Multi-core parallel encryption and decryption device

Abstract

The invention provides a multi-core parallel encryption and decryption device, which is characterized in that a plurality of to-be-encrypted and decrypted data packets stored in a DRAM (Dynamic Random Access Memory) are distributed to a plurality of encryption and decryption control modules of an encryption and decryption micro-engine through the set encryption and decryption micro-engine, and the data packets are encrypted and decrypted through each encryption and decryption control module; and respectively calling the DMA controller to copy each data packet to be encrypted and decrypted to the SRAM memory, and respectively calling each encryption and decryption hardware circuit core to perform encryption and decryption operation on a message to be encrypted and decrypted in each data packet to be encrypted and decrypted, so that the parallel operation of each data packet to be encrypted and decrypted is realized, and each operation process is kept independent and does not interfere with each other. The execution efficiency of encryption and decryption operation is greatly improved, the problem that in the prior art, due to the fact that an intelligent network card uses a single hardware encryption and decryption circuit, the operational capability is limited, and performance indexes of a high-speed network are difficult to reach is solved, and the intelligent network card is helped to rapidly process large-flow real-time services.

Description

Technical Field

[0001] The present application relates to the field of network communication technology, and in particular to a multi-core parallel encryption and decryption device. Background Art

[0002] DPU (Data Processing Unit) is often used as an offload engine for CPU (Central Processing Unit). It solves the resource overhead problem of CPU by offloading complex operations from CPU to DPU. The network interface is an ideal privacy boundary. To ensure information security and protect data from being obtained or tampered by unauthorized third parties during data transmission, network data packets need to be encrypted and decrypted. However, the encryption and decryption algorithm overhead is very large, such as the asymmetric encryption algorithm SM2, hash algorithm SM3 and symmetric block cipher algorithm SM4 of the national cryptographic standard. If the CPU (Central Processing Unit) is used for processing, only a small amount of data can be encrypted and decrypted; and if the high-speed network of 25G / 40G / 100G is considered, it is almost impossible for the CPU to complete this task; therefore, it is necessary to transfer this encryption and decryption algorithm to the DPU (Data Processing Unit) for execution to reduce the burden on the CPU and improve the overall performance of the system and network performance.

[0003] Smart NIC is a hardware device with network communication and data processing capabilities, which can implement encryption and decryption operations through hardware. Therefore, the encryption and decryption operations of network data packets are offloaded to the Smart NIC hardware in an inline manner, which has gradually replaced the solution of using dedicated encryption and decryption chip devices.

[0004] However, currently, smart network cards only use a single hardware encryption and decryption circuit to process input network data packets one by one, and their computing power is limited. Especially when processing large-volume real-time services (such as IPsec-encapsulated security data), they often need to be queued for processing, making it difficult to achieve the performance indicators of high-speed networks. Summary of the invention

[0005] In view of the above-mentioned shortcomings of the prior art, the purpose of this application is to provide a multi-core parallel encryption and decryption device to solve the problem that the computing power of the smart network card in the prior art is limited due to the use of a single hardware encryption and decryption circuit, which makes it difficult to achieve the performance indicators of high-speed networks.

[0006] To achieve the above-mentioned purpose and other related purposes, the first aspect of the present application provides a multi-core parallel encryption and decryption device, which includes: a DRAM memory, an SRAM memory, a DMA controller, an encryption and decryption microengine and a plurality of encryption and decryption hardware circuit cores; wherein the encryption and decryption microengine is respectively connected to the DMA controller and each encryption and decryption hardware circuit core, the DMA controller is respectively connected to the DRAM memory and the SRAM memory, and each encryption and decryption hardware circuit core is respectively connected to the SRAM memory; the encryption and decryption microengine includes: a plurality of encryption and decryption control modules, each of which is respectively connected to one of the encryption and decryption hardware circuit cores; the encryption and decryption microengine is used to distribute a plurality of data packets to be encrypted and decrypted stored in the DRAM memory to each of the encryption and decryption control modules, and to call the DMA controller and the encryption and decryption hardware circuit cores respectively through each of the encryption and decryption control modules, so as to perform encryption and decryption operations on the messages to be encrypted and decrypted in each data packet to be encrypted and decrypted in parallel, and generate encryption and decryption data and authentication data of the messages to be encrypted and decrypted.

[0007] In some embodiments of the first aspect of the present application, the method of calling the DMA controller and the connected encryption and decryption hardware circuit core through the encryption and decryption control module to perform encryption and decryption operations on the messages to be encrypted and decrypted in each data packet to be encrypted and decrypted includes: calling the DMA controller through the encryption and decryption control module to copy the allocated data packet to be encrypted and decrypted from the DRAM memory to the SRAM memory; wherein the data packet to be encrypted and decrypted includes: the message to be encrypted and decrypted and the encryption and decryption algorithm parameters and authentication algorithm parameters of the message to be encrypted and decrypted; calling the connected encryption and decryption hardware circuit core through the encryption and decryption control module to perform encryption and decryption operations on the message to be encrypted and decrypted according to the encryption and decryption algorithm parameters and the authentication algorithm parameters to generate encryption and decryption data and authentication data of the message to be encrypted and decrypted and store them in the SRAM memory; calling the DMA controller again through the encryption and decryption control module to copy the encryption and decryption data and the authentication data from the SRAM memory to the DRAM memory.

[0008] In some embodiments of the first aspect of the present application, each of the encryption and decryption hardware circuit cores includes: an encryption and decryption instruction buffer for storing a preset encryption and decryption operation instruction set and an encryption and decryption operation parameter set.

[0009] In some embodiments of the first aspect of the present application, the method of calling the DMA controller and the connected encryption and decryption hardware circuit core through the encryption and decryption control module to perform encryption and decryption operations on the messages to be encrypted and decrypted in each data packet to be encrypted and decrypted also includes: after copying the messages to be encrypted and decrypted in the data packet to be encrypted and decrypted and the encryption and decryption algorithm parameters and authentication algorithm parameters of the messages to be encrypted and decrypted to the SRAM memory, the SRAM addresses of the stored data are written into the encryption and decryption operation parameter set of the encryption and decryption instruction buffer through the encryption and decryption control module; after storing the encryption and decryption data and authentication data of the messages to be encrypted and decrypted in the SRAM memory, the SRAM addresses of the stored data are written into the encryption and decryption operation parameter set of the encryption and decryption instruction buffer through the encryption and decryption control module.

[0010] In some embodiments of the first aspect of the present application, the encryption and decryption execution instruction set is initialized to the encryption and decryption instruction buffer of each encryption and decryption hardware circuit core when the encryption and decryption microengine is started, including: encryption and decryption algorithm execution instructions, authentication algorithm execution instructions, encryption and decryption algorithm parameter read and write instructions, authentication algorithm parameter read and write instructions, to-be-encrypted and decrypted message read and write instructions, and data write back instructions.

[0011] In some embodiments of the first aspect of the present application, the method of generating encryption and decryption data and authentication data of the message to be encrypted and decrypted includes: calling the connected encryption and decryption hardware circuit core through the encryption and decryption control module, and executing the read and write instructions of the message to be encrypted and decrypted stored in the encryption and decryption instruction buffer to obtain the SRAM address for storing the encryption and decryption message and the message to be encrypted and decrypted; calling the connected encryption and decryption hardware circuit core through the encryption and decryption control module, and executing the encryption and decryption algorithm parameter read and write instructions stored in the encryption and decryption instruction buffer to obtain the SRAM address for storing the encryption and decryption algorithm parameters and the encryption and decryption algorithm parameters; calling the connected encryption and decryption hardware circuit core through the encryption and decryption control module, and executing the encryption and decryption algorithm execution instructions stored in the encryption and decryption instruction buffer according to the acquired encryption and decryption algorithm parameters, and performing the operation of the encryption and decryption algorithm to obtain the encryption and decryption algorithm parameters. The message performs encryption and decryption operations to generate encryption and decryption data of the message to be encrypted and decrypted; the encryption and decryption control module calls the connected encryption and decryption hardware circuit core, and executes the authentication algorithm parameter read and write instructions stored in the encryption and decryption instruction buffer to obtain the SRAM address and the authentication algorithm parameters used to store the authentication algorithm parameters; the encryption and decryption control module calls the connected encryption and decryption hardware circuit core, and according to the obtained authentication algorithm parameters, executes the authentication algorithm execution instructions stored in the encryption and decryption instruction buffer, and performs authentication operations on the obtained message to be encrypted and decrypted to generate the authentication data of the message to be encrypted and decrypted; the encryption and decryption control module calls the connected encryption and decryption hardware circuit core, and executes the data write back instructions stored in the encryption and decryption instruction buffer to write the generated encryption and decryption data and the authentication data back to the SRAM memory.

[0012] In some embodiments of the first aspect of the present application, the DRAM memory includes: multiple DRAM address partitions; each DRAM address partition is used to store a data packet to be encrypted and decrypted and the encryption and decryption data and authentication data of the message to be encrypted and decrypted.

[0013] In some embodiments of the first aspect of the present application, the multi-core parallel encryption and decryption device also includes: a data output module, connected to the DRAM memory, used to send the data packets to be encrypted and decrypted stored in the DRAM memory and the encryption and decryption data and authentication data of the encrypted and decrypted messages to an external device, and release the corresponding DRAM address partition.

[0014] In some embodiments of the first aspect of the present application, the SRAM memory includes: multiple SRAM address partitions; each SRAM address partition is used to store a data packet to be encrypted and decrypted copied from the DRAM memory by the DMA controller, as well as encryption and decryption data and authentication data of the message to be encrypted and decrypted generated; when the encryption and decryption data and the authentication data are copied from the SRAM memory to the DRAM memory, the corresponding SRAM address partition is released.

[0015] In some embodiments of the first aspect of the present application, the encryption and decryption microengine includes: multiple protocol encapsulation modules, which are respectively connected to the DRAM memory; each protocol encapsulation module obtains the corresponding data packet to be encrypted and decrypted stored in the DRAM memory, and performs a protocol encapsulation operation on each message to be encrypted and decrypted therein to generate header data of each message to be encrypted and decrypted; each message to be encrypted and decrypted and the corresponding header data are stored together in the DRAM memory, so that each encryption and decryption control module can call the DMA controller and the encryption and decryption hardware circuit connected to each of them to perform encryption and decryption operations on each message to be encrypted and decrypted.

[0016] As described above, the present application has the following beneficial effects: the present application provides a multi-core parallel encryption and decryption device, which distributes multiple data packets to be encrypted and decrypted stored in a DRAM memory to multiple encryption and decryption control modules of the encryption and decryption microengine through the set encryption and decryption microengine, and through each encryption and decryption control module, respectively calls the DMA controller to copy each data packet to be encrypted and decrypted to the SRAM memory, and respectively calls each encryption and decryption hardware circuit core to perform encryption and decryption operations on the messages to be encrypted and decrypted in each data packet to be encrypted and decrypted, thereby realizing parallel operations on each data packet to be encrypted and decrypted, and each operation process remains independent and does not interfere with each other, greatly improving the execution efficiency of encryption and decryption operations, and solving the problem in the prior art that the intelligent network card has limited computing power due to the use of a single hardware encryption and decryption circuit and is difficult to achieve the performance indicators of high-speed networks, which helps the intelligent network card to quickly process real-time services with large traffic. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 Shown is a schematic diagram of the structure of a multi-core parallel encryption and decryption device in one embodiment of the present application.

[0018] Figure 2 Shown is a flowchart of performing encryption and decryption operations in one embodiment of the present application.

[0019] Figure 3 Shown is a schematic diagram of the structure of the encryption and decryption hardware circuit core in one embodiment of the present application.

[0020] Figure 4Shown is a flowchart of a method for encrypting and decrypting data and generating authentication data in one embodiment of the present application.

[0021] Figure 5 Shown is a schematic diagram of the structure of a quad-core parallel encryption and decryption device in a specific embodiment of the present application. DETAILED DESCRIPTION

[0022] The following describes the embodiments of the present application through specific examples, and those skilled in the art can easily understand other advantages and effects of the present application from the contents disclosed in this specification. The present application can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed in various ways based on different viewpoints and applications without departing from the spirit of the present application. It should be noted that the following embodiments and features in the embodiments can be combined with each other without conflict.

[0023] The technical solutions of the embodiments of the present application can be applied to various communication systems, such as: Long Term Evolution (LTE) system, LTE frequency division duplex (FDD) system, future fifth generation (5G) communication system, new radio access technology (NR), LTE time division duplex (TDD), Worldwide Interoperability for Microwave Access (WiMAX), Universal Mobile Telecommunication System (UMTS), and vehicle-to-XV2X. Among them, V2X can include vehicle to network (V2N), vehicle to vehicle (V2V), vehicle to infrastructure (V2I), vehicle to pedestrian (V2P), Long Term Evolution-Vehicle (LTE-V), Internet of Vehicles, machine type communication (MTC), Internet of Things (IoT), Long Term Evolution-Machine (LTE-M), machine to machine (M2M), etc.

[0024] In order to solve the problems in the above-mentioned background technology, the present invention provides a multi-core parallel encryption and decryption device, which aims to solve the problem in the prior art that the intelligent network card only uses a single hardware encryption and decryption circuit, resulting in limited computing power and difficulty in achieving the performance indicators of high-speed networks. A multi-core parallel approach is adopted to perform encryption and decryption operations on multiple data packets to be encrypted and decrypted input into the intelligent network card, thereby improving the computing power of the intelligent network card and meeting the performance indicators of high-speed networks.

[0025] At the same time, in order to make the purpose, technical solution and advantages of the present invention more clear, the technical solution in the embodiment of the present invention is further described in detail through the following embodiments and in combination with the accompanying drawings. It should be understood that the specific embodiments described here are only used to explain the present invention and are not used to limit the invention.

[0026] like Figure 1 As shown, a schematic diagram of the structure of a multi-core parallel encryption and decryption device in an embodiment of the present invention is shown. The multi-core parallel encryption and decryption device in this embodiment is used to perform encryption and decryption operations on multiple data packets to be encrypted and decrypted input into the smart network card, and send the generated data to an external device through the smart network card. The multi-core parallel encryption and decryption device includes: DRAM memory 1, SRAM memory 2, DMA controller 3, encryption and decryption microengine 4 and multiple encryption and decryption hardware circuit cores 5.

[0027] Among them, Figure 1 As shown, the encryption / decryption microengine 4 is respectively connected to the DMA controller and each encryption / decryption hardware circuit core 5, the DMA controller 3 is respectively connected to the DRAM memory 1 and the SRAM memory 2, and each encryption / decryption hardware circuit core 5 is respectively connected to the SRAM memory. In addition, the encryption / decryption microengine 4 includes: a plurality of encryption / decryption control modules 41; each of the encryption / decryption control modules 41 is respectively connected to one of the encryption / decryption hardware circuit cores 5.

[0028] Specifically, the encryption and decryption microengine 4 is used to distribute the multiple data packets to be encrypted and decrypted stored in the DRAM memory 1 to each of the encryption and decryption control modules 41, and respectively call the DMA controller 3 and the encryption and decryption hardware circuit core 5 connected to each of the encryption and decryption control modules 41 to perform encryption and decryption operations on the messages to be encrypted and decrypted in each data packet to be encrypted and decrypted in parallel, and generate encryption and decryption data and authentication data of the messages to be encrypted and decrypted.

[0029] The purpose of the design of the present application in this embodiment is: through multiple encryption and decryption control modules 41, each encryption and decryption hardware circuit core 5 is called respectively to perform encryption and decryption operations on each data packet to be decrypted in parallel, so that operations can be performed on multiple data packets to be encrypted and decrypted at one time, and each operation process remains independent and does not interfere with each other, thereby greatly improving the execution efficiency, effectively improving the encryption and decryption computing ability of the device, and being able to quickly process real-time services with large traffic volumes, meeting the performance indicators of high-speed networks.

[0030] In one embodiment, if Figure 2 As shown, the encryption and decryption control module 41 calls the DMA controller 3 and the connected encryption and decryption hardware circuit core 5 to perform encryption and decryption operations on the messages to be encrypted and decrypted in each data packet to be encrypted and decrypted, including steps S1 to S3.

[0031] Step S1: calling the DMA controller 3 through the encryption and decryption control module 41 to copy the allocated data packet to be encrypted and decrypted from the DRAM memory 1 to the SRAM memory 2.

[0032] In a specific embodiment, the DRAM memory 1 includes: a plurality of DRAM address partitions for storing each data packet to be encrypted and decrypted input to the smart network card. The data packet to be encrypted and decrypted includes: a message to be encrypted and decrypted and encryption and decryption algorithm parameters and authentication algorithm parameters of the message to be encrypted and decrypted. In addition, the SRAM memory 2 includes: a plurality of SRAM address partitions; each SRAM address partition is used to store a data packet to be encrypted and decrypted copied from the DRAM memory 1 by the DMA controller 3 and the encryption and decryption data and authentication data of the message to be encrypted and decrypted generated.

[0033] It should be noted that the encryption and decryption algorithm parameters include but are not limited to: the key KEY value, the security parameter index SPI value and the initialization vector IV value used in the encryption and decryption algorithm operation process. The generated authentication data includes but is not limited to: the integrity check ICV value.

[0034] Step S2: Call the connected encryption and decryption hardware circuit core 5 through the encryption and decryption control module 41, and perform encryption and decryption operations on the message to be encrypted and decrypted according to the encryption and decryption algorithm parameters and the authentication algorithm parameters to generate encryption and decryption data and authentication data of the message to be encrypted and decrypted and store them in the SRAM memory 2.

[0035] It should be noted that the present application stores the read and write data of each encryption and decryption hardware circuit core 5 in the SRAM memory, which can achieve more efficient and faster data reading and writing, thereby ensuring the computing power of the multi-core parallel encryption and decryption device and high-speed network transmission.

[0036] In a specific embodiment, if Figure 3 As shown, each of the encryption and decryption hardware circuit cores 5 includes: an encryption and decryption instruction buffer 51, which is used to store a preset encryption and decryption operation instruction set and an encryption and decryption operation parameter set.

[0037] Among them, the encryption and decryption running instruction set is initialized to the encryption and decryption instruction buffer 51 of each encryption and decryption hardware circuit core 5 when the encryption and decryption microengine 4 is started, including: encryption and decryption algorithm running instructions, authentication algorithm running instructions, encryption and decryption algorithm parameter read and write instructions, authentication algorithm parameter read and write instructions, to-be-encrypted and decrypted message read and write instructions, and data write back instructions.

[0038] The encryption and decryption operation parameter set includes: encryption and decryption algorithm parameters, authentication algorithm parameters, messages to be encrypted and decrypted, and the SRAM addresses of the corresponding encryption and decryption data and authentication data generated in the SRAM memory 2. The initialization method includes: after copying the messages to be encrypted and decrypted in the data packets to be encrypted and decrypted and the encryption and decryption algorithm parameters and authentication algorithm parameters of the messages to be encrypted and decrypted to the SRAM memory 2, the SRAM addresses storing the data are written into the encryption and decryption operation parameter set of the encryption and decryption instruction buffer 51 through the encryption and decryption control module 41; and after storing the encryption and decryption data and authentication data of the messages to be encrypted and decrypted in the SRAM memory 2, the SRAM addresses storing the data are written into the encryption and decryption operation parameter set of the encryption and decryption instruction buffer 51 through the encryption and decryption control module 41.

[0039] In this application, the encryption and decryption algorithms supported by each encryption and decryption hardware circuit core mainly include mainstream cryptographic algorithms such as AES, CHACHA and SM4, and the supported authentication algorithms mainly include mainstream hash algorithms such as SHA-1, SHA-256, SHA-384, SHA-512, GF-128, POLY1305 and SM3.

[0040] The purpose of the design of the present application in this embodiment is to use a preset encryption and decryption operation instruction set and an encryption and decryption operation parameter set to implement the call of each of the encryption and decryption hardware circuit cores 5, which can effectively improve the instruction execution efficiency of each of the encryption and decryption hardware circuit cores 5, thereby further improving the computing power of the multi-core parallel encryption and decryption device.

[0041] In a specific embodiment, if Figure 4 As shown, the method of generating the encryption and decryption data and the authentication data of the message to be encrypted and decrypted includes steps S21 to S26.

[0042] Step S21: calling the connected encryption and decryption hardware circuit core 5 through the encryption and decryption control module 41, and executing the read and write instructions of the message to be encrypted and decrypted stored in the encryption and decryption instruction buffer 51 to obtain the SRAM address for storing the encryption and decryption message and the message to be encrypted and decrypted.

[0043] Step S22: calling the connected encryption and decryption hardware circuit core 5 through the encryption and decryption control module 41, and executing the encryption and decryption algorithm parameter read and write instructions stored in the encryption and decryption instruction buffer 51 to obtain the SRAM address for storing the encryption and decryption algorithm parameters and the encryption and decryption algorithm parameters.

[0044] Step S23: The encryption and decryption control module 41 calls the connected encryption and decryption hardware circuit core 5, and according to the acquired encryption and decryption algorithm parameters, runs the encryption and decryption algorithm running instructions stored in the encryption and decryption instruction buffer 51, performs encryption and decryption operations on the message to be encrypted and decrypted, so as to generate encryption and decryption data of the message to be encrypted and decrypted.

[0045] Step S24: calling the connected encryption and decryption hardware circuit core 5 through the encryption and decryption control module 41 to execute the authentication algorithm parameter read and write instructions stored in the encryption and decryption instruction buffer 51 to obtain the SRAM address for storing the authentication algorithm parameters and the authentication algorithm parameters.

[0046] Step S25: The encryption and decryption control module 41 calls the connected encryption and decryption hardware circuit core 5, and runs the authentication algorithm running instructions stored in the encryption and decryption instruction buffer 51 according to the acquired authentication algorithm parameters, and performs authentication operations on the message to be encrypted and decrypted to generate authentication data of the message to be encrypted and decrypted.

[0047] Step S26: calling the connected encryption and decryption hardware circuit core 5 through the encryption and decryption control module 41, executing the data write-back instruction stored in the encryption and decryption instruction buffer, and writing the generated encryption and decryption data and the authentication data back to the SRAM memory 2.

[0048] It should be noted that if it is not necessary to authenticate the message to be encrypted and decrypted, there is no need to generate the corresponding authentication data, and steps S24 and S25 can be omitted, and when writing back the data, only the encryption and decryption data can be written back. Similarly, if it is not necessary to perform encryption and decryption operations on the message to be encrypted and decrypted, there is no need to generate the corresponding encryption and decryption data, and steps S22 and S23 can be omitted, and when writing back the data, only the authentication data can be written back. Therefore, the present application calls the encryption and decryption hardware circuit to check whether encryption and decryption data and authentication data are generated during the encryption and decryption operation of the message to be encrypted and decrypted, which can be set according to demand and is not limited by the present application.

[0049] In one embodiment, the encryption / decryption micro-engine 4 includes: a plurality of protocol encapsulation modules, each of which is connected to the DRAM memory.

[0050] Thus, the encryption / decryption microengine 4 can first perform protocol encapsulation on the message to be encrypted / decrypted before performing encryption / decryption operation on the message to be encrypted / decrypted. The specific method includes: obtaining the corresponding data packets to be encrypted / decrypted stored in the DRAM memory 1 through each of the protocol encapsulation modules, and performing protocol encapsulation operation on each of the messages to be encrypted / decrypted therein, and generating the header data of each message to be encrypted / decrypted; storing each message to be encrypted / decrypted and the corresponding header data together in the DRAM memory 1, so that each of the encryption / decryption control modules 41 can respectively call the DMA controller 3 and the encryption / decryption hardware circuit core 5 connected thereto to perform encryption / decryption operation on each message to be encrypted / decrypted.

[0051] It should be noted that, in this embodiment, the header data of the message to be encrypted and decrypted generated by the protocol encapsulation module is stored in the same DRAM address partition as the message to be encrypted and decrypted, and when the encryption and decryption control module 41 calls the DMA controller 3 to copy the data packet to be encrypted and decrypted from the DRAM memory 1 to the SRAM memory 2, the DMA controller 3 also copies from the DRAM memory 1 to the SRAM memory 2, thereby providing a parameter basis for performing encryption and decryption operations on the message to be encrypted and decrypted.

[0052] Specifically, the header data refers to metadata in a network request or response message, which provides additional information about the request or response, such as the type of data, language, encoding method, etc. that the client can accept.

[0053] Taking an IPsec protocol message as an example, in tunnel mode, the method of performing protocol encapsulation on it includes: adding IP header data and ESP header data, and encapsulating them in a new IPO data packet for transmission.

[0054] Step S3: the encryption / decryption control module 41 calls the DMA controller 3 again to copy the encryption / decryption data and the authentication data from the SRAM memory 2 to the DRAM memory 1 .

[0055] In a preferred embodiment, after the encryption and decryption data and the authentication data are copied from the SRAM memory 2 to the DRAM memory 1, the corresponding SRAM address partition is released to facilitate the multi-core parallel encryption and decryption device to continue to perform subsequent encryption and decryption operations.

[0056] In one embodiment, the multi-core parallel encryption and decryption device further includes: a data output module. The data output module is connected to the DRAM memory 1, and is used to send the data packet to be encrypted and decrypted stored in the DRAM memory 1 and the encryption and decryption data and authentication data of the encrypted and decrypted message to an external device, and release the corresponding DRAM address partition, so that the multi-core parallel encryption and decryption device can continue to perform subsequent encryption and decryption operations, thereby improving the resource utilization of the DRAM memory.

[0057] In order to better describe the specific structure of a multi-core parallel encryption and decryption device and the specific process of performing encryption and decryption operations on multiple packets to be encrypted and decrypted input into a smart network card in parallel through the device, the present application provides a specific embodiment for describing in detail the structure of a quad-core parallel encryption and decryption device and the process of performing encryption operations using the device.

[0058] Embodiment: A quad-core parallel encryption and decryption device 500.

[0059] like Figure 5 As shown, the quad-core parallel encryption and decryption device 500 includes: a DRAM memory 501 , an SRAM memory 502 , a DMA controller 503 , an encryption and decryption micro-engine 504 , and four encryption and decryption hardware circuit cores 505 .

[0060] The DRAM memory 501 includes: four DRAM address partitions, namely, a first DRAM address partition, a second DRAM address partition, a third DRAM address partition, and a fourth DRAM address partition, which can be used to store four different data packets to be encrypted and decrypted; the SRAM memory 502 includes: four SRAM address partitions corresponding to the DRAM address partitions one by one, namely, a first SRAM address partition, a second SRAM address partition, a third SRAM address partition, and a fourth SRAM address partition, which can be used to store four different data packets to be encrypted and decrypted copied from each DRAM address partition of the DRAM memory 501 through the DMA controller; the encryption and decryption microengine 504 includes: The four protocol encapsulation modules and the four encryption and decryption control modules 5042 respectively connected to the protocol encapsulation modules are respectively the first protocol encapsulation module 5041, the second protocol encapsulation module 5041, the third protocol encapsulation module 5041, the fourth protocol encapsulation module 5041, the first encryption and decryption control module 5042, the second encryption and decryption control module 5042, the third encryption and decryption control module 5042 and the fourth encryption and decryption control module 5042; each encryption and decryption hardware circuit core 505 is respectively the first encryption and decryption hardware circuit core 505, the second encryption and decryption hardware circuit core 505, the third encryption and decryption hardware circuit core 505 and the fourth encryption and decryption hardware circuit core 505, and each includes an encryption and decryption instruction buffer for storing encryption and decryption operation instruction sets and encryption and decryption operation parameter sets.

[0061] like Figure 5 As shown, the first protocol encapsulation module 5041, the second protocol encapsulation module 5041, the third protocol encapsulation module 5041 and the fourth protocol encapsulation module 5041 of the encryption and decryption microengine 504 are respectively connected to the DRAM memory 501; the first encryption and decryption control module 5042, the second encryption and decryption control module 5042, the third encryption and decryption control module 5042 and the fourth encryption and decryption control module 5042 of the encryption and decryption microengine 504 are respectively connected to the DMA controller and each encryption and decryption hardware circuit core 505, specifically, the first encryption and decryption control module 5042 is connected to the first encryption and decryption hardware circuit core 505, the second encryption and decryption control module 5042 is connected to the second encryption and decryption hardware circuit core 505, the third encryption and decryption control module 5042 is connected to the third encryption and decryption hardware circuit core 505, and the fourth encryption and decryption control module 5042 is connected to the fourth encryption and decryption hardware circuit core 505; the DMA controller 503 is respectively connected to the DRAM memory 501 and the SRAM memory 502, and each encryption and decryption hardware circuit core 505 is respectively connected to the SRAM memory 502.

[0062] The encryption and decryption microengine 504 is used to distribute the multiple data packets to be encrypted and decrypted stored in the DRAM memory 501 to each protocol encapsulation module 5041 and each encryption and decryption control module 5042, perform protocol encapsulation operations on the messages to be encrypted and decrypted in each data packet to be encrypted and decrypted through each protocol encapsulation module 5041, and call the DMA controller 503 and the encryption and decryption hardware circuit core 505 connected to each other through each encryption and decryption control module 5042, so as to perform encryption and decryption operations on the messages to be encrypted and decrypted in each data packet to be encrypted and decrypted in parallel, and generate encryption and decryption data and authentication data of the messages to be encrypted and decrypted.

[0063] Specifically, the first protocol encapsulation module 5041 is used to perform a protocol encapsulation operation on the message to be encrypted and decrypted stored in the first DRAM address partition, and the first encryption and decryption control module 5042 is used to perform an encryption and decryption operation on the message to be encrypted and decrypted stored in the first DRAM address partition by calling the DMA controller 503 and the first encryption and decryption hardware circuit core 505; the second protocol encapsulation module 5041 is used to perform a protocol encapsulation operation on the message to be encrypted and decrypted stored in the second DRAM address partition, and the second encryption and decryption control module 5042 is used to perform an encryption and decryption operation on the message to be encrypted and decrypted stored in the second DRAM address partition by calling the DMA controller 503 and the second encryption and decryption hardware circuit core 505. The third protocol encapsulation module 5041 is used to perform protocol encapsulation operations on the messages to be encrypted and decrypted stored in the third DRAM address partition, and the third encryption and decryption control module 5042 is used to perform encryption and decryption operations on the messages to be encrypted and decrypted stored in the third DRAM address partition by calling the DMA controller 503 and the third encryption and decryption hardware circuit core 505; the fourth protocol encapsulation module 5041 is used to perform protocol encapsulation operations on the messages to be encrypted and decrypted stored in the fourth DRAM address partition, and the fourth encryption and decryption control module 5042 is used to perform encryption and decryption operations on the messages to be encrypted and decrypted stored in the fourth DRAM address partition by calling the DMA controller 503 and the fourth encryption and decryption hardware circuit core 505. It should be noted that when executing corresponding operations through each protocol encapsulation module 5041 and each encryption and decryption control module 5042, they remain independent and do not interfere with each other. After a certain operation is completed, they continue to input the next data to be encrypted and decrypted for execution without affecting the process of other modules or being affected by other modules. As a result, operations on multiple data packets to be encrypted and decrypted can be performed at one time, greatly improving execution efficiency, effectively improving the encryption and decryption computing capabilities of the device, and being able to quickly process real-time services with large traffic volumes, meeting the performance indicators of high-speed networks.

[0064] Taking the example of one of the protocol encapsulation module 5041 and the encryption and decryption control module 5042 of the quad-core parallel encryption and decryption device 500 performing encryption operation on the IPsec protocol message, the specific process is as described in steps S501 to S511.

[0065] Step S501: Acquire the IPsec protocol data packet to be encrypted stored in the first DRAM address partition of the DRAM memory 501 through the first protocol encapsulation module 5041.

[0066] Among them, the IPsec protocol data packet to be encrypted includes: the IPsec protocol message to be encrypted and the encryption algorithm parameters of the IPsec protocol message to be encrypted; if the IPsec protocol message to be encrypted needs to be authenticated, the IPsec protocol data packet to be encrypted also includes the authentication algorithm parameters of the IPsec protocol message to be encrypted.

[0067] Step S502: performing a protocol encapsulation operation on the acquired IPsec protocol messages to be encrypted, generating header data of each IPsec protocol message to be encrypted, and storing the header data in the first DRAM address partition of the DRAM memory 501 .

[0068] It should be noted that the first DRAM address partition is allocated with several DRAM addresses, which can not only store various types of data of the original IPsec protocol data packet to be encrypted, but also store various types of data subsequently generated corresponding to the IPsec protocol message to be encrypted, such as header data, including IP header data and ESP header data.

[0069] Step S503: Call the DMA controller 503 through the first encryption and decryption control module 5042 to copy the IPsec protocol data packet to be encrypted and the corresponding header data from the first DRAM address partition of the DRAM memory 501 to the first SRAM address partition of the SRAM memory 502, and write each SRAM address of the stored data into the encryption and decryption operating parameter set of the first encryption and decryption hardware circuit core 505 through the first encryption and decryption control module 5042.

[0070] Step S504: calling the first encryption and decryption hardware circuit core 505 through the first encryption and decryption control module 5042, and executing the encryption and decryption message read and write instructions in the encryption and decryption execution instruction set to obtain the SRAM address for storing the encrypted IPsec protocol message and the IPsec protocol message to be encrypted.

[0071] Step S505: calling the first encryption and decryption hardware circuit core 505 through the first encryption and decryption control module 5042, and executing the encryption and decryption algorithm parameter read and write instructions in the encryption and decryption execution instruction set to obtain the SRAM address for storing the encryption algorithm parameters and the encryption and decryption algorithm parameters.

[0072] Step S506: Call the first encryption and decryption hardware circuit core 505 through the first encryption and decryption control module 5042, run the encryption and decryption algorithm running instructions in the encryption and decryption running instruction set according to the obtained encryption algorithm parameters, perform encryption operations on the obtained IPsec protocol message to be encrypted, so as to generate ciphertext data of the IPsec protocol message to be encrypted.

[0073] Step S507: calling the first encryption and decryption hardware circuit core 505 through the first encryption and decryption control module 5042, and executing the authentication algorithm parameter read and write instructions in the encryption and decryption execution instruction set to obtain the SRAM address for storing the authentication algorithm parameters and the authentication algorithm parameters.

[0074] Step S508: Call the first encryption and decryption hardware circuit core 505 through the first encryption and decryption control module 5042, run the authentication algorithm running instructions in the encryption and decryption running instruction set according to the obtained authentication algorithm parameters, perform authentication operations on the obtained IPsec protocol message to be encrypted, so as to generate authentication data of the IPsec protocol message to be encrypted.

[0075] Step S509: Call the first encryption and decryption hardware circuit core 505 through the first encryption and decryption control module 5042, execute the data write back instruction in the encryption and decryption operation instruction set, and write the generated ciphertext data and the authentication data back to the first SRAM address partition of the SRAM memory 502, and at the same time write each SRAM address of the stored data into the encryption and decryption operation parameter set of the first encryption and decryption hardware circuit core 505.

[0076] Step S510: Call the DMA controller 503 again through the first encryption and decryption control module 5042 to copy the ciphertext data and the authentication data from the first SRAM address partition of the SRAM memory 502 to the first DRAM address partition of the DRAM memory 501, and release the first SRAM address partition.

[0077] Step S511: sending the to-be-encrypted IPsec protocol data packet stored in the DRAM memory 501 and the ciphertext data and authentication data of the encrypted IPsec protocol message therein to an external device, and releasing the first DRAM address partition.

[0078] Similarly, when the decryption operation is performed on the message to be decrypted in the decryption data packet, the principle is the same as that of the above steps S501 to S511.

[0079] In the embodiments of the present application, words such as "first" and "second" are used to distinguish the same or similar items with substantially the same functions and effects. For example, the first XX and the second XX are only used to distinguish different XXs, and do not limit their order. Those skilled in the art can understand that words such as "first" and "second" do not limit the quantity and execution order, and words such as "first" and "second" do not necessarily limit them to be different.

[0080] It should be noted that in the embodiments of the present application, words such as "exemplary" or "for example" represent examples, illustrations or descriptions. Any embodiment or design described as "exemplary" or "for example" in the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary" or "for example" is intended to present related concepts in a specific way.

[0081] In the embodiments of the present application, "at least one" refers to one or more, and "plurality" refers to two or more. "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone, where A and B can be singular or plural. The character " / " generally indicates that the previous and next associated objects are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b or c can represent: a, b, c, ab, ac, bc or abc, where a, b, c can be single or multiple.

[0082] It should be understood that the division of modules in the embodiments of the present application is schematic and is only a logical function division. There may be other division methods in actual implementation. In addition, each functional module in each embodiment of the present application may be integrated into a processor, or may exist physically separately, or two or more modules may be integrated into one module. The above-mentioned integrated modules may be implemented in the form of hardware or in the form of software functional modules.

[0083] Those of ordinary skill in the art will appreciate that the various illustrative logical blocks and steps described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or in a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel may use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0084] In the several embodiments provided in the present application, it should be understood that the device embodiments described above are only schematic, for example, the division of units is only a logical function division, and there may be other division methods in actual implementation, for example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0085] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0086] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0087] In the above embodiments, the functions of each functional unit can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions (programs). When loading and executing computer program instructions (programs) on a computer, the process or function according to the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. Computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, computer instructions can be transmitted from a website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (digital subscriber line, DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that contains one or more available media integrations. Available media may be magnetic media (e.g., floppy disks, hard disks, tapes), optical media (e.g., high-density digital video discs (DVDs), or semiconductor media (e.g., solid state disks (SSDs), etc.).

[0088] If the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk, and other media that can store program codes.

[0089] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0090] In summary, the present application provides a multi-core parallel encryption and decryption device, which distributes multiple data packets to be encrypted and decrypted stored in a DRAM memory to multiple encryption and decryption control modules of the encryption and decryption microengine through the set encryption and decryption microengine, and through each encryption and decryption control module, respectively calls the DMA controller to copy each data packet to be encrypted and decrypted to the SRAM memory, and respectively calls each encryption and decryption hardware circuit core to perform encryption and decryption operations on the messages to be encrypted and decrypted in each data packet to be encrypted and decrypted, thereby realizing parallel operations on each data packet to be encrypted and decrypted, and each operation process remains independent and does not interfere with each other, greatly improving the execution efficiency of encryption and decryption operations, and solving the problem in the prior art that the intelligent network card has limited computing power due to the use of a single hardware encryption and decryption circuit and is difficult to achieve the performance indicators of high-speed networks, which helps the intelligent network card to quickly process real-time services with large traffic.

[0091] Therefore, the present application effectively overcomes various shortcomings in the prior art and has high industrial utilization value.

[0092] The above embodiments are merely illustrative of the principles and effects of the present application and are not intended to limit the present application. Anyone familiar with the technology may modify or change the above embodiments without violating the spirit and scope of the present application. Therefore, all equivalent modifications or changes made by a person of ordinary skill in the art without departing from the spirit and technical ideas disclosed in the present application shall still be covered by the claims of the present application.

Claims

1. A multi-core parallel encryption and decryption device, characterized in that: include: DRAM memory, SRAM memory, DMA controller, encryption and decryption micro-engine and multiple encryption and decryption hardware circuit cores; The encryption / decryption microengine is connected to the DMA controller and each encryption / decryption hardware circuit core respectively, the DMA controller is connected to the DRAM memory and the SRAM memory respectively, and each encryption / decryption hardware circuit core is connected to the SRAM memory respectively; The encryption and decryption microengine includes: multiple encryption and decryption control modules, each of which is connected to one of the encryption and decryption hardware circuit cores; the encryption and decryption microengine is used to distribute multiple data packets to be encrypted and decrypted stored in the DRAM memory to each of the encryption and decryption control modules, and call the DMA controller and the encryption and decryption hardware circuit cores connected to each of the encryption and decryption control modules respectively, so as to perform encryption and decryption operations on the messages to be encrypted and decrypted in each data packet to be encrypted and decrypted in parallel, and generate encryption and decryption data and authentication data of the messages to be encrypted and decrypted.

2. The multi-core parallel encryption and decryption device according to claim 1, characterized in that: The method of calling the DMA controller and the connected encryption and decryption hardware circuit core by the encryption and decryption control module to perform encryption and decryption operations on the messages to be encrypted and decrypted in each data packet to be encrypted and decrypted includes: The DMA controller is called by the encryption and decryption control module to copy the allocated data packet to be encrypted and decrypted from the DRAM memory to the SRAM memory; wherein the data packet to be encrypted and decrypted includes: a message to be encrypted and decrypted and encryption and decryption algorithm parameters and authentication algorithm parameters of the message to be encrypted and decrypted; The encryption and decryption control module calls the connected encryption and decryption hardware circuit core, and performs encryption and decryption operations on the message to be encrypted and decrypted according to the encryption and decryption algorithm parameters and the authentication algorithm parameters, so as to generate encryption and decryption data and authentication data of the message to be encrypted and decrypted and store them in the SRAM memory; The DMA controller is called again through the encryption and decryption control module to copy the encryption and decryption data and the authentication data from the SRAM memory to the DRAM memory.

3. The multi-core parallel encryption and decryption device according to claim 2, characterized in that: Each of the encryption and decryption hardware circuit cores includes an encryption and decryption instruction buffer for storing a preset encryption and decryption operation instruction set and an encryption and decryption operation parameter set.

4. The multi-core parallel encryption and decryption device according to claim 3, characterized in that: The method of calling the DMA controller and the connected encryption and decryption hardware circuit core by the encryption and decryption control module to perform encryption and decryption operations on the messages to be encrypted and decrypted in each data packet to be encrypted and decrypted also includes: After copying the message to be encrypted and decrypted in the data packet to be encrypted and decrypted and the encryption and decryption algorithm parameters and authentication algorithm parameters of the message to be encrypted and decrypted to the SRAM memory, each SRAM address storing data is written into the encryption and decryption operation parameter set of the encryption and decryption instruction buffer through the encryption and decryption control module; After the encryption and decryption data of the message to be encrypted and decrypted and the authentication data are stored in the SRAM memory, each SRAM address storing the data is written into the encryption and decryption operation parameter set of the encryption and decryption instruction buffer through the encryption and decryption control module.

5. The multi-core parallel encryption and decryption device according to claim 3, characterized in that: The encryption and decryption operation instruction set is initialized to the encryption and decryption instruction buffer of each encryption and decryption hardware circuit core when the encryption and decryption microengine is started, and includes: Encryption and decryption algorithm running instructions, authentication algorithm running instructions, encryption and decryption algorithm parameter reading and writing instructions, authentication algorithm parameter reading and writing instructions, to-be-encrypted and decrypted message reading and writing instructions, and data write-back instructions.

6. The multi-core parallel encryption and decryption device according to claim 5, characterized in that: The method of generating the encryption and decryption data and the authentication data of the message to be encrypted and decrypted includes: Calling the connected encryption and decryption hardware circuit core through the encryption and decryption control module, running the message read and write instructions to be encrypted and decrypted stored in the encryption and decryption instruction buffer, so as to obtain the SRAM address for storing the encryption and decryption message and the message to be encrypted and decrypted; Calling the connected encryption and decryption hardware circuit core through the encryption and decryption control module, running the encryption and decryption algorithm parameter read and write instructions stored in the encryption and decryption instruction buffer, so as to obtain the SRAM address for storing the encryption and decryption algorithm parameters and the encryption and decryption algorithm parameters; The encryption and decryption control module calls the connected encryption and decryption hardware circuit core, runs the encryption and decryption algorithm running instructions stored in the encryption and decryption instruction buffer according to the acquired encryption and decryption algorithm parameters, and performs encryption and decryption operations on the acquired message to be encrypted and decrypted, so as to generate encryption and decryption data of the message to be encrypted and decrypted; Calling the connected encryption and decryption hardware circuit core through the encryption and decryption control module, running the authentication algorithm parameter read and write instructions stored in the encryption and decryption instruction buffer, so as to obtain the SRAM address for storing the authentication algorithm parameters and the authentication algorithm parameters; Calling the connected encryption and decryption hardware circuit core through the encryption and decryption control module, running the authentication algorithm running instruction stored in the encryption and decryption instruction buffer according to the acquired authentication algorithm parameters, performing an authentication operation on the acquired message to be encrypted and decrypted, so as to generate authentication data of the message to be encrypted and decrypted; The connected encryption and decryption hardware circuit core is called through the encryption and decryption control module to execute the data write-back instruction stored in the encryption and decryption instruction buffer, and the generated encryption and decryption data and the authentication data are written back to the SRAM memory.

7. The multi-core parallel encryption and decryption device according to claim 2, characterized in that: The DRAM memory includes: a plurality of DRAM address partitions; each DRAM address partition is used to store a data packet to be encrypted and decrypted and the encryption and decryption data and authentication data of the message to be encrypted and decrypted.

8. The multi-core parallel encryption and decryption device according to claim 7, characterized in that: The multi-core parallel encryption and decryption device also includes: A data output module is connected to the DRAM memory and is used to send the data packets to be encrypted and decrypted stored in the DRAM memory and the encryption and decryption data and authentication data of the encryption and decryption messages therein to an external device, and release the corresponding DRAM address partition.

9. The multi-core parallel encryption and decryption device according to claim 2, characterized in that: The SRAM memory includes: multiple SRAM address partitions; each SRAM address partition is used to store a data packet to be encrypted and decrypted copied from the DRAM memory by the DMA controller, as well as encryption and decryption data and authentication data of the message to be encrypted and decrypted generated; when the encryption and decryption data and the authentication data are copied from the SRAM memory to the DRAM memory, the corresponding SRAM address partition is released.

10. The multi-core parallel encryption and decryption device according to claim 1, characterized in that: The encryption and decryption micro-engine comprises: A plurality of protocol encapsulation modules are respectively connected to the DRAM memories; Acquire each data packet to be encrypted and decrypted stored in the DRAM memory through each protocol encapsulation module, and perform a protocol encapsulation operation on each message to be encrypted and decrypted therein to generate header data of each message to be encrypted and decrypted; Each message to be encrypted and decrypted and the corresponding header data are stored together in the DRAM memory, so that each encryption and decryption control module can respectively call the DMA controller and the encryption and decryption hardware circuit connected to each other to perform encryption and decryption operations on each message to be encrypted and decrypted.

Images