Data encryption method and device, computer equipment and storage medium
By implementing a data encryption method on the chip, encrypting data frames transmitted over Ethernet using identification algorithms and encryption strategies, the problem of low data encryption efficiency in traditional technology is solved, and efficient and secure data encryption is achieved.
Patent Information
- Application Number
- CN202411994763.2
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-12-31
- Publication Date
- 2025-03-07
AI Technical Summary
Traditional data encryption technology relies on the computing power of the CPU and is difficult to meet the needs of efficient data encryption in practical applications, especially when the network transmission speed is fast.
By implementing a data encryption method on the chip, the initial data frame transmitted by Ethernet is received, the feature characters are identified using a preset recognition algorithm, the processing identifier is matched and added to the feature characters, the initial target data is obtained, and the data frame is then encrypted using processing strategies and encryption strategies (such as data encryption standard algorithm, advanced encryption standard algorithm, and national secret algorithm).
It improves data processing efficiency, reduces latency, improves overall system performance, and effectively protects data privacy through integrated national secret algorithms, improving the security of data processing.
Smart Images
Figure CN119583211A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of big data technology, and in particular to a data encryption method, apparatus, computer equipment, storage medium and computer program product. Background Art
[0002] With the continuous development of big data, data security has become increasingly important, and the implementation of data encryption technology is one of the key measures to ensure data security. In traditional data encryption technology, data is usually encrypted by software, which essentially uses the computing power of the CPU to complete the encryption process. However, the time required for the CPU to access the third-level cache is generally in seconds, while the time it takes to transmit data over the network is in nanoseconds. Therefore, relying solely on the CPU for network data encryption processing is not efficient and is difficult to meet the needs of practical applications. Summary of the invention
[0003] Based on this, it is necessary to provide a data encryption method, apparatus, computer device, computer-readable storage medium and computer program product to address the above technical problems.
[0004] In a first aspect, the present application provides a data encryption method. Applied to a chip, the method comprises:
[0005] Receive the initial data frame transmitted by Ethernet;
[0006] Using a preset recognition algorithm, the initial data frame is recognized to obtain characteristic characters of the initial data frame;
[0007] Using the characteristic character, matching to obtain a corresponding processing identifier; and adding the processing identifier to the characteristic character to obtain initial target data;
[0008] Utilize the processing identifier in the initial target data to match the corresponding processing strategy, and utilize the processing strategy and the preset encryption strategy to process and encrypt the initial data frame to obtain the target data; wherein the encryption strategy includes at least one of the following algorithms: data encryption standard algorithm, advanced encryption standard algorithm, national encryption algorithm.
[0009] In one embodiment, the initial data frame includes a data packet header and a data payload; the initial data frame is identified by using a preset identification algorithm to obtain a characteristic character of the initial data frame, including:
[0010] Using a preset universal protocol, the data packet header in the initial data frame is parsed to obtain a target data packet header;
[0011] The target data packet header is identified using a preset recognition algorithm to obtain characteristic characters of the initial data frame.
[0012] In one embodiment, the processing and encrypting the initial data frame using the processing strategy and the preset encryption strategy to obtain the target data includes:
[0013] The data payload in the initial data frame is processed and encrypted using the processing strategy and the preset encryption strategy to obtain target data; wherein the data payload is stored in the memory.
[0014] In one embodiment, the using of the processing identifier in the initial target data, matching the corresponding processing strategy, and using the processing strategy and a preset encryption strategy to process and encrypt the initial data frame to obtain the target data includes:
[0015] Using the processing identifier in the initial target data, matching the corresponding processing strategy;
[0016] Adding the initial data frame and the processing strategy to a preset processing queue;
[0017] The initial data frame and the corresponding processing strategy are sequentially obtained from the processing queue, and the initial data frame is processed and encrypted using the processing strategy and a preset encryption strategy to obtain target data.
[0018] In one embodiment, adding the initial data frame and the processing strategy to a preset processing queue includes:
[0019] Adding the initial data frame and the processing strategy to a preset processing queue;
[0020] When the processing queue is full, a target data frame is selected according to the initial data frame and the priority identifiers of the data frames in the processing queue, and the target data frame is added to a preset waiting queue.
[0021] In one embodiment, after receiving the initial data frame transmitted by Ethernet, the method further includes:
[0022] A target buffer pool is selected according to the amount of data stored in each buffer pool, and the initial data frame is stored in the target buffer pool for processing.
[0023] In a second aspect, the present application also provides a data encryption device. Applied to a chip, the device comprises:
[0024] A data receiving module, used for receiving an initial data frame transmitted by Ethernet;
[0025] A feature recognition module, used to recognize the initial data frame using a preset recognition algorithm to obtain feature characters of the initial data frame;
[0026] An identification adding module is used to use the characteristic characters to match and obtain a corresponding processing identification; and add the processing identification to the characteristic characters to obtain initial target data;
[0027] A data encryption module is used to use the processing identifier in the initial target data to match the corresponding processing strategy, and use the processing strategy and a preset encryption strategy to process and encrypt the initial data frame to obtain target data; wherein the encryption strategy includes at least one of the following algorithms: data encryption standard algorithm, advanced encryption standard algorithm, and national encryption algorithm.
[0028] In one embodiment, the initial data frame includes a data packet header and a data payload; the feature recognition module includes:
[0029] A data parsing submodule, used to parse the data packet header in the initial data frame using a preset universal protocol to obtain a target data packet header;
[0030] The feature recognition submodule is used to recognize the target data packet header using a preset recognition algorithm to obtain the feature characters of the initial data frame.
[0031] In one embodiment, the data encryption module is further used to:
[0032] The data payload in the initial data frame is processed and encrypted using the processing strategy and the preset encryption strategy to obtain target data; wherein the data payload is stored in the memory.
[0033] In one embodiment, the data encryption module includes:
[0034] A strategy matching submodule, used to match a corresponding processing strategy using a processing identifier in the initial target data;
[0035] An adding queue submodule is used to add the initial data frame and the processing strategy to a preset processing queue;
[0036] The data encryption submodule is used to sequentially obtain the initial data frame and the corresponding processing strategy from the processing queue, and use the processing strategy and the preset encryption strategy to process and encrypt the initial data frame to obtain the target data.
[0037] In one embodiment, the adding queue submodule is further used for:
[0038] Adding the initial data frame and the processing strategy to a preset processing queue;
[0039] When the processing queue is full, a target data frame is selected according to the initial data frame and the priority identifiers of the data frames in the processing queue, and the target data frame is added to a preset waiting queue.
[0040] In one embodiment, the device further comprises:
[0041] The buffer pool selection module is used to select a target buffer pool according to the amount of data stored in each buffer pool, and store the initial data frame in the target buffer pool for processing.
[0042] In a third aspect, the present application further provides a computer device, wherein the computer device comprises a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the data encryption method as described in any one of the embodiments of the present disclosure is implemented.
[0043] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the data encryption method as described in any one of the embodiments of the present disclosure is implemented.
[0044] In a fifth aspect, the present application further provides a computer program product, which includes a computer program, and when the computer program is executed by a processor, the data encryption method as described in any one of the embodiments of the present disclosure is implemented.
[0045] The above-mentioned data encryption method, device, computer equipment, storage medium and computer program product receive the initial data frame transmitted by Ethernet, identify the initial data frame to obtain characteristic characters, match the processing identifier with the characteristic characters, and add the processing identifier to the characteristic characters to obtain the initial target data, and match the processing identifier in the initial target data to obtain the processing strategy, and finally encrypt the initial data frame with the processing strategy and the encryption strategy to obtain the target data. This solution is applied to the inside of the chip to realize the identification and encryption process, improve the data processing efficiency, reduce the delay, and improve the overall system performance. The national secret algorithm is integrated into the chip, which can effectively protect data privacy and improve the security of data processing. At the same time, this solution supports distributed processing to ensure that data can be transmitted quickly and securely between different nodes. The use of the data encryption method can achieve efficient data encryption while ensuring data security. BRIEF DESCRIPTION OF THE DRAWINGS
[0046] Figure 1 A schematic diagram of a flow chart of a data encryption method in an embodiment;
[0047] Figure 2 A schematic diagram of a flow chart of a data encryption standard algorithm in one embodiment;
[0048] Figure 3 is a schematic diagram of a flow chart of an advanced encryption standard algorithm in one embodiment;
[0049] Figure 4 A schematic diagram of a flow chart of a Chinese cryptographic algorithm according to an embodiment;
[0050] Figure 5 A schematic diagram of a process of acquiring characteristic characters in an embodiment;
[0051] Figure 6 A schematic diagram of a process of adding data to a processing queue and processing data in one embodiment;
[0052] Figure 7 A schematic diagram of a process of adding data to a waiting queue in one embodiment;
[0053] Figure 8 A first structural block diagram of a data encryption device in an embodiment;
[0054] Fig. 9 A second structural block diagram of a data encryption device in one embodiment;
[0055] Fig.10 is a structural block diagram of a frame manager module in one embodiment;
[0056] Fig.11 A schematic diagram of a flow chart of a frame manager module application in one embodiment;
[0057] Fig.12 A first structural block diagram of a security encryption module in one embodiment;
[0058] Fig.13 A second structural block diagram of a security encryption module in one embodiment;
[0059] Fig.14 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION
[0060] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.
[0061] In one embodiment, Figure 1 As shown, a data encryption method is provided, which is applied to a chip and includes the following steps:
[0062] Step S100, receiving an initial data frame transmitted via Ethernet.
[0063] In an exemplary embodiment, the chip can be connected to Ethernet via AXI (bus protocol) and receive data frames transmitted by Ethernet.
[0064] Step S200: using a preset recognition algorithm to recognize the initial data frame to obtain characteristic characters of the initial data frame.
[0065] In an exemplary embodiment, the recognition algorithm may include a keyword extraction algorithm, etc.; the key characters of the initial data frame, that is, the characteristic characters, are extracted; for example, the recognition algorithm may include a hash algorithm, and the initial data frame is recognized by the hash algorithm to obtain the hash value of the initial data frame, etc. The hash value is the unique characteristic character of the initial data frame, etc.
[0066] Step S300, using the characteristic character to match and obtain a corresponding processing identifier; and adding the processing identifier to the characteristic character to obtain initial target data.
[0067] In an exemplary embodiment, using the characteristic character to match the corresponding processing identifier may include pre-establishing a relationship table between the characteristic character and the processing identifier, and using the characteristic character to search and obtain the corresponding processing identifier from the relationship table, etc. In another exemplary embodiment, the characteristic character may include a hash value, and a preset calculation formula may be used to calculate and obtain the processing identifier, etc.
[0068] In an exemplary implementation, the processing identifier may include an identifier of a configuration file, etc. Each configuration file identifies a processing strategy, and the processing identifier can be obtained by calculating characteristic characters, thereby determining the processing strategy, etc.
[0069] In an exemplary embodiment, a preset fusion strategy can be used to add a processing identifier to a feature character to obtain initial target data, wherein the fusion strategy may include adding the processing identifier to the first digit of the feature character, adding the processing identifier to the last digit of the feature character, adding the processing identifier to a certain digit of the feature character, etc.
[0070] Step S400, using the processing identifier in the initial target data, matching the corresponding processing strategy, and using the processing strategy and the preset encryption strategy to process and encrypt the initial data frame to obtain the target data; wherein the encryption strategy includes at least one of the following algorithms: data encryption standard algorithm, advanced encryption standard algorithm, national encryption algorithm.
[0071] In an exemplary embodiment, the initial target data includes an initial data frame and a processing identifier, so the processing identifier can be obtained from the initial target data, and the corresponding processing strategy can be matched using the processing identifier, and the initial data frame can be preprocessed using the processing strategy, and the preprocessed data frame can be encrypted using a preset encryption strategy to obtain the target data, etc. Matching the corresponding processing strategy may include matching the corresponding configuration file, and it can be understood that each configuration file can work in RFC-2698 or pass-through mode, etc., and each mode can work in color blindness or color sensitive mode, etc. Processing the initial data frame may include forwarding and packet loss of the data frame according to color, etc.
[0072] In an exemplary embodiment, the data encryption method can be implemented in a distributed manner, for example, it can be divided into three nodes, the first node is responsible for receiving the initial data frame transmitted by Ethernet, and identifying the initial data frame to obtain the characteristic character of the initial data frame. The second node is responsible for matching the processing identifier and adding the processing identifier to the characteristic character to obtain the initial target data. The third node is responsible for processing and encrypting the initial data frame, etc. By implementing the data encryption method in a distributed manner in this way, the encryption efficiency of the data is greatly improved.
[0073] In an exemplary embodiment, the data encryption standard algorithm (DES algorithm) can be as follows Figure 2 As shown in the figure, after each set of data is input, it takes 16 clock cycles to get the result. Although each data encryption and decryption requires 16 clock cycles, after the current set of data has undergone a certain round of transformation, the same round of transformation can transform the next set of data. In this way, the throughput of the algorithm implemented by the 16-stage pipeline structure is 16 times that of the non-pipelined one.
[0074] In an exemplary embodiment, the Advanced Encryption Standard algorithm (AES algorithm) may be as follows: Figure 3 As shown, registers are added between each round of transformation or inside the round transformation, so that the chip can process multiple data packets at the same time, thereby improving the chip's data processing speed per unit time. Since the algorithm of each round of transformation of the AES encryption and decryption algorithm is relatively complex, registers can be inserted inside the AES round transformation to realize the pipeline structure. It can be understood that in this way, the AES algorithm can be divided into two types of pipeline structures, one is the internal pipeline structure, and the other is the external pipeline structure. The internal pipeline structure is to divide the combinational logic circuit that realizes a round of encryption and decryption transformation into multiple parts, and insert registers between each part. This method can improve the overall efficiency of encryption and decryption while increasing the area very little. The external pipeline structure is similar to the DES algorithm, that is, registers are inserted between each round of transformation.
[0075] In an exemplary embodiment, the national secret algorithm can be as follows Figure 4 As shown, taking the SM4 algorithm as an example, it can be understood that the transformation scale of each round of SM4 is small, but the number of rounds is large. Therefore, the full pipeline of SM4 will inevitably consume too many resources. Therefore, the SM4 algorithm can be implemented in a semi-pipeline and semi-rotation manner to balance the speed and resources.
[0076] In the above data encryption method, the initial data frame transmitted by Ethernet is received, and the initial data frame is identified to obtain characteristic characters, the characteristic characters are used to match the processing identifier, and the processing identifier is added to the characteristic characters to obtain the initial target data, and the processing identifier in the initial target data is matched to obtain the processing strategy, and finally the initial data frame is encrypted using the processing strategy and the encryption strategy to obtain the target data. This solution is applied to the chip to realize the identification and encryption process, improve data processing efficiency, reduce latency, and improve overall system performance. The national secret algorithm is integrated into the chip, which can effectively protect data privacy and improve the security of data processing. At the same time, this solution supports distributed processing to ensure that data can be transmitted quickly and securely between different nodes. The data encryption method can achieve efficient data encryption while ensuring data security.
[0077] In one embodiment, Figure 5 As shown, the initial data frame includes a data packet header and a data payload; the initial data frame is identified by using a preset recognition algorithm to obtain characteristic characters of the initial data frame, including:
[0078] Step S201, using a preset universal protocol, parse the data packet header in the initial data frame to obtain a target data packet header.
[0079] Step S202: using a preset recognition algorithm, the target data packet header is recognized to obtain characteristic characters of the initial data frame.
[0080] In an exemplary embodiment, the general protocol can implement the function of parsing and identifying the message protocol header, and can support the parsing and identification of multiple frame format protocols and encapsulation, etc. Specifically, the general protocol can include the following protocols: L2 layer header: Ethernet II, LLC+SNAP, VLAN, PPPoE+PPP, MPLS, etc.; L3 layer header: IPv4, IPv6, GRE, MinEncap, etc.; L4 layer header: TCP, UDP, SCTP, DCCP, IPSec, etc.
[0081] In an exemplary embodiment, the data frame may be split into a data packet header and a data payload, etc. The data payload may be stored in a memory, such as a DDR (double data rate synchronous dynamic random access memory), etc., and only the data packet header needs to be parsed and processed, which can greatly improve the efficiency of network protocol parsing, etc. In an exemplary embodiment, only the data packet header may be processed before the data frame is encrypted, thereby improving the efficiency of network protocol parsing, etc.
[0082] In an exemplary embodiment, a hash algorithm may be used to identify the target data packet header, thereby obtaining characteristic characters of the initial data frame.
[0083] In this embodiment, the data packet header of the initial data frame is parsed by a general protocol to obtain a target data packet header, and the target data packet header is identified by a recognition algorithm to obtain a characteristic character of the initial data frame. By parsing the data packet header in the initial data frame, the target data packet header can be accurately extracted, thereby providing accurate data support for subsequent identification of characteristic characters, and improving the accuracy of characteristic characters. The accuracy of characteristic characters can improve the efficiency of processing strategy matching, thereby improving the efficiency of data processing and encryption. At the same time, only the data packet header is identified, avoiding the identification of all data frames, thereby improving the efficiency of obtaining the characteristic characters of the initial data frame, and further improving the efficiency of data encryption.
[0084] In one embodiment, the processing strategy and the preset encryption strategy are used to process and encrypt the initial data frame to obtain the target data, including:
[0085] The data payload in the initial data frame is processed and encrypted using the processing strategy and the preset encryption strategy to obtain target data; wherein the data payload is stored in the memory.
[0086] In an exemplary embodiment, the data payload may be stored in a DDR (double data rate synchronous dynamic random access memory) or the like.
[0087] In an exemplary embodiment, after the identifier is extracted from the initial data frame through the data packet header, the data payload may not be processed temporarily, and encryption may be performed when the data payload needs to be sent. In another exemplary embodiment, the data packet header may be used to obtain the initial target data, and the processing identifier in the initial target data may be used to match the processing strategy and the encryption strategy may be used to process and encrypt the data payload.
[0088] In this embodiment, the data payload of the initial data frame is processed and encrypted using the processing strategy and the encryption strategy to obtain the target data. The data payload is stored in the memory. Before obtaining the initial target data, only the data payload is stored and forwarded, which avoids the processing of the data payload and improves the efficiency of obtaining the initial target data. At the same time, the data payload is processed and encrypted using the processing strategy and the encryption strategy to ensure the security of the data.
[0089] In one embodiment, Figure 6 As shown, the processing identifier in the initial target data is used to match the corresponding processing strategy, and the processing strategy and the preset encryption strategy are used to process and encrypt the initial data frame to obtain the target data, including:
[0090] Step S401, using the processing identifier in the initial target data to match the corresponding processing strategy.
[0091] Step S402: adding the initial data frame and the processing strategy to a preset processing queue.
[0092] Step S403, sequentially obtaining the initial data frame and the corresponding processing strategy from the processing queue, and using the processing strategy and the preset encryption strategy to process and encrypt the initial data frame to obtain the target data.
[0093] In an exemplary embodiment, after matching the processing strategy, the initial data frame and the processing strategy can be added to the processing queue to wait for processing; the system can sequentially obtain the initial data frame and the processing strategy from the processing queue for processing. Specifically, the initial data frame can include a priority, and the system can sequentially obtain the initial data frame and the processing strategy from the processing queue for processing according to the priority of the initial data frame. The priority may include the timestamp of the initial data frame transmitted by Ethernet, etc.
[0094] In this embodiment, by adding the initial data frame and the processing strategy to the processing queue, and obtaining the initial data frame and the processing strategy from the processing queue in turn, the initial data frame is processed and encrypted to obtain the target data. By adding the initial data frame and the corresponding processing strategy to the preset processing queue, the system can realize batch processing and parallel execution of data, optimize resource utilization, and reduce processing delays. In addition, this queued processing method allows the system to maintain stability and efficiency in a high-throughput data environment, ensuring that each data frame can be processed in a timely and accurate manner according to its specific processing strategy and encryption requirements, thereby significantly improving data security and overall performance.
[0095] In one embodiment, Figure 7As shown, the adding of the initial data frame and the processing strategy to a preset processing queue includes:
[0096] Step S411, adding the initial data frame and the processing strategy to a preset processing queue.
[0097] Step S412, when the processing queue is full, select a target data frame according to the priority identifiers of the initial data frame and the data frames in the processing queue, and add the target data frame to a preset waiting queue.
[0098] In an exemplary embodiment, when the processing queue is a full queue, the data frame with the lowest priority can be selected as the target data frame according to the priority identifier of the data frame in the processing queue and the initial data frame, and the data frame is added to the waiting queue. Among them, multiple processing queues can be included, so the data frame in the waiting queue can be forwarded to the processing queue of the idle or non-full queue for processing, etc.
[0099] In this embodiment, when the processing queue is full, the target data frame is selected from the data frames in the processing queue and the initial data frame and added to the waiting queue. When the processing queue is full, the system selects the target data frame according to the priority identifier and transfers it to the waiting queue. This priority scheduling mechanism can ensure that high-priority data is processed first, thereby effectively meeting the real-time requirements. In addition, the introduction of the waiting queue can prevent the overflow of the processing queue, ensure the stability of the system, and effectively manage the processing order of different data frames during the encryption process, further improving the overall data security and processing performance. This method helps to optimize resource allocation in a high-load environment and ensure the timely encryption and transmission of important information.
[0100] In one embodiment, after receiving the initial data frame transmitted by Ethernet, the method further includes:
[0101] A target buffer pool is selected according to the amount of data stored in each buffer pool, and the initial data frame is stored in the target buffer pool for processing.
[0102] In an exemplary embodiment, the system may include multiple buffer pools, and dynamically select one of the relatively small target data pools according to the amount of data currently stored in each buffer pool, thereby avoiding overloading of a buffer pool and ensuring the balance of data processing.
[0103] In an exemplary embodiment, a priority buffer pool may be set, and after receiving an initial data frame, it is determined whether to store the initial data frame in the priority buffer pool for priority processing according to the priority of the initial data frame.
[0104] In this embodiment, the target buffer pool is selected according to the amount of data stored in each buffer pool, and the initial data frame is stored in the target buffer pool for processing. By balancing the load of each buffer pool, the system can effectively avoid processing bottlenecks and ensure real-time response capabilities in a high-traffic data environment. At the same time, through priority classification and dynamic adjustment, the system can ensure priority processing of important data and optimal allocation of resources, thereby improving the stability and security of overall data processing.
[0105] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.
[0106] Based on the same inventive concept, the embodiment of the present application also provides a data encryption device for implementing the data encryption method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more data encryption device embodiments provided below can refer to the limitations on the data encryption method above, and will not be repeated here.
[0107] In one embodiment, Figure 8 As shown, a data encryption device 100 is provided, which is applied to a chip and includes: a data receiving module 101, a feature recognition module 102, an identification adding module 103 and a data encryption module 104, wherein:
[0108] A data receiving module, used for receiving an initial data frame transmitted by Ethernet;
[0109] A feature recognition module, used to recognize the initial data frame using a preset recognition algorithm to obtain feature characters of the initial data frame;
[0110] An identification adding module is used to use the characteristic characters to match and obtain a corresponding processing identification; and add the processing identification to the characteristic characters to obtain initial target data;
[0111] A data encryption module is used to use the processing identifier in the initial target data to match the corresponding processing strategy, and use the processing strategy and a preset encryption strategy to process and encrypt the initial data frame to obtain target data; wherein the encryption strategy includes at least one of the following algorithms: data encryption standard algorithm, advanced encryption standard algorithm, and national encryption algorithm.
[0112] In one embodiment, the initial data frame includes a data packet header and a data payload; the feature recognition module includes:
[0113] A data parsing submodule, used to parse the data packet header in the initial data frame using a preset universal protocol to obtain a target data packet header;
[0114] The feature recognition submodule is used to recognize the target data packet header using a preset recognition algorithm to obtain the feature characters of the initial data frame.
[0115] In one embodiment, the data encryption module is further used to:
[0116] The data payload in the initial data frame is processed and encrypted using the processing strategy and the preset encryption strategy to obtain target data; wherein the data payload is stored in the memory.
[0117] In one embodiment, the data encryption module includes:
[0118] A strategy matching submodule, used to match a corresponding processing strategy using a processing identifier in the initial target data;
[0119] An adding queue submodule is used to add the initial data frame and the processing strategy to a preset processing queue;
[0120] The data encryption submodule is used to sequentially obtain the initial data frame and the corresponding processing strategy from the processing queue, and use the processing strategy and the preset encryption strategy to process and encrypt the initial data frame to obtain the target data.
[0121] In one embodiment, the adding queue submodule is further used for:
[0122] Adding the initial data frame and the processing strategy to a preset processing queue;
[0123] When the processing queue is full, a target data frame is selected according to the initial data frame and the priority identifiers of the data frames in the processing queue, and the target data frame is added to a preset waiting queue.
[0124] In one embodiment, the device further comprises:
[0125] The buffer pool selection module is used to select a target buffer pool according to the amount of data stored in each buffer pool, and store the initial data frame in the target buffer pool for processing.
[0126] In an exemplary embodiment, the data encryption device may be as follows: Fig. 9 As shown, it includes a buffer manager module, a frame manager module, a queue manager module, and a security encryption module, wherein: the parsing of the message protocol and the flow rate limit are implemented by the frame manager module; the high-quality scheduling of the message queue, the maintenance of the message order and the message congestion management function are implemented by the queue manager module; the encryption and decryption functions of the message are implemented by the security encryption engine module, and the DES algorithm, AES algorithm and SM4 algorithm are integrated in this module. In order to make full use of the external memory, a buffer management module is designed to be responsible for the allocation and recovery of the buffer pool. Each submodule supports the AXI interface and is mounted on the AXI bus to communicate with the external DDR and CPU. The frame manager module is connected to the external Ethernet interface. Specifically, since a network frame is usually hundreds or thousands of bytes, if we directly process the entire network frame, it will consume a lot of resources. For the network frame protocol header part, it only exists in the header of the network frame, and the longest will not exceed 256 bytes. In order to save resources and improve processing efficiency, we split the received frame into a header part and a payload part. When the network card receives the data frame, it splits the data frame into a data packet header and a data payload. The data payload is stored in DDR, and the subsequent modules only parse and process the data packet header, which greatly improves the efficiency of network protocol parsing. The essential working mode of network intermediate devices is the "store-and-forward" mode. If the device receives a data packet, the storage and forwarding tasks are all handled by the software to allocate and release memory. This will generate a huge overhead. Therefore, it is necessary to design a module specifically for managing the classification and release of memory, thereby reducing the software load and improving the processing speed. The main function of the buffer manager is to reduce the overhead required for software to manage the free buffer pools of multiple hardware modules. As the central resource of the multi-core data path infrastructure, the buffer manager manages the data storage buffer pool and applies for and releases these buffers on behalf of the multi-core processors, network interfaces and hardware accelerators of the multi-core system-on-chip. Other modules obtain these buffers by making requests to the buffer manager and then the buffer manager allocates buffers to them. After other modules have finished using them, they send a release command to the buffer manager, and the buffer manager releases the corresponding buffers.
[0127] In an exemplary embodiment, the frame manager is a functional unit that combines an Ethernet network interface with packet distribution logic to provide intelligent distribution and queuing decisions for incoming traffic at line rate. This integration allows the frame manager to perform configurable analysis and distribution of incoming frames with the goal of selecting the appropriate incoming frame queue for accelerated CPU processing. The frame manager can be used as follows: Fig.10 As shown, the sub-functional modules in the frame manager module specifically include a cache manager interface module, a queue manager interface module, a direct memory access module, a shared cache module, a parsing module, a keyword generation module, a frame management controller module and a supervisor module. Among them: the frame processing controller allocates frame processing tasks among various frame manager modules. Timestamp counts are allocated to different frame manager modules. Timestamps are used as the basis for different timing functions of the frame manager. The cache manager interface communicates with the buffer manager, Ethernet interface and other frame manager submodules. The queue manager interface module provides an interface for the queue management module to queue frames into or out of the queue in the data path acceleration architecture. The direct memory access module realizes data movement between the frame manager and the system external DDR. The frame parsing module mainly realizes the function of parsing and identifying the message protocol header, and supports the parsing and identification of multiple frame format protocols and encapsulations. The parsing module can parse and identify the following common protocols: L2 layer header: Ethernet II, LLC+SNAP, VLAN, PPPoE+PPP, MPLS; L3 layer header: IPv4, IPv6, GRE, Min Encap; L4 layer header: TCP, UDP, SCTP, DCCP, IPSec; The keyword generation module saves 32 keyword generation schemes in memory, and selects a scheme to extract keywords according to the parsing result of the parser (i.e., IP protocol type). And generate FQID (Frame queue ID) and PNUM (Policer profile number) by calculation, and update the latest parameter value to the shared data buffer for use by other frame manager submodules. The regulator supports the implementation of differentiated services by limiting the speed of receiving or sending parsing paths in the frame manager. The regulator stores 256 traffic profiles in the internal memory PRAM, and each profile can work in RFC-2698 or pass-through mode. Each mode can work in color-blind or color-sensitive mode, and forward and drop packets according to the color it generates.
[0128] In an exemplary embodiment, the application of the frame manager may be as follows Fig.11As shown, Ethernet sends data frames to the memory through the buffer manager interface module; the parsing module parses the data frames through the general module; the keyword generation module identifies the parsed data frames and calculates the hash value; the supervisor module colors the data frames; the cache manager interface module releases the buffer according to the packet loss strategy; the queue management interface module adds the data frames to the processing queue, etc.
[0129] In an exemplary embodiment, the queue management module mainly performs queue management. It manages the software queue through hardware, and also implements queue congestion management, data frame priority arrangement and data frame sequence recovery. The module requeues the data frames processed by the frame manager, significantly improving the efficiency of data frame entry and exit.
[0130] In an exemplary embodiment, the security encryption module is responsible for encrypting and decrypting the transmitted data. The security encryption module can be as follows: Fig.12 As shown, the descriptor controller is responsible for controlling the descriptor; the arbitrator implements the scheduling of the multi-algorithm module; the algorithm implementation module implements the encryption and decryption of various algorithms; and the direct memory access module implements the transmission of the data frame. The descriptor controller communicates with the CPU through the AXI software interface and transmits data with the queue management module through the direct connection interface. In the security encryption module, the software first sends the encryption and decryption instructions to the descriptor controller, and the descriptor controller updates the frame descriptor sent by the queue management module into an encryption and decryption descriptor according to the software instructions. Then the encryption and decryption descriptor is sent to the encryption and decryption algorithm module. When the encryption is completed, the descriptor controller parses the encryption and decryption descriptor and feeds the encryption and decryption results back to the software. The encryption and decryption descriptor is generated by the combination of the frame descriptor and the software instruction, and contains the address of the data frame to be encrypted in the buffer pool, the starting and ending positions of the load in the data frame, the encryption mode to be performed, the encryption key, the data frame length and other information. The encryption and decryption descriptor is stored in the FIFO inside the controller, and up to 8 encryption and decryption descriptors can be stored at the same time. When the FIFO is full, a busy signal is sent to the software to stop receiving encryption and decryption descriptors.
[0131] In an exemplary embodiment, the security encryption module can be as follows Fig.13 As shown in the figure, specifically, the algorithm implementation module consists of a descriptor executor module and three algorithm function modules, each of which consists of four identical sub-modules. The four sub-modules can operate in parallel. For example, each SM4 sub-module encrypts 128-bit data, and the four sub-modules can encrypt 512-bit data at the same time. The algorithm implementation module structure is shown in the figure. Figure 5 The descriptor executor is connected to the three algorithm modules and the arbitrator, and is also connected to the direct memory access module.
[0132] Each module in the above data encryption device can be implemented in whole or in part by software, hardware, or a combination thereof. Each module can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute operations corresponding to each module.
[0133] In one embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as follows: Fig.14 As shown. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. The processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store processing strategy data. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a data encryption method is implemented.
[0134] Those skilled in the art will understand that Fig.14 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.
[0135] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant laws, regulations and standards of relevant countries and regions.
[0136] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.
[0137] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.
[0138] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.
Claims
1. A data encryption method, characterized in that: Applied to a chip, the method comprises: Receive the initial data frame transmitted by Ethernet; Using a preset recognition algorithm, the initial data frame is recognized to obtain characteristic characters of the initial data frame; Using the characteristic character, matching to obtain a corresponding processing identifier; and adding the processing identifier to the characteristic character to obtain initial target data; Utilize the processing identifier in the initial target data to match the corresponding processing strategy, and utilize the processing strategy and the preset encryption strategy to process and encrypt the initial data frame to obtain the target data; wherein the encryption strategy includes at least one of the following algorithms: data encryption standard algorithm, advanced encryption standard algorithm, national encryption algorithm.
2. The method according to claim 1, characterized in that The initial data frame includes a data packet header and a data payload; the initial data frame is identified by using a preset identification algorithm to obtain a characteristic character of the initial data frame, including: Using a preset universal protocol, the data packet header in the initial data frame is parsed to obtain a target data packet header; The target data packet header is identified using a preset recognition algorithm to obtain characteristic characters of the initial data frame.
3. The method according to claim 2, characterized in that The processing strategy and the preset encryption strategy are used to process and encrypt the initial data frame to obtain target data, including: The data payload in the initial data frame is processed and encrypted using the processing strategy and the preset encryption strategy to obtain target data; wherein the data payload is stored in the memory.
4. The method according to claim 1, characterized in that: The using of the processing identifier in the initial target data, matching the corresponding processing strategy, and using the processing strategy and a preset encryption strategy to process and encrypt the initial data frame to obtain the target data includes: Using the processing identifier in the initial target data, matching the corresponding processing strategy; Adding the initial data frame and the processing strategy to a preset processing queue; The initial data frame and the corresponding processing strategy are sequentially obtained from the processing queue, and the initial data frame is processed and encrypted using the processing strategy and a preset encryption strategy to obtain target data.
5. The method according to claim 4, characterized in that The step of adding the initial data frame and the processing strategy to a preset processing queue includes: Adding the initial data frame and the processing strategy to a preset processing queue; When the processing queue is full, a target data frame is selected according to the initial data frame and the priority identifiers of the data frames in the processing queue, and the target data frame is added to a preset waiting queue.
6. The method according to claim 1, characterized in that After receiving the initial data frame transmitted by Ethernet, the method further comprises: A target buffer pool is selected according to the amount of data stored in each buffer pool, and the initial data frame is stored in the target buffer pool for processing.
7. A data encryption device, characterized in that: The device comprises: A data receiving module, used for receiving an initial data frame transmitted by Ethernet; A feature recognition module, used to recognize the initial data frame using a preset recognition algorithm to obtain feature characters of the initial data frame; An identification adding module is used to use the characteristic characters to match and obtain a corresponding processing identification; and add the processing identification to the characteristic characters to obtain initial target data; A data encryption module is used to use the processing identifier in the initial target data to match the corresponding processing strategy, and use the processing strategy and a preset encryption strategy to process and encrypt the initial data frame to obtain target data; wherein the encryption strategy includes at least one of the following algorithms: data encryption standard algorithm, advanced encryption standard algorithm, and national encryption algorithm.
8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.
9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.
10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.