Packet processing method, system and apparatus

Abstract

The application discloses a message processing method, system and device, and relates to the fields of data processing and communication technologies. The method comprises the following steps: in the case that a target message is received, detecting, by a data reading controller, whether target negotiation data corresponding to message metadata carried by the target message is stored in a target cache; in the case that it is detected that the target negotiation data is stored in the target cache, sending the message metadata and the target negotiation data to a scheduling controller; sending, by the scheduling controller, the message metadata and the target negotiation data to any one of N processing engines in an idle state; and processing, by the processing engine in the idle state, the target message according to the message metadata and the target negotiation data. The application solves the technical problem of slow message processing speed in the prior art, which is caused by the fact that a large amount of SA data needs to be read from the memory when IPSec messages are processed by using SA data.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of data processing and the field of communication technology, in particular to a message processing method, system and device. BACKGROUND

[0002] IPSec (Internet Protocol Security) is a set of communication rules or protocols for establishing secure connections over a network. The Internet Protocol is a universal standard that determines how data is transmitted over the Internet. IPSec incorporates encryption and authentication on top of this, making the protocol more secure. IPSec uses asymmetric and symmetric encryption to provide speed and security during data transmission. In asymmetric encryption, the encryption key is public, while the decryption key is secret. Symmetric encryption uses the same public key to encrypt and decrypt data. IPSec establishes a secure connection through asymmetric encryption and then switches to symmetric encryption to speed up data transmission.

[0003] First, to use IPsec security services, a security association (SA) must be created between the two communicating parties. SA data is a set of IPSec specifications negotiated between devices that establish an IPSec relationship. These specifications include preferences for authentication, encryption, and IPSec protocol types that should be used when establishing an IPSec connection. Since symmetric encryption and authentication are computationally complex tasks, their performance is generally low if implemented using software based on general-purpose CPUs. Therefore, it is a common choice to use hardware acceleration chips or devices to share the pressure of the CPU.

[0004] However, a SA data at least needs to define an encryption algorithm and a key, an authentication algorithm and a key. The mainstream symmetric encryption algorithm and authentication algorithm generally use a 256-bit key, so a one-way SA data only needs to save 64 bytes of the key part. On this basis, since each message must read its corresponding SA data for processing, when a device supports tens of thousands of SA data at the same time, the SA data itself has a very large bandwidth pressure on the memory, which further affects the speed of message processing.

[0005] In view of the above problems, no effective solution has been proposed so far. SUMMARY

[0006] The embodiments of the present application provide a message processing method, system and device to at least solve the technical problem of slow message processing speed caused by the need to read a large number of SA data from the memory when using SA data to process IPSec messages in the prior art.

[0007] According to an aspect of the embodiments of the present application, a packet processing method is provided. The method comprises: in the case that a target packet is received, detecting, by a data reading controller, whether target negotiation data corresponding to packet metadata carried by the target packet is stored in a target cache, wherein the target cache is configured to cache negotiation data being used in a communication system, and the negotiation data represents data encryption protocol information negotiated by both parties of communication; in the case that it is detected that the target negotiation data is stored in the target cache, sending the packet metadata and the target negotiation data to a scheduling controller; sending, by the scheduling controller, the packet metadata and the target negotiation data to any one of N processing engines in an idle state, wherein N is an integer greater than 1, and the N processing engines are configured to process multiple packets in a parallel processing manner; and processing, by the processing engine in the idle state, the target packet according to the packet metadata and the target negotiation data.

[0008] Optionally, after detecting, by the data reading controller, whether the target negotiation data corresponding to the packet metadata carried by the target packet is stored in the target cache, the packet processing method further comprises: in the case that it is detected that the target negotiation data is not stored in the target cache, sending the packet metadata to any one of M negotiation data receiving stations in an idle state, wherein M is an integer greater than 1, and the negotiation data receiving station is configured to read negotiation data in a target memory; reading, by the negotiation data receiving station in the idle state, the target negotiation data corresponding to the packet metadata from the target memory, and sending the target negotiation data and the packet metadata to the scheduling controller, and storing the target negotiation data in the target cache.

[0009] Optionally, the target cache comprises a plurality of storage units, each of the plurality of storage units is configured to store a complete negotiation data, and the packet processing method further comprises: in the case that the data reading controller receives the packet metadata of the target packet, and it is detected that the target negotiation data of the target packet is stored in an i th storage unit, performing an increment operation on a counter of the i th storage unit, wherein the increment operation represents that one packet needs to be processed by using the target negotiation data in the i th storage unit, and the i th storage unit is any one of the plurality of storage units; and in the case that it is detected that the target packet is processed by any one of the processing engines, performing a decrement operation on the counter of the i th storage unit, wherein the decrement operation represents that one packet needs to be processed by using the target negotiation data in the i th storage unit.

[0010] Optionally, the packet processing method further comprises: determining that there is no packet in the communication system that needs to be processed by using the target negotiation data in the i th storage unit when it is detected that the current count of the counter of the i th storage unit is 0; and performing a recycling operation on the i th storage unit, wherein the recycling operation is used to control the i th storage unit to delete the target negotiation data and allow storage of other negotiation data except the target negotiation data.

[0011] Optionally, the sending of the packet metadata and the target negotiation data to any one of the N processing engines in an idle state by the scheduling controller comprises: determining an idle result cache area from the plurality of result cache areas as a first cache area, wherein the result cache area is used to store the metadata generated after processing of each packet; obtaining a packet identifier of the target packet and a region identifier of the first cache area; composing a queue element with the packet identifier and the region identifier; adding the queue element to an in-order queue corresponding to the target negotiation data, wherein a j th queue element in the in-order queue enters the in-order queue at an earlier time than a (j+1) th queue element, j being an integer greater than or equal to 1; and sending the queue element composed of the packet identifier and the region identifier, the packet metadata, and the target negotiation data to any one of the N processing engines in an idle state.

[0012] Optionally, after the sending of the queue element composed of the packet identifier and the region identifier, the packet metadata, and the target negotiation data to any one of the N processing engines in an idle state, the packet processing method further comprises: obtaining target metadata generated in the processing of the target packet by the processing engine in an idle state according to the packet metadata and the target negotiation data, wherein the target metadata is used to describe the processing result of the target packet; and writing the target metadata to the first cache area and marking the state of the first cache area as a target state, wherein the target state represents that the target packet has been processed.

[0013] Optionally, the packet processing method further comprises: detecting whether the result cache area corresponding to the region identifier in the first queue element in the in-order queue is marked as the target state; in a case where it is detected that the result cache area corresponding to the region identifier in the first queue element is marked as the target state, outputting the processing result of the packet corresponding to the first queue element and deleting the first queue element from the in-order queue; and in a case where it is detected that the result cache area corresponding to the region identifier in the first queue element is not marked as the target state, prohibiting output of the processing result of the packet corresponding to any one of the queue elements in the in-order queue.

[0014] According to another aspect of the present application, a packet processing system is also provided, which comprises: a target cache configured to cache negotiation data currently used in a communication system, wherein the negotiation data represents data security information negotiated by both parties of the communication; a data reading controller configured to, in a case where a target packet is received, detect whether the target cache stores target negotiation data corresponding to packet metadata carried by the target packet; in a case where it is detected that the target cache stores the target negotiation data, send the packet metadata and the target negotiation data to a scheduling controller; the scheduling controller configured to send the packet metadata and the target negotiation data to any one of N processing engines in an idle state, wherein N is an integer greater than 1, and the N processing engines are configured to process multiple packets in a parallel processing manner; and the N processing engines, wherein the processing engine in the idle state is configured to process the target packet according to the packet metadata and the target negotiation data.

[0015] Optionally, the packet processing system further comprises: M negotiation data receiving stations, each of which is configured to read negotiation data in the target memory, wherein M is an integer greater than 1; the data reading controller is further configured to, in a case where it is detected that the target cache does not store the target negotiation data, send the packet metadata to any one of the M negotiation data receiving stations in an idle state; and the negotiation data receiving station in the idle state is configured to read target negotiation data corresponding to the packet metadata from the target memory, send the target negotiation data and the packet metadata to the scheduling controller, and store the target negotiation data in the target cache.

[0016] According to another aspect of the present application, a packet processing apparatus is also provided, which comprises: a detection unit configured to, in a case where a target packet is received, detect, by a data reading controller, whether a target cache stores target negotiation data corresponding to packet metadata carried by the target packet, wherein the target cache is configured to cache negotiation data currently used in a communication system, and the negotiation data represents data encryption protocol information negotiated by both parties of the communication; a first processing unit configured to, in a case where it is detected that the target cache stores the target negotiation data, send the packet metadata and the target negotiation data to a scheduling controller; a second processing unit configured to send, by the scheduling controller, the packet metadata and the target negotiation data to any one of N processing engines in an idle state, wherein N is an integer greater than 1, and the N processing engines are configured to process multiple packets in a parallel processing manner; and a third processing unit configured to process, by the processing engine in the idle state, the target packet according to the packet metadata and the target negotiation data.

[0017] In the present application, first, in the case of receiving a target packet, whether the target negotiation data corresponding to the packet metadata carried by the target packet is stored in the target cache is detected by the data reading controller, wherein the target cache is used to cache the negotiation data being used in the communication system, and the negotiation data represents the data encryption protocol information negotiated by the communication parties. Then, in the case of detecting that the target negotiation data has been stored in the target cache, the packet metadata and the target negotiation data are sent to the scheduling controller, and then the packet metadata and the target negotiation data are sent to any idle processing engine in the N processing engines by the scheduling controller, wherein N is an integer greater than 1, and the N processing engines are used to process multiple packets in a distributed data processing manner. Finally, the target packet is processed by the idle processing engine according to the packet metadata and the target negotiation data.

[0018] From the above, according to the technical solution of the present application, in the process of processing the packet, when the data reading controller reads a packet metadata each time, it first detects whether the target negotiation data (such as SA data) corresponding to the packet metadata is stored in the target cache. If the target negotiation data corresponding to the packet metadata is stored in the target cache, the packet metadata and the target negotiation data are directly sent to the scheduling controller, instead of reading the corresponding SA data in the memory (such as DDR memory, the full name of DDR is Double Data Rate Synchronous Dynamic Random Access Memory, i.e. Double Data Rate Synchronous Dynamic Random Access Memory) each time a packet metadata is read, as in the prior art. Thus, the purpose of using local cache to hide the high delay of DDR memory reading is achieved, the bandwidth utilization of DDR memory is effectively improved, and the problem of long data processing delay time is avoided. Especially in the case of processing a large number of packets, using the technical solution of the present application can realize that a considerable proportion of packet metadata directly reads SA data from the target cache, instead of querying SA data from the DDR memory, thereby realizing the technical effect of improving the overall packet processing efficiency.

[0019] In addition, the present application also adopts the design of N processing engines processing multiple packets in parallel, compared with the way of using a single processing engine to process all packets, the technical solution of the present application can further improve the processing efficiency of the packet.

[0020] It can be seen that, according to the technical scheme of the present application, the use of local cache for SA data query and the use of multiple processing engines for parallel processing of multiple packets avoid the high delay problem of DDR memory reading SA data, improve the processing efficiency of the packets and reduce the bandwidth pressure of the memory, thereby solving the technical problem of slow packet processing speed in the prior art when IPSec packets are processed using SA data, because a large amount of SA data needs to be read from the memory. BRIEF DESCRIPTION OF DRAWINGS

[0021] The drawings described herein are used to provide further understanding of the present application, and form a part of the present application. The illustrative embodiments of the present application and their descriptions serve to explain the present application, and do not constitute an improper limitation on the present application. In the drawings:

[0022] Figure 1 is a flowchart of an optional packet processing method according to an embodiment of the present application;

[0023] Figure 2 is a schematic diagram of an optional multiple processing engine parallel processing packet according to an embodiment of the present application;

[0024] Figure 3 is a schematic diagram of a packet processing system according to an embodiment of the present application;

[0025] Figure 4 is a flowchart of an optional packet processing device according to an embodiment of the present application. DETAILED DESCRIPTION

[0026] In order to enable those skilled in the art to better understand the present application, the technical scheme in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, but not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor should fall within the scope of protection of the present application.

[0027] It should be noted that the terms "first", "second" and the like in the description and in the claims of the present application and the above-described accompanying drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged under appropriate circumstances, so that the embodiments of the present application described herein can be implemented in an order other than that illustrated or described herein. In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusion, for example, a process, method, system, product or device including a series of steps or units does not necessarily have to be limited to those steps or units clearly listed, but can include other steps or units not clearly listed or inherent to these processes, methods, products or devices.

[0028] It should also be noted that the information collected by the present application (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data for analysis, stored data, displayed data, etc.) are information and data authorized by the user or authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of related data comply with relevant laws, regulations and standards in relevant regions, necessary security measures are taken, do not violate public order and good customs, and provide corresponding operation portal for user to choose authorization or refusal. For example, interfaces are provided between the system and related users or agencies, and before obtaining the relevant information, the interface needs to send a request to the aforementioned user or agency, and after receiving the consent information feedback from the aforementioned user or agency, the relevant information is obtained.

[0029] In an optional embodiment, a message processing system can be used as the execution subject of the message processing method in the embodiments of the present application. The message processing system can be a software system or an embedded system combining software and hardware. Of course, in addition to using the message processing system as the execution subject, other forms of devices and equipment can also be used as the execution subject of the message processing method in the embodiments of the present application, and the specific type of the execution subject is not particularly limited in the present application.

[0030] For the convenience of description, the technical solutions of the embodiments of the present application are described below with the message processing system as the execution subject.

[0031] According to the embodiments of the present application, an embodiment of a message processing method is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although the logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that described herein.

[0032] Figure 1is a flow chart of an optional packet processing method according to an embodiment of the present application, as shown in Figure 1 The method comprises the following steps:

[0033] In step S101, when a target packet is received, a data reading controller detects whether target negotiation data corresponding to packet metadata carried by the target packet is stored in a target cache.

[0034] In step S101, the target cache is used to cache negotiation data being used in a communication system, and the negotiation data represents data encryption protocol information negotiated by the communication parties.

[0035] Optionally, the negotiation data can be SA data, wherein the SA data comprises two parts of content, one part is static configuration data such as algorithm key, etc., and the other part is dynamic data such as anti-replay counter, etc. The static data is read-only and does not need to be written back to the SA memory; the dynamic data needs to be written back and can only be written back after the packet is successfully processed. For example, an attack packet intercepted by an anti-replay mechanism cannot trigger updating and writing back.

[0036] Here, the SA data is data determined by the IPsec communication parties through a negotiation process when establishing a secure connection.

[0037] Optionally, the negotiation data can also be data negotiated by the communication parties other than the SA data, for example, port number, connection duration, connection time, verification password, etc.

[0038] In the case where the negotiation data is SA data, the data reading controller can be an SA reading controller for reading packet metadata. In addition, the SA reading controller is also connected with an SA cache (corresponding to the target cache described above), wherein the SA cache is used to cache SA data being used in the communication system, and the SA cache belongs to a kind of local cache.

[0039] Optionally, when the packet processing system needs to process a packet, the packet metadata of the packet to be processed is first read from the packet request queue by the SA reading controller, and then it is detected whether the target SA data (corresponding to the target negotiation data described above) corresponding to the packet metadata is stored in the SA cache, instead of directly querying the target SA data corresponding to the packet metadata in the memory. This design can reduce the number of memory reading times and reduce the bandwidth pressure of the memory.

[0040] It should be noted that the packet metadata refers to additional information related to the packet itself in network communication. These information is used to describe the attributes, characteristics, status or context of the packet, in order to facilitate identification, classification, processing and routing in network transmission and processing process. The purpose of packet metadata is to improve communication efficiency, security and reliability.

[0041] Packet metadata mainly includes the following information:

[0042] 1. Packet identification: used to uniquely identify a packet, usually contains packet ID, sequence number, etc.

[0043] 2. Sender and receiver information, such as including the address, port number of the sender and receiver, etc., used to determine the source and target of the packet.

[0044] 3. Packet type: describes the content and format of the packet, such as whether it is a control packet, data packet, request packet or response packet, etc.

[0045] 4. Packet size: refers to the length or byte number of the packet, used to determine the transmission and processing time of the packet.

[0046] 5. Timestamp: records the sending and receiving time of the packet, used to calculate the delay and synchronization.

[0047] 6. Priority: used to determine the priority of the packet, in order to give priority to high priority packets when the network is congested.

[0048] 7. Security information: such as including encryption, authentication and authorization information, used to protect the security and integrity of the packet.

[0049] 8. Routing information: describes the routing path and next hop address of the packet, used to guide the transmission of the packet in the network.

[0050] 9. Status and error information: used to record the transmission status, error code, etc. of the packet, in order to carry out fault diagnosis and processing.

[0051] Packet metadata is applied in each layer of network protocol stack, such as physical layer, link layer, network layer, transport layer and application layer. By reasonably using packet metadata, the efficiency and reliability of network communication can be improved.

[0052] Optionally, the packet metadata includes, but is not limited to, source IP, destination IP, protocol number (indicating the network layer protocol used by the packet, for example, AH (protocol number 51) or ESP (protocol number 50) may be used in the IPSec protocol), SPI (Security Parameters Index), and other information carried in the header of the target packet. SPI is a unique identifier of the SA, used to distinguish different SAs. For example, the packet processing system can find the SA data from the target cache or the target memory according to the SPI in the packet metadata.

[0053] Step S102, in the case of detecting that the target cache has stored the target negotiation data, sending the packet metadata and the target negotiation data to the scheduling controller.

[0054] Optionally, if the SA reading controller detects that the target SA data corresponding to the packet metadata has been stored in the SA cache, the SA reading controller will directly forward the packet metadata and the target SA data to the scheduling controller, wherein the scheduling controller is configured to send the packet metadata of the target packet and the target SA data to the processing engine, and the processing engine is configured to perform encryption and decryption, identity verification, and the like on the target packet according to the packet metadata of the target packet and the target SA data.

[0055] Step S103, sending the packet metadata and the target negotiation data to any idle processing engine in the N processing engines through the scheduling controller.

[0056] In step S103, N is an integer greater than 1, and the N processing engines are configured to process multiple packets in a parallel processing manner.

[0057] Optionally, in the present application, N processing engines are provided to process multiple packets in a parallel processing manner. For example, one processing engine can process one packet in real time, and N processing engines can simultaneously process N packets.

[0058] It should be noted that, in order to maximize the working efficiency of the N processing engines and improve the processing efficiency of the packets, after receiving the packet metadata and the target SA data of the target packet, the scheduling controller first determines the working state of each processing engine in the N processing engines (for example, the working state of each processing engine can be obtained according to the heartbeat data reported by each processing engine to the scheduling controller at a fixed time), and then determines an idle processing engine from the N processing engines as a processing engine for processing the target packet. In this way, the processing of the target packet can be performed without waiting, and the processing flow can be entered as soon as possible.

[0059] It should be further explained that if all the N processing engines are in the working state, the scheduling controller will select the processing engine that switches from the working state to the idle state earliest as the processing engine for processing the target packet.

[0060] In step S104, the processing engine in the idle state processes the target packet according to the packet metadata and the target negotiation data.

[0061] The target packet is a packet associated with the packet metadata.

[0062] Optionally, after receiving the packet metadata and the target SA data of the target packet, the processing engine in the idle state can use the packet metadata and the target SA data to perform encryption, decryption, identity verification and other processing on the target packet.

[0063] Based on the above steps S101 to S104, in the present application, first, when the target packet is received, the data reading controller detects whether the target negotiation data corresponding to the packet metadata carried by the target packet is stored in the target cache. The target cache is used to cache the negotiation data being used in the communication system, and the negotiation data represents the data encryption protocol information negotiated by the communication parties. Then, when it is detected that the target negotiation data is stored in the target cache, the packet metadata and the target negotiation data are sent to the scheduling controller. Subsequently, the scheduling controller sends the packet metadata and the target negotiation data to any processing engine in the idle state among the N processing engines. N is an integer greater than 1, and the N processing engines are used to process multiple packets in a parallel processing manner. Finally, the processing engine in the idle state processes the target packet according to the packet metadata and the target negotiation data.

[0064] As can be seen from the above, according to the technical solution of the present application, in the process of processing packets, when the data reading controller reads a packet metadata each time, it first detects whether the target negotiation data (such as SA data) corresponding to the packet metadata is stored in the target cache. If the target negotiation data corresponding to the packet metadata is stored in the target cache, the packet metadata and the target negotiation data are directly sent to the scheduling controller, instead of reading the corresponding SA data in the DDR memory each time a packet metadata is read as in the prior art, thereby achieving the purpose of using local cache to hide the high delay of DDR memory reading, effectively improving the bandwidth utilization of DDR memory, and avoiding the problem of long data processing delay. Especially when processing a large number of packets, using the technical solution of the present application can achieve that a considerable proportion of packet metadata directly reads SA data from the target cache, instead of querying SA data from the DDR memory, thereby achieving the technical effect of improving the overall packet processing efficiency.

[0065] In addition, the application also adopts the design of N processing engines for parallel processing of multiple packets. Compared with the method of using one processing engine to process all packets, the technical solution of the application can further improve the processing efficiency of the packets.

[0066] As can be seen, according to the technical solution of the application, by using the local cache to query the SA data and using multiple processing engines to parallel process multiple packets, the problem of high delay of reading SA data from the DDR memory is avoided, the processing efficiency of the packets is improved, and the bandwidth pressure of the memory is reduced, thereby solving the technical problem of slow packet processing speed in the prior art when IPSec packets are processed by using SA data, because a large amount of SA data needs to be read from the memory.

[0067] In an optional embodiment, after detecting whether the target cache stores the target negotiation data corresponding to the packet metadata carried by the target packet by the data reading controller, the packet processing method further comprises: in the case of detecting that the target cache does not store the target negotiation data, sending the packet metadata to any negotiation data receiving station in an idle state in the M negotiation data receiving stations, wherein M is an integer greater than 1, and the negotiation data receiving station is used to read the negotiation data in the target memory; reading the target negotiation data corresponding to the packet metadata from the target memory by the negotiation data receiving station in the idle state, and sending the target negotiation data and the packet metadata to the scheduling controller, and storing the target negotiation data in the target cache.

[0068] Optionally, if the scheduling controller does not query the target SA data corresponding to the packet metadata of the target packet in the SA cache after reading the packet metadata, the scheduling controller will send the packet metadata to any SA receiving station in an idle state in the M SA receiving stations (corresponding to the negotiation data receiving station, referred to as rcv_m). If there is no idle SA receiving station at this time, the packet metadata will be stranded in the SA reading controller until an idle SA receiving station appears.

[0069] It should be noted that the SA receiving station is configured to initiate a SA data read request to the SA memory (generally a high-delay DDR memory, corresponding to the target memory described above), and the SA memory stores full SA data. If the packet metadata of the target packet enters the SA receiving station, the SA receiving station will initiate a SA data read request to the SA memory about the target packet. After the SA memory returns the target SA data corresponding to the target packet to the SA receiving station, the SA receiving station sends the packet metadata and the target SA data of the target packet to the scheduling controller, and also caches the target SA data in the SA cache. Thus, the target SA data can be directly queried from the SA cache when needed, without accessing the SA memory again, thereby reducing the access frequency of the SA memory and the bandwidth pressure of the SA memory.

[0070] It should also be noted that the design of the M SA receiving stations can also improve the reading efficiency of the SA data. The design can meet the requirement that the M SA receiving stations simultaneously query the SA data from the SA memory, that is, at most M SA data can be simultaneously queried from the SA memory.

[0071] In an optional embodiment, the target cache includes a plurality of storage units, each of the plurality of storage units is configured to store a complete negotiation data, and the packet processing method further includes: when the data read controller receives the packet metadata of the target packet and detects that the target negotiation data of the target packet is stored in the i-th storage unit, performing an increment operation on a counter of the i-th storage unit, wherein the increment operation represents adding a packet that needs to be processed by using the target negotiation data in the i-th storage unit, and the i-th storage unit is any one of the plurality of storage units; and after detecting that the target packet is processed by any one of the processing engines, performing a decrement operation on the counter of the i-th storage unit, wherein the decrement operation represents reducing a packet that needs to be processed by using the target negotiation data in the i-th storage unit.

[0072] Optionally, the SA cache (corresponding to the target cache described above) in the embodiment of the present application is a specially designed cache. The SA cache in the embodiment of the present application includes a plurality of storage units, for example, K storage units, where K is an integer greater than 1. Each storage unit is configured to store a complete SA data, and the K storage units correspond to K SA data.

[0073] Optionally, since the dynamic data in the SA cache needs to be updated and written back after the packet is processed, in the embodiment of the present application, a counter (reference counter, refcnt for short) is set for each storage unit to track the state of the storage unit.

[0074] Optionally, after the SA reading controller receives the message metadata of a target message (a message to be processed), if the target SA data of the target message is stored in the i-th storage unit, the counter of the i-th storage unit is incremented by one, indicating that a message requiring subsequent processing using the target SA data in the i-th storage unit is added at this time. Further, after the subsequent processing engine completes processing of the target message according to the target SA data in the i-th storage unit, the counter of the i-th storage unit is decremented by one, indicating that a message requiring processing using the target SA data in the i-th storage unit is reduced at this time.

[0075] In an optional embodiment, when it is detected that the current count of the counter of the i-th storage unit is 0, it is determined that there is no message in the communication system requiring processing using the target negotiation data in the i-th storage unit; the i-th storage unit is recycled, wherein the recycling operation is used to control the i-th storage unit to delete the target negotiation data and allow storage of other negotiation data in addition to the target negotiation data.

[0076] Optionally, if the current count of the counter of a certain storage unit is 0, it indicates that there is no message in the communication system requiring processing using the SA data in the storage unit, in order to maximize the utilization of the storage unit, the storage unit is recycled at this time to delete the currently stored SA data in the storage unit, so as to realize timely release of the storage resources of the storage unit, and the storage unit after the release of the storage resources can be used to store new SA data.

[0077] In an optional embodiment, the dispatching controller sends the message metadata and the target negotiation data to any idle processing engine in the N processing engines, comprising: determining an idle result cache area as a first cache area from a plurality of result cache areas, wherein the result cache area is used to store the metadata generated after processing each message; obtaining a message identifier of the target message and a region identifier of the first cache area; grouping the message identifier and the region identifier into a queue element; adding the queue element to an in-order queue corresponding to the target negotiation data, wherein the j-th queue element in the in-order queue enters the in-order queue at an earlier time than the j+1-th queue element, j is an integer greater than or equal to 1; and sending the queue element composed of the message identifier and the region identifier, the message metadata, and the target negotiation data to any idle processing engine in the N processing engines.

[0078] Optionally, for IPSec device, such as IPSec acceleration device (a device specially designed for improving IPSec message processing speed), a very important requirement is the message order preservation, i.e. the order of the messages belonging to the same SA data leaving the device must be consistent with the order of the messages entering the device (it can be understood as the first-in first-out message processing principle). However, the messages belonging to the same SA data often have the burst characteristics, i.e. in a very short time, the device can receive a plurality of messages belonging to the same SA in succession. Therefore, how to improve the bandwidth use efficiency of IPSec message processing and reduce the processing delay of the messages under the premise of ensuring the order preservation is an important problem to be solved by the hardware acceleration device.

[0079] Firstly, Figure 2 is a schematic diagram of an optional multi-processing engine parallel processing message according to an embodiment of the present application, as Figure 2 indicated, the scheduling controller is connected with the processing engine array, wherein the processing engine array is composed of N processing engines, the N processing engines can process a plurality of messages in parallel, each processing engine can use the SA data to process the messages, such as encryption and decryption, identity authentication, anti-replay, message encapsulation, decapsulation, etc., the N processing engines are independent of each other and work in parallel.

[0080] Optionally, as Figure 2 indicated, the scheduling controller is also connected with a plurality of result buffers (corresponding to the result cache area described above), wherein each result buffer is used to store the metadata generated by the processing engine after processing a message, the metadata is used to describe the related attributes of the message processing result.

[0081] Optionally, when the scheduling controller processes a message (assumed to be a target message) in cooperation with the processing engine, it first determines any buffer in an idle state from the plurality of result buffers as a first cache area, if there is no buffer in an idle state at present, it selects the buffer as the first cache area until an idle buffer appears. The scheduling controller obtains the message id (i.e. message identification) of the target message and the buffer id (i.e. area identification) of the first cache area, then composes a queue element with the message id of the target message and the buffer id of the first cache area, and adds the queue element to the order preserving queue of the target SA data corresponding to the target message. It should be noted that since a message must belong to an SA data, the target SA data of the target message can be determined by judging the target SA data, and the order preserving queue corresponding to the target message can be determined. The order preserving queue is Figure 2The reordering queue in the reordering queue array is a queue in which the queue elements are arranged in the order of the time when the queue elements enter the reordering queue.

[0082] It should be further noted that the jth queue element in a reordering queue enters the reordering queue at an earlier time than the j+1th queue element, j being an integer greater than or equal to 1. In short, the queue elements in the reordering queue also follow the principle of first-in first-out, that is, the earlier the queue element is generated, the earlier the queue element enters the reordering queue and the closer the queue element is to the head of the reordering queue. Only after the preceding queue elements leave the reordering queue can the subsequent queue elements leave the reordering queue.

[0083] Finally, the scheduling controller sends the queue element composed of the packet identifier and the region identifier, the packet metadata, and the target SA data to any idle processing engine in the N processing engines. If there is no idle processing engine, the scheduling controller needs to wait.

[0084] In an optional embodiment, after the queue element composed of the packet identifier and the region identifier, the packet metadata, and the target negotiation data is sent to any idle processing engine in the N processing engines, the packet processing method further includes: obtaining target metadata generated in the process of processing the target packet by the idle processing engine according to the packet metadata and the target negotiation data, wherein the target metadata is used to describe the processing result of the target packet; writing the target metadata into the first cache region, and marking the state of the first cache region as a target state, wherein the target state represents that the target packet has been processed.

[0085] Optionally, the processing engine can write the target metadata generated in the process of processing the target packet into the corresponding first cache region. After the target packet is successfully processed, the scheduling controller marks the state of the corresponding first cache region as "complete" (corresponding to the target state described above).

[0086] In an optional embodiment, the packet processing system can detect whether the result cache region corresponding to the region identifier in the first queue element in the reordering queue is marked as the target state. In the case where the result cache region corresponding to the region identifier in the first queue element is detected to be marked as the target state, the processing result of the packet corresponding to the first queue element is output, and the first queue element is deleted from the reordering queue; in the case where the result cache region corresponding to the region identifier in the first queue element is detected not to be marked as the target state, the processing result of the packet corresponding to any queue element in the reordering queue is prohibited to be output.

[0087] Optionally, with the output controller in Figure 2 , the first queue element of each reordering queue (corresponding to the above-mentioned in-order queue) can be outputted, if the state of the result cache area corresponding to the buffer id in the first queue element of a certain reordering queue is "complete", the processing result of the packet corresponding to the first queue element is outputted, the SA cache is updated, and the first queue element in the reordering queue is deleted.

[0088] Optionally, if the state of the result cache area corresponding to the buffer id in the first queue element of a certain reordering queue is not "complete", the processing result of the packet corresponding to any one of the queue elements in the reordering queue is prohibited to be outputted.

[0089] In an optional embodiment, the application also provides a packet processing system, comprising: a target cache, a data reading controller, a scheduling controller, and N processing engines.

[0090] The target cache is configured to cache negotiation data being used in a communication system, wherein the negotiation data represents data security information used by both parties of communication; the data reading controller is configured to detect whether the target cache stores target negotiation data corresponding to packet metadata carried by a target packet; and in a case where the target cache is detected to store the target negotiation data, send the packet metadata and the target negotiation data to the scheduling controller; the scheduling controller is configured to send the packet metadata and the target negotiation data to any one of the N processing engines in an idle state, wherein N is an integer greater than 1, and the N processing engines are configured to process multiple packets in a parallel processing manner; and the N processing engines in the idle state are configured to process the target packet according to the packet metadata and the target negotiation data.

[0091] Optionally, the packet processing system further comprises: M negotiation data receiving stations, each of which is configured to read negotiation data in the target memory, wherein M is an integer greater than 1; the data reading controller is further configured to, in a case where the target cache is detected to not store the target negotiation data, send the packet metadata to any one of the M negotiation data receiving stations in an idle state; and the negotiation data receiving station in the idle state is configured to read target negotiation data corresponding to the packet metadata from the target memory, send the target negotiation data and the packet metadata to the scheduling controller, and store the target negotiation data in the target cache.

[0092] Optionally, Figure 3 is a schematic diagram of a packet processing system according to an embodiment of the application, as Figure 3As shown, the target cache can be an "SA cache", the data reading controller can be an "SA reading controller", and the negotiation data receiving station can be an "SA receiving station". The message processing system can be mounted on a chip, such as an ASIC or other digital security chip.

[0093] Optionally, as shown, the message metadata received by the chip enters the "IPSec request message queue (i.e. Figure 3 ipsec_req_0, ipsec_req_1,..., ipsec_req_n in FIG. 1) in sequence and waits for processing. Figure 3 First, the SA reading controller takes out some message metadata from the request queue, checks whether the SA data to which the message metadata belongs already exists in the SA cache, and if so, directly sends the message metadata and the SA data to the scheduling controller for subsequent encryption and decryption and identity verification processing; if not, sends the message metadata to any idle SA receiving station (corresponding to rcv m,..., rcv m in FIG. 1). If there is no idle SA receiving station at this time, the message metadata will be stranded in the SA reading controller until an idle SA receiving station appears.

[0094] Figure 3 Among them, the SA receiving station is responsible for initiating an SA data reading request to the SA memory and waiting for the SA memory to return the SA data. After the SA data is returned, the SA receiving station is responsible for updating the SA data to the SA cache and sending the message metadata and the SA data to the scheduling controller for subsequent encryption and decryption and identity verification processing.

[0095] It should be noted that the SA receiving station is used to initiate an SA data reading request to the SA memory (generally a high-latency DDR memory, corresponding to the target memory described above), and the SA memory stores full SA data. If the message metadata of the target message enters the SA receiving station, the SA receiving station will initiate an SA data reading request for the target message to the SA memory. After the SA memory returns the target SA data corresponding to the target message to the SA receiving station, the SA receiving station sends the message metadata of the target message and the target SA data to the scheduling controller, and on the other hand, the SA receiving station also caches the target SA data in the SA cache. In this way, when the target SA data is used again, it can be directly queried from the SA cache, without the need to access the SA memory again, thereby maximizing the number of accesses to the SA memory and reducing the bandwidth pressure of the SA memory.

[0096] It should be noted that the SA receiving station is used to initiate an SA data reading request to the SA memory (generally a high-latency DDR memory, corresponding to the target memory described above), and the SA memory stores full SA data. If the message metadata of the target message enters the SA receiving station, the SA receiving station will initiate an SA data reading request for the target message to the SA memory. After the SA memory returns the target SA data corresponding to the target message to the SA receiving station, the SA receiving station sends the message metadata of the target message and the target SA data to the scheduling controller, and on the other hand, the SA receiving station also caches the target SA data in the SA cache. In this way, when the target SA data is used again, it can be directly queried from the SA cache, without the need to access the SA memory again, thereby maximizing the number of accesses to the SA memory and reducing the bandwidth pressure of the SA memory.

[0097] ​It should be noted that the design of the M SA receiving stations can also improve the reading efficiency of the SA data. The design can meet the requirement that the M SA receiving stations simultaneously query the SA data from the SA memory, i.e., at most M SA data can be simultaneously queried from the SA memory.

[0098] In addition, the SA cache is used to cache the SA data being used in the system. The SA data includes two parts of content. One part is static configuration data such as an algorithm key, etc. The other part is dynamic data such as an anti-replay counter, etc. The static data is read-only and does not need to be written back to the SA memory. The dynamic data needs to be written back and can only be written back after the packet is successfully processed. For example, an attack packet intercepted by the anti-replay mechanism cannot trigger updating and writing back.

[0099] In addition, the scheduling controller can be connected with N processing engines. The N processing engines are used to process multiple packets in parallel. For example, one processing engine can process one packet in real time, and N processing engines can simultaneously process N packets.

[0100] It should be noted that, in order to maximize the working efficiency of the N processing engines and improve the processing efficiency of the packet, after the scheduling controller receives the packet metadata of the target packet and the target SA data, the scheduling controller first determines the working state of each processing engine in the N processing engines, and then determines a processing engine in an idle state from the N processing engines as a processing engine for processing the target packet. In this way, the processing of the target packet can be performed without waiting and can be performed in the fastest processing flow.

[0101] It should be noted that, if all the N processing engines are in a working state, the scheduling controller selects a processing engine that is in an idle state first as a processing engine for processing the target packet.

[0102] Optionally, the SA cache (corresponding to the target cache described above) in the embodiment of the present application is a specially designed cache. The SA cache in the embodiment of the present application includes a plurality of storage units, for example, K storage units, where K is an integer greater than 1. Each storage unit is used to store a complete SA data, i.e., K storage units correspond to K SA data.

[0103] Optionally, since the dynamic data in the SA cache needs to be updated and written back after the packet is processed, in the embodiment of the present application, a counter (reference counter, refcnt for short) is set for each storage unit to track the state of the storage unit.

[0104] Optionally, after the SA reading controller receives the message metadata of a target message (a message to be processed), if the target SA data of the target message is stored in the i-th storage unit, the counter of the i-th storage unit is incremented by one, indicating that a message that needs to be processed using the target SA data in the i-th storage unit is added at this time. Further, after the subsequent processing engine completes the processing of the target message according to the target SA data in the i-th storage unit, the counter of the i-th storage unit is decremented by one, indicating that a message that needs to be processed using the target SA data in the i-th storage unit is reduced at this time.

[0105] Optionally, if the current count of the counter of a certain storage unit is 0, it indicates that there is no message in the communication system that needs to be processed using the SA data in the storage unit. In order to maximize the utilization of the storage unit, the storage unit is recycled at this time, and the SA data currently stored in the storage unit is deleted, so as to realize the timely release of the storage resource of the storage unit. The storage unit after the release of the storage resource can be used to store new SA data.

[0106] From the above, according to the technical solution of the present application, in the process of processing messages, when the data reading controller reads a message metadata each time, it first detects whether the target cache stores the target negotiation data (such as SA data) corresponding to the message metadata. If the target cache stores the target negotiation data corresponding to the message metadata, the message metadata and the target negotiation data are directly sent to the scheduling controller, without reading the corresponding SA data in the DDR memory each time, thereby realizing the purpose of using local cache to hide the high delay of DDR memory reading, effectively improving the bandwidth utilization of DDR memory, and avoiding the problem of long data processing delay. Especially when processing a large number of messages, using the technical solution of the present application can realize that a considerable proportion of message metadata directly reads SA data from the target cache, without querying SA data from the DDR memory, thereby realizing the technical effect of improving the processing efficiency of the whole message.

[0107] In addition, the present application also adopts the design of N processing engines for parallel processing of multiple messages. Compared with the method of using one processing engine to process all messages, the technical solution of the present application can further improve the processing efficiency of messages.

[0108] According to another aspect of the present application, an embodiment of a message processing device is also provided, as shown in Figure 4 The message processing device comprises a detection unit 401, a first processing unit 402, a second processing unit 403, and a third processing unit 404.

[0109] Optionally, the detection unit 401 is configured to, in the case that the target packet is received, detect, by the data reading controller, whether the target negotiation data corresponding to the packet metadata carried by the target packet is stored in a target cache, wherein the target cache is configured to cache negotiation data being used in the communication system, and the negotiation data represents data encryption protocol information negotiated by the two communication parties; the first processing unit 402 is configured to, in the case that the target negotiation data is detected to be stored in the target cache, send the packet metadata and the target negotiation data to a scheduling controller; the second processing unit 403 is configured to send, by the scheduling controller, the packet metadata and the target negotiation data to any one of N processing engines in an idle state, wherein N is an integer greater than 1, and the N processing engines are configured to process a plurality of packets in a parallel processing manner; and the third processing unit 404 is configured to process, by the processing engine in the idle state, the target packet according to the packet metadata and the target negotiation data.

[0110] Optionally, the packet processing apparatus further comprises a fourth processing unit and a fifth processing unit. The fourth processing unit is configured to, in the case that the target negotiation data is detected not to be stored in the target cache, send the packet metadata to any one of M negotiation data receiving stations in an idle state, wherein M is an integer greater than 1, and the negotiation data receiving station is configured to read negotiation data in a target memory; and the fifth processing unit is configured to read, by the negotiation data receiving station in the idle state, the target negotiation data corresponding to the packet metadata from the target memory, and send the target negotiation data and the packet metadata to the scheduling controller, and store the target negotiation data in the target cache.

[0111] Optionally, the target cache comprises a plurality of storage units, each of the plurality of storage units is configured to store a complete negotiation data, and the packet processing apparatus further comprises a sixth processing unit and a seventh processing unit. The sixth processing unit is configured to, in the case that the data reading controller receives the packet metadata of the target packet, and the target negotiation data of the target packet is detected to be stored in an i-th storage unit, perform an increment operation on a counter of the i-th storage unit, wherein the increment operation represents that a packet needing to be processed by using the target negotiation data in the i-th storage unit is added, and the i-th storage unit is any one of the plurality of storage units; and the seventh processing unit is configured to, in the case that the target packet is detected to be processed by any one of the processing engines, perform a decrement operation on the counter of the i-th storage unit, wherein the decrement operation represents that a packet needing to be processed by using the target negotiation data in the i-th storage unit is reduced.

[0112] Optionally, the packet processing apparatus further comprises a first determining unit and a recycling operation unit. The first determining unit is configured to determine that there is no packet in the communication system that needs to be processed by using the target negotiation data in the i th storage unit when detecting that the current count of the counter of the i th storage unit is 0; and the recycling operation unit is configured to perform a recycling operation on the i th storage unit, wherein the recycling operation is used to control the i th storage unit to delete the target negotiation data and allow other negotiation data to be stored in addition to the target negotiation data.

[0113] Optionally, the second processing unit 403 comprises a first determining subunit, a first obtaining subunit, a first processing subunit, a second processing subunit and a third processing subunit. The first determining subunit is configured to determine a result cache area in an idle state from a plurality of result cache areas as a first cache area, wherein the result cache area is used to store metadata generated after processing a packet; the first obtaining subunit is configured to obtain a packet identifier of a target packet and a region identifier of the first cache area; the first processing subunit is configured to form a queue element by using the packet identifier and the region identifier; the second processing subunit is configured to add the queue element to a sequence preserving queue corresponding to the target negotiation data, wherein the j th queue element in the sequence preserving queue enters the sequence preserving queue at a time earlier than the j+1 th queue element enters the sequence preserving queue, and j is an integer greater than or equal to 1; and the third processing subunit is configured to send the queue element formed by the packet identifier and the region identifier, the packet metadata and the target negotiation data to any processing engine in an idle state in the N processing engines.

[0114] Optionally, the packet processing apparatus further comprises a first obtaining unit and a writing unit. The first obtaining unit is configured to obtain target metadata generated in a processing process of a target packet by a processing engine in an idle state according to packet metadata and target negotiation data in the process of controlling the processing engine to process the target packet according to the packet metadata and the target negotiation data, wherein the target metadata is used to describe a processing result of the target packet; and the writing unit is configured to write the target metadata into the first cache area and mark a state of the first cache area as a target state, wherein the target state represents that the target packet has been processed.

[0115] Optionally, the packet processing apparatus further comprises a first detection unit, an eighth processing unit and a ninth processing unit. The first detection unit is configured to detect whether the result cache region corresponding to the region identifier in the first queue element in the in-order queue is marked as the target state; the eighth processing unit is configured to output the processing result of the packet corresponding to the first queue element and delete the first queue element from the in-order queue in the case that the result cache region corresponding to the region identifier in the first queue element is detected to be marked as the target state; and the ninth processing unit is configured to prohibit outputting the processing result of the packet corresponding to any one of the queue elements in the in-order queue in the case that the result cache region corresponding to the region identifier in the first queue element is detected not to be marked as the target state.

[0116] The above-mentioned embodiments or examples of the present application are not exhaustive, and only illustrate some embodiments or examples, and are not used as specific limitations on the protection scope of the present application. In the case of no contradiction, each step in a certain embodiment or example in the present application can be implemented as an independent example, and the steps can be combined arbitrarily, for example, the scheme after removing some steps in a certain embodiment or example can be implemented as an independent example, and the order of the steps in a certain embodiment or example can be exchanged arbitrarily, in addition, the optional mode or optional example in a certain embodiment or example can be combined arbitrarily; in addition, the embodiments or examples can be combined arbitrarily, for example, the steps of different embodiments or examples can be combined arbitrarily, a certain embodiment or example can be combined with the optional mode or optional example of other embodiments or examples.

[0117] The above-mentioned embodiment numbers of the present application are only for description, and do not represent the advantages or disadvantages of the embodiments.

[0118] In the above-mentioned embodiments of the present application, the description of each embodiment has its own emphasis, and the parts not described in detail in a certain embodiment can be referred to the related description of other embodiments.

[0119] In the several embodiments of the present application, it should be understood that the disclosed technology can be implemented in other ways. The above-mentioned device embodiments are only illustrative, for example, the division of the units can be a logical function division, and actual implementation can have another division mode, for example, a plurality of units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the displayed or discussed each other can be through some interface, indirect coupling or communication connection between units or modules, which can be electrical or other forms.

[0120] The units described as separate components may or may not be physically separate, and the components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple units. Part or all of the units can be selected according to actual needs to achieve the purpose of the embodiment scheme.

[0121] In addition, the functional units in each embodiment of the present application can be integrated in one processing unit, or each unit can be physically present alone, or two or more units can be integrated in one unit. The integrated unit can be realized in the form of hardware or in the form of a software functional unit.

[0122] The integrated unit, if realized in the form of a software functional unit and sold or used as an independent product, can be stored in a computer readable storage medium. Based on this understanding, the technical solutions of the present application essentially or the part of the prior art that contributes to the technical solutions or all or part of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes a plurality of instructions for causing a computer device (which can be a personal computer, a server or a network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The foregoing storage medium includes: a U disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a mobile hard disk, a magnetic disk or an optical disk, and various program code storage media.

[0123] The above is only the preferred embodiment of the present application, and it should be pointed out that for those skilled in the art, without departing from the principles of the present application, a number of improvements and refinements can be made, which should be considered as the protection scope of the present application.

Claims

1. A message processing method, characterized in that, include: Upon receiving a target message, the data reading controller detects whether the target cache stores target negotiation data corresponding to the message metadata carried by the target message. The target cache is used to cache negotiation data currently in use in the communication system, and the negotiation data represents the data encryption protocol information negotiated by the two communicating parties. If it is detected that the target negotiation data has been stored in the target cache, the message metadata and the target negotiation data are sent to the scheduling controller; The scheduling controller sends the message metadata and the target negotiation data to any one of the N processing engines that is in an idle state, where N is an integer greater than 1. The N processing engines are used to process multiple messages in parallel. The idle processing engine processes the target message based on the message metadata and the target negotiation data. After detecting whether target negotiation data corresponding to the packet metadata carried by the target packet is stored in the target cache through the data read controller, the packet processing method further includes: if the target negotiation data is not stored in the target cache, sending the packet metadata to any one of the M negotiation data receiving stations that is in an idle state, where M is an integer greater than 1, and the negotiation data receiving station is used to read the negotiation data in the target memory; reading the target negotiation data corresponding to the packet metadata from the target memory through the negotiation data receiving station in the idle state, and sending the target negotiation data and the packet metadata to the scheduling controller, and storing the target negotiation data in the target cache.

2. The message processing method according to claim 1, characterized in that, The target cache includes multiple storage units, each of which stores a complete set of negotiation data. The message processing method further includes: When the data read controller receives the message metadata of the target message and detects that the target negotiation data of the target message is stored in the i-th storage unit, it increments the counter of the i-th storage unit by one. The increment operation represents the addition of a new message that needs to be processed using the target negotiation data in the i-th storage unit. The i-th storage unit is any one of the plurality of storage units. After detecting that the target message has been processed by any of the processing engines, the counter of the i-th storage unit is decremented by one, wherein the decrement operation represents the reduction of one message that needs to be processed using the target negotiation data in the i-th storage unit.

3. The message processing method according to claim 2, characterized in that, The message processing method further includes: When the current count of the counter in the i-th storage unit is detected to be 0, it is determined that there is no message in the communication system that needs to be processed using the target negotiation data in the i-th storage unit; A recycling operation is performed on the i-th storage unit, wherein the recycling operation is used to control the i-th storage unit to delete the target negotiated data and allow the storage of other negotiated data besides the target negotiated data.

4. The message processing method according to claim 1, characterized in that, The scheduling controller sends the message metadata and the target negotiation data to any one of the N processing engines that is in an idle state, including: The first cache area is determined from multiple result cache areas as an idle cache area, wherein the result cache area is used to store the metadata generated after each message is processed; Obtain the message identifier of the target message and the region identifier of the first buffer area; Combine the message identifier and the region identifier into a queue element; The queue element is added to the order-preserving queue corresponding to the target negotiation data, wherein the time when the j-th queue element enters the order-preserving queue is earlier than the time when the (j+1)-th queue element enters the order-preserving queue, and j is an integer greater than or equal to 1. The queue element consisting of the message identifier and the region identifier, the message metadata, and the target negotiation data are sent to any one of the N processing engines that is in an idle state.

5. The message processing method according to claim 4, characterized in that, After sending the queue element consisting of the message identifier and the region identifier, the message metadata, and the target negotiation data to any one of the N processing engines that is in an idle state, the message processing method further includes: During the process of controlling the idle processing engine to process the target packet based on the packet metadata and the target negotiation data, the target metadata generated during the processing of the target packet is obtained, wherein the target metadata is used to describe the processing result of the target packet; The target metadata is written into the first cache area, and the status of the first cache area is marked as the target status, wherein the target status indicates that the target message has been processed.

6. The message processing method according to claim 4 or 5, characterized in that, The message processing method further includes: Detect whether the result cache region corresponding to the region identifier in the first queue element of the ordered queue is marked as the target state; If the result cache region corresponding to the region identifier in the first queue element is detected to be marked as the target state, the processing result of the message corresponding to the first queue element is output, and the first queue element is deleted from the order-keeping queue. If the result cache region corresponding to the region identifier in the first queue element is not marked as the target state, the processing result of the message corresponding to any queue element in the order-keeping queue shall be prohibited from being output.

7. A message processing system, characterized in that, include: A target cache is used to cache negotiation data currently in use in the communication system, wherein the negotiation data represents data security information negotiated and used by both communicating parties; A data reading controller is configured to, upon receiving a target message, detect whether target negotiation data corresponding to the message metadata carried by the target message is stored in the target cache; and if the target negotiation data is detected in the target cache, send the message metadata and the target negotiation data to the scheduling controller. The scheduling controller is used to send the message metadata and the target negotiation data to any one of the N processing engines that is in an idle state, where N is an integer greater than 1, and the N processing engines are used to process multiple messages in a parallel processing manner. The N processing engines, wherein the processing engine in the idle state among the N processing engines is used to process the target message based on the message metadata and the target negotiation data; The message processing system further includes: M negotiation data receiving stations, each of which is used to read negotiation data from the target memory, where M is an integer greater than 1; the data reading controller is further used to send the message metadata to any one of the M negotiation data receiving stations that is in an idle state when it is detected that the target negotiation data does not exist in the target cache; the negotiation data receiving station in the idle state is used to read the target negotiation data corresponding to the message metadata from the target memory, send the target negotiation data and the message metadata to the scheduling controller, and store the target negotiation data in the target cache.

8. A message processing apparatus for implementing the message processing method according to any one of claims 1 to 6, characterized in that, include: The detection unit is used to detect, upon receiving a target message, whether the target cache stores target negotiation data corresponding to the message metadata carried by the target message through the data reading controller. The target cache is used to cache negotiation data currently in use in the communication system, and the negotiation data represents the data encryption protocol information negotiated by the two communicating parties. The first processing unit is configured to send the message metadata and the target negotiation data to the scheduling controller when it is detected that the target negotiation data has been stored in the target cache. The second processing unit is used to send the message metadata and the target negotiation data to any one of the N processing engines that is in an idle state through the scheduling controller, where N is an integer greater than 1, and the N processing engines are used to process multiple messages in a parallel processing manner. The third processing unit is used to process the target message based on the message metadata and the target negotiation data through the processing engine in the idle state.

Images