, after sending a queue element consisting of a message identifier and an area identifier, message metadata, and target negotiation data to any one of N processing engines that is in an idle state, the message processing method further includes: in the process of controlling the processing engine that is in an idle state to process the target message according to the message metadata and the target negotiation data, obtaining target metadata generated by the target message during the processing process, wherein the target metadata is used to describe the processing result of the target message; writing the target metadata into a first cache area, and marking the state of the first cache area as a target state, wherein the target state indicates that the target message has been processed.

[0085] Optionally, when processing the target message, the processing engine can write the target metadata generated during the target message processing into the corresponding first cache area. After the target message is successfully processed, the scheduling controller marks the status of the corresponding first cache area as "completed" (corresponding to the above-mentioned target status).

[0086] In an optional embodiment, the message processing system can detect whether the result cache area corresponding to the area identifier in the first queue element in the order-preserving queue is marked as the target state. In the case where it is detected that the result cache area corresponding to the area identifier in the first queue element is marked as the target state, the processing result of the message corresponding to the first queue element is output, and the first queue element is deleted from the order-preserving queue; in the case where it is detected that the result cache area corresponding to the area identifier in the first queue element is not marked as the target state, it is prohibited to output the processing result of the message corresponding to any queue element in the order-preserving queue.

[0087] Optionally, use Figure 2 The output controller in can output the processing result of the message corresponding to the first queue element of each reordering queue (corresponding to the above-mentioned order-preserving queue) to the outside, if the status of the result cache area corresponding to the buffer id in the first queue element of a reordering queue is "completed", and update the SA cache at the same time, and delete the first queue element in the reordering queue.

[0088] Optionally, if the status of the result cache area corresponding to the buffer id in the first queue element of a certain reordering queue is not "completed", it is prohibited to output the processing result of the message corresponding to any queue element in the reordering queue.

[0089] In an optional embodiment, the embodiment of the present application also provides a message processing system, including: a target cache, a data reading controller, a scheduling controller, and N processing engines.

[0090] Among them, the target cache is used to cache the negotiation data being used in the communication system, wherein the negotiation data represents the data security information used by the communicating parties; the data reading controller is used to detect whether the target negotiation data corresponding to the message metadata carried by the target message is stored in the target cache; when it is detected that the target negotiation data exists in the target cache, the message metadata and the target negotiation data are sent to the scheduling controller; the scheduling controller is used to send the message metadata and the target negotiation data to any one of the N processing engines that is in an idle state, wherein N is an integer greater than 1, and the N processing engines are used to process multiple messages in parallel processing; N processing engines, wherein the processing engine in the idle state among the N processing engines is used to process the target message according to the message metadata and the target negotiation data.

[0091] Optionally, the message processing system also includes: M negotiation data receiving stations, each of which is used to read the negotiation data in the target memory, where M is an integer greater than 1; a data reading controller, which is also used to send the message metadata to any one of the M negotiation data receiving stations that is in an idle state when it is detected that the target negotiation data does not exist in the target cache; the idle negotiation data receiving station is used to read the target negotiation data corresponding to the message metadata from the target memory, and send the target negotiation data and the message metadata to the scheduling controller, and store the target negotiation data in the target cache.

[0092] Optionally, Figure 3 is a schematic diagram of a message processing system according to an embodiment of the present application, such as Figure 3As shown, the target cache may be an "SA cache", the data read controller may be an "SA read controller", and the negotiation data receiving station may be an "SA receiving station". The message processing system may be mounted on a chip, for example, a digital security chip such as an ASIC.

[0093] Alternatively, if Figure 3 As shown, the message metadata received by the chip enters the "IPSec request message queue (i.e. Figure 3 ipsec_req_0, ipsec_req_1…ipsec_req_n)” in the queue, waiting to be processed.

[0094] First, the "SA Read Controller" takes a message metadata from the request queue and checks whether the SA data to which the message metadata belongs already exists in the "SA Cache". If so, the message metadata and SA data are directly sent to the "Scheduling Controller" to wait for subsequent encryption, decryption and identity authentication processing; if not, the message metadata is sent to any idle "SA Receiving Station" (corresponding to Figure 3 If there is no idle "SA receiving station" at this time, the message metadata will be retained in the "SA reading controller" until an idle "SA receiving station" appears.

[0095] Among them, the "SA receiving station" is responsible for initiating SA data read requests to the "SA memory" and waiting for the "SA memory" to return SA data. When the SA data is returned, the "SA receiving station" is responsible for updating the SA data to the "SA cache" and sending the message metadata and SA data to the scheduling controller, waiting for subsequent encryption, decryption and identity authentication processing.

[0096] It should be noted that the SA receiving station is used to initiate an SA data read request to the SA memory (generally a DDR memory with higher latency, corresponding to the target memory mentioned above), wherein the SA memory stores the full amount of SA data. If the message metadata of the target message enters the SA receiving station, the SA receiving station will initiate an SA data read request for the target message to the SA memory. After the SA memory returns the target SA data corresponding to the target message to the SA receiving station, the SA receiving station will send the message metadata and target SA data of the target message to the scheduling controller on the one hand; on the other hand, the SA receiving station will also cache the target SA data in the SA cache, so that when the target SA data is used later, it can be directly queried from the SA cache without accessing the SA memory again, thereby minimizing the number of accesses to the SA memory and reducing the bandwidth pressure of the SA memory.

[0097] It should also be noted that the design of M SA receiving stations can also improve the efficiency of reading SA data. This design can satisfy the simultaneous query of SA data by M SA receiving stations to the SA memory, that is, at most M SA data can be queried from the SA memory at the same time.

[0098] In addition, the "SA cache" is used to cache the SA data currently in use in the system. SA data consists of two parts: one is static configuration data, such as algorithm keys, etc.; the other is dynamic data, such as anti-replay counters, etc. Static data is read-only and does not need to be written back to the SA memory; dynamic data needs to be written back, and can only be written back after the message is successfully processed. For example, attack messages intercepted by the anti-replay mechanism cannot trigger updates and writebacks.

[0099] In addition, the scheduling controller may be connected to N processing engines, and the N processing engines are used to process multiple messages in parallel. For example, one processing engine can process one message in real time, and the N processing engines can process N messages simultaneously.

[0100] It should be noted that in order to maximize the working efficiency of the N processing engines and improve the processing efficiency of messages, after receiving the message metadata and target SA data of the target message, the scheduling controller first determines the working status of each processing engine in the N processing engines, and then determines an idle processing engine from the N processing engines as the processing engine for processing the target message. In this way, the processing of the target message can enter the processing flow as quickly as possible without waiting.

[0101] It should also be noted that if all N processing engines are in working state, the scheduling controller will select the processing engine that is in idle state first as the processing engine for processing the target message.

[0102] Optionally, the SA cache in the embodiment of the present application (corresponding to the target cache described above) is a specially designed cache, wherein the SA cache in the embodiment of the present application includes multiple storage units, for example, K storage units, where K is an integer greater than 1. Each storage unit is used to store a complete SA data, that is, K storage units store K SA data correspondingly.

[0103] Optionally, since the dynamic data in the SA cache needs to be updated and written back after the message is processed, in an embodiment of the present application, a counter (reference counter, refcnt for short) is set for each storage unit to track the status of the storage unit.

[0104] Optionally, after the SA reading controller receives the message metadata of a target message (message to be processed), if the target SA data of the target message is stored in the i-th storage unit, the counter of the i-th storage unit is incremented by one, indicating that a new message that needs to be processed using the target SA data in the i-th storage unit is added. Further, after the subsequent processing engine completes processing of the target message based on the target SA data in the i-th storage unit, the counter of the i-th storage unit is decremented by one, indicating that a message that needs to be processed using the target SA data in the i-th storage unit is reduced.

[0105] Optionally, if the current count of the counter of a storage unit is 0, it means that there is no message in the communication system that needs to be processed using the SA data in the storage unit. In order to maximize the utilization rate of the storage unit, the storage unit is recycled and the SA data currently stored in the storage unit is deleted, thereby realizing the timely release of the storage resources of the storage unit. After the storage resources are released, the storage unit can be used to store new SA data.

[0106] It can be seen from the above content that according to the technical solution of the present application, in the process of processing messages, each time the data reading controller reads a message metadata, it first detects whether the target negotiation data (such as SA data) corresponding to the message metadata is stored in the target cache. If the target negotiation data corresponding to the message metadata is stored in the target cache, the message metadata and the target negotiation data are directly sent to the scheduling controller, instead of reading the corresponding SA data in the DDR memory each time a message metadata is read as in the prior art, thereby achieving the purpose of using the local cache to hide the high latency of DDR memory reading, effectively improving the bandwidth utilization of the DDR memory, and avoiding the problem of long data processing delay time. Especially when processing messages on a large scale, using the technical solution of the present application, a considerable proportion of the message metadata can be directly read from the target cache as SA data, and no longer querying the DDR memory for SA data, thereby achieving the technical effect of improving the overall message processing efficiency.

[0107] In addition, the present application also adopts a design method in which N processing engines process multiple messages in parallel. Compared with the method of using one processing engine to process all messages, the technical solution of the present application can further improve the processing efficiency of the messages.

[0108] According to another aspect of the present application, an embodiment of a message processing device is also provided, such as Figure 4 As shown, the message processing device includes: a detection unit 401, a first processing unit 402, a second processing unit 403, and a third processing unit 404.

[0109] Optionally, a detection unit 401 is used to detect, through a data reading controller, whether target negotiation data corresponding to message metadata carried by the target message is stored in the target cache when a target message is received, wherein the target cache is used to cache negotiation data being used in the communication system, and the negotiation data represents data encryption protocol information negotiated and used by the communicating parties; a first processing unit 402 is used to send the message metadata and the target negotiation data to a scheduling controller when it is detected that the target negotiation data is stored in the target cache; a second processing unit 403 is used to send the message metadata and the target negotiation data to any one of N processing engines that is in an idle state through the scheduling controller, wherein N is an integer greater than 1, and the N processing engines are used to process multiple messages in parallel; a third processing unit 404 is used to process the target message based on the message metadata and the target negotiation data through a processing engine that is in an idle state.

[0110] Optionally, the message processing device further includes: a fourth processing unit and a fifth processing unit. The fourth processing unit is used to send the message metadata to any one of the M negotiation data receiving stations in an idle state when detecting that the target negotiation data is not stored in the target cache, wherein M is an integer greater than 1, and the negotiation data receiving station is used to read the negotiation data in the target memory; the fifth processing unit is used to read the target negotiation data corresponding to the message metadata from the target memory through the negotiation data receiving station in an idle state, and send the target negotiation data and the message metadata to the scheduling controller, and store the target negotiation data in the target cache.

[0111] Optionally, the target cache includes multiple storage units, each of which is used to store a complete negotiation data, and the message processing device also includes: a sixth processing unit and a seventh processing unit. The sixth processing unit is used to add one to the counter of the i-th storage unit when the data reading controller receives the message metadata of the target message and detects that the target negotiation data of the target message is stored in the i-th storage unit, wherein the addition operation represents the addition of a message that needs to be processed using the target negotiation data in the i-th storage unit, and the i-th storage unit is any one of the multiple storage units; the seventh processing unit is used to subtract one from the counter of the i-th storage unit after detecting that the target message has been processed by any processing engine, wherein the subtraction operation represents the reduction of one message that needs to be processed using the target negotiation data in the i-th storage unit.

[0112] Optionally, the message processing device further includes: a first determination unit and a recycling operation unit. The first determination unit is used to determine that there is no message in the communication system that needs to be processed using the target negotiation data in the i-th storage unit when it is detected that the current count of the counter of the i-th storage unit is 0; the recycling operation unit is used to perform a recycling operation on the i-th storage unit, wherein the recycling operation is used to control the i-th storage unit to delete the target negotiation data and allow the storage of other negotiation data except the target negotiation data.

[0113] Optionally, the second processing unit 403 includes: a first determination subunit, a first acquisition subunit, a first processing subunit, a second processing subunit and a third processing subunit. The first determination subunit is used to determine a result cache area in an idle state from multiple result cache areas as the first cache area, wherein the result cache area is used to store metadata generated after each message is processed; the first acquisition subunit is used to obtain the message identifier of the target message and the area identifier of the first cache area; the first processing subunit is used to form a queue element with the message identifier and the area identifier; the second processing subunit is used to add the queue element to the order-preserving queue corresponding to the target negotiation data, wherein the time when the jth queue element in the order-preserving queue enters the order-preserving queue is earlier than the time when the j+1th queue element enters the order-preserving queue, and j is an integer greater than or equal to 1; the third processing subunit is used to send the queue element composed of the message identifier and the area identifier, the message metadata and the target negotiation data to any one of the N processing engines in an idle state.

[0114] Optionally, the message processing device further includes: a first acquisition unit and a writing unit. The first acquisition unit is used to acquire target metadata generated by the target message during the processing process when the processing engine in the idle state is controlled to process the target message according to the message metadata and the target negotiation data, wherein the target metadata is used to describe the processing result of the target message; the writing unit is used to write the target metadata into the first cache area and mark the state of the first cache area as the target state, wherein the target state indicates that the target message has been processed.

[0115] Optionally, the message processing device further includes: a first detection unit, an eighth processing unit, and a ninth processing unit. The first detection unit is used to detect whether the result cache area corresponding to the area identifier in the first queue element in the order-preserving queue is marked as the target state; the eighth processing unit is used to output the processing result of the message corresponding to the first queue element and delete the first queue element from the order-preserving queue when it is detected that the result cache area corresponding to the area identifier in the first queue element is marked as the target state; the ninth processing unit is used to prohibit outputting the processing result of the message corresponding to any queue element in the order-preserving queue when it is detected that the result cache area corresponding to the area identifier in the first queue element is not marked as the target state.

[0116] The above-mentioned embodiments or examples disclosed in the present application are not exhaustive, but are only illustrative of some embodiments or examples, and are not intended to be specific limitations on the scope of protection disclosed in the present application. In the absence of contradiction, each step in a certain embodiment or example in the present application can be implemented as an independent example, and the steps can be combined arbitrarily. For example, the scheme after removing some steps in a certain embodiment or example can also be implemented as an independent example, and the order of the steps in a certain embodiment or example can be arbitrarily exchanged. In addition, the optional methods or optional examples in a certain embodiment or example can be combined arbitrarily; in addition, the various embodiments or examples can be combined arbitrarily, for example, some or all steps of different embodiments or examples can be combined arbitrarily, and a certain embodiment or example can be combined arbitrarily with the optional methods or optional examples of other embodiments or examples.

[0117] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0118] In the above embodiments of the present application, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.

[0119] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the units can be a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0120] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0121] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0122] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, in essence, or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, disk or optical disk and other media that can store program codes.

[0123] The above is only a preferred implementation of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A message processing method, characterized in that: include: In the case of receiving a target message, detecting, through a data reading controller, whether target negotiation data corresponding to message metadata carried by the target message is stored in a target cache, wherein the target cache is used to cache negotiation data being used in a communication system, and the negotiation data represents data encryption protocol information negotiated and used by both parties of the communication; In case of detecting that the target negotiation data has been stored in the target cache, sending the message metadata and the target negotiation data to a scheduling controller; Sending the message metadata and the target negotiation data to any one of the N processing engines in an idle state through the scheduling controller, wherein N is an integer greater than 1, and the N processing engines are used to process multiple messages in a parallel processing manner; The target message is processed by the processing engine in the idle state according to the message metadata and the target negotiation data.

2. The message processing method according to claim 1, characterized in that: After detecting, by the data reading controller, whether the target cache stores target negotiation data corresponding to the message metadata carried by the target message, the message processing method further includes: When it is detected that the target negotiation data is not stored in the target cache, the message metadata is sent to any one of the M negotiation data receiving stations that is in an idle state, wherein M is an integer greater than 1, and the negotiation data receiving station is used to read the negotiation data in the target memory; The target negotiation data corresponding to the message metadata is read from the target memory by the negotiation data receiving station in the idle state, the target negotiation data and the message metadata are sent to the scheduling controller, and the target negotiation data is stored in the target cache.

3. The message processing method according to claim 1, characterized in that: The target cache includes a plurality of storage units, each of the plurality of storage units is used to store a complete negotiation data, and the message processing method further includes: When the data reading controller receives the message metadata of the target message and detects that the target negotiation data of the target message is stored in the i-th storage unit, an increment operation is performed on the counter of the i-th storage unit, wherein the increment operation represents the addition of a new message that needs to be processed using the target negotiation data in the i-th storage unit, and the i-th storage unit is any one of the multiple storage units; After detecting that the target message has been processed by any one of the processing engines, the counter of the i-th storage unit is decremented by one, wherein the decrement operation represents reducing one message that needs to be processed using the target negotiation data in the i-th storage unit.

4. The message processing method according to claim 3, characterized in that: The message processing method further includes: When detecting that the current count of the counter of the i-th storage unit is 0, determining that there is no message in the communication system that needs to be processed using the target negotiation data in the i-th storage unit; A recycling operation is performed on the i-th storage unit, wherein the recycling operation is used to control the i-th storage unit to delete the target negotiation data and allow storage of other negotiation data except the target negotiation data.

5. The message processing method according to claim 1, characterized in that: The method includes sending the message metadata and the target negotiation data to any one of the N processing engines in an idle state through the scheduling controller, including: Determine a result cache area in an idle state from multiple result cache areas as a first cache area, wherein the result cache area is used to store metadata generated after each message is processed; Obtaining a message identifier of the target message and an area identifier of the first cache area; Combining the message identifier and the area identifier into a queue element; Add the queue element to the order-preserving queue corresponding to the target negotiation data, wherein the time when the j-th queue element in the order-preserving queue enters the order-preserving queue is earlier than the time when the j+1-th queue element enters the order-preserving queue, and j is an integer greater than or equal to 1; The queue element consisting of the message identifier and the area identifier, the message metadata, and the target negotiation data are sent to any one of the N processing engines that is in an idle state.

6. The message processing method according to claim 5, characterized in that: After sending the queue element consisting of the message identifier and the area identifier, the message metadata, and the target negotiation data to any one of the N processing engines that is in an idle state, the message processing method further includes: In the process of controlling the processing engine in the idle state to process the target message according to the message metadata and the target negotiation data, obtaining the target metadata generated by the target message during the processing, wherein the target metadata is used to describe the processing result of the target message; The target metadata is written into the first cache area, and the state of the first cache area is marked as a target state, wherein the target state indicates that the target message has been processed.

7. The message processing method according to claim 5 or 6, characterized in that: The message processing method further includes: Detecting whether the result cache area corresponding to the area identifier in the first queue element in the order-preserving queue is marked as a target state; When it is detected that the result cache area corresponding to the area identifier in the first queue element is marked as the target state, outputting the processing result of the message corresponding to the first queue element, and deleting the first queue element from the order-preserving queue; When it is detected that the result cache area corresponding to the area identifier in the first queue element is not marked as the target state, outputting the processing result of the message corresponding to any queue element in the order-preserving queue is prohibited.

8. A message processing system, characterized in that: include: A target cache, used to cache negotiation data being used in the communication system, wherein the negotiation data represents data security information negotiated and used by both parties of the communication; A data reading controller, configured to, upon receiving a target message, detect whether the target negotiation data corresponding to the message metadata carried by the target message is stored in the target cache; and upon detecting that the target negotiation data exists in the target cache, send the message metadata and the target negotiation data to the scheduling controller; The scheduling controller is used to send the message metadata and the target negotiation data to any one of the N processing engines that is in an idle state, wherein N is an integer greater than 1, and the N processing engines are used to process multiple messages in a parallel processing manner; The N processing engines, wherein the processing engines in an idle state among the N processing engines, are used to process the target message according to the message metadata and the target negotiation data.

9. The message processing system according to claim 8, characterized in that: The message processing system also includes: M negotiation data receiving stations, each of which is used to read the negotiation data in the target memory, where M is an integer greater than 1; The data reading controller is further configured to send the message metadata to any one of the M negotiation data receiving stations that is in an idle state when detecting that the target negotiation data does not exist in the target cache; The negotiation data receiving station in an idle state is used to read the target negotiation data corresponding to the message metadata from the target memory, send the target negotiation data and the message metadata to the scheduling controller, and store the target negotiation data in the target cache.

10. A message processing device, characterized in that: include: a detection unit, configured to detect, when receiving a target message, whether target negotiation data corresponding to message metadata carried by the target message is stored in a target cache through a data reading controller, wherein the target cache is used to cache negotiation data being used in a communication system, and the negotiation data represents data encryption protocol information negotiated and used by both parties of the communication; A first processing unit, configured to send the message metadata and the target negotiation data to a scheduling controller when detecting that the target negotiation data has been stored in the target cache; A second processing unit, configured to send the message metadata and the target negotiation data to any one of the N processing engines in an idle state through the scheduling controller, wherein N is an integer greater than 1, and the N processing engines are configured to process multiple messages in a parallel processing manner; The third processing unit is used to process the target message according to the message metadata and the target negotiation data through the processing engine in the idle state.

Images