Method and device for realizing high-speed operation of algorithm based on multi-stage field cache

Abstract

The invention discloses a method and a device for realizing high-speed operation of an algorithm based on multistage field cache. The method comprises the following steps of: issuing algorithm parameters to an FPGA (Field Programmable Gate Array) chip through a configuration management CPU (Central Processing Unit) and storing the algorithm parameters in an RAM (Random Access Memory); the business processing CPU creates a handle and sends the handle to the configuration management CPU; the configuration management CPU generates a key number according to the handle; the configuration management CPU issues the key library to the FPGA chip; the service processing CPU sends the message to be operated to the FPGA chip; the algorithm scheduling module carries out fragmentation judgment and carries out subsequent processing according to a sequence judgment result; the cryptographic operation module takes the received secret key, the initialization vector or the intermediate chain variable and the message to be operated as input, carries out cryptographic operation, and outputs a calculation result and the intermediate chain variable after operation; and judging whether the data fragment is the final data fragment according to the tail fragment identifier of the to-be-operated message, and performing subsequent processing according to a tail fragment judgment result. According to the invention, the access times of a communication interface and a CPU can be reduced, high-speed operation of a cryptographic algorithm is realized, and the overall performance of a cryptographic service system is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of password security, and in particular to a method and device for realizing high-speed algorithm operation based on multi-level on-site cache. Background Art

[0002] Big data centers built on technologies such as cloud computing and distributed storage have new network architectures and information service environments that put forward many new technical requirements for cryptographic products. There is an urgent need to support virtualization and service-oriented cryptographic products with high performance and high concurrency. How to improve the algorithm running speed in a multi-tasking and high-concurrency environment has become a key technology for the successful development of high-performance cryptographic service systems.

[0003] At present, in multi-tasking and high-concurrency cryptographic service scenarios, task switching occurs frequently during algorithm operation, which requires high-speed access and query of key resources and intermediate results. In the past, the cryptographic resource management CPU was mainly used to frequently configure keys and parameters for the algorithm core chip. Although the CPU and algorithm chip can be interconnected through high-speed parallel bus, PCIE, high-speed Ethernet and other communication interfaces, both the key request data packet and the intermediate result data packet are short messages of tens or one or two hundred bytes. Frequent small packet communication will cause the communication bandwidth to drop sharply, and frequent configuration tasks will also bring a heavy burden to the CPU.

[0004] Therefore, how to invent a high-speed computing method to reduce the number of communication interfaces and CPU access times, achieve high-speed computing of cryptographic algorithms, and improve the overall performance of the cryptographic service system has become an urgent problem to be solved. Summary of the invention

[0005] To this end, the present invention provides a method and device for realizing high-speed algorithm operation based on multi-level field cache, utilizing FPGA on-chip BRAM and external DDR storage chip to establish a multi-level key library and field protection efficient cache unit, reducing the number of communication interface and CPU access times, realizing high-speed operation of cryptographic algorithms, and thus improving the overall performance of the cryptographic service system.

[0006] In order to achieve the above object, the present invention provides the following technical solution: a method for realizing high-speed operation of an algorithm based on multi-level on-site cache, comprising:

[0007] The configuration management CPU sends the algorithm parameters to the FPGA chip; the convergence distribution module in the FPGA chip configures the algorithm parameters to the cryptographic operation module, and saves the algorithm parameters through the RAM inside the cryptographic operation module;

[0008] The business processing CPU creates a handle according to the business data cryptographic operation requirements, and sends the handle to the configuration management CPU; the configuration management CPU generates a key number according to the handle;

[0009] The configuration management CPU sends the key library to the FPGA chip;

[0010] The business processing CPU sends the message to be calculated to the FPGA chip; the convergence distribution module in the FPGA chip receives the message to be calculated, and forwards the message to be calculated to the algorithm scheduling module;

[0011] The algorithm scheduling module performs fragmentation judgment according to the sequence of the message to be calculated, and performs subsequent processing according to the sequence judgment result;

[0012] The cryptographic operation module takes the received key, initialization vector or the intermediate chain variable and the message to be operated as input, performs cryptographic operation, and outputs the calculation result and the intermediate chain variable after the operation;

[0013] Determine whether it is the last data fragment according to the tail piece identifier of the message to be calculated, and perform subsequent processing according to the tail piece determination result;

[0014] When the statistical value of the primary key and the on-site protection buffer reaches the set value, when the primary key and the on-site buffer timestamp are judged, if the primary key and the on-site buffer timestamp do not exceed the set threshold, the intermediate chain variables and timestamp after the calculation are written into the secondary key and the on-site buffer; the calculation result is returned to the business processing CPU, and the next round of message calculation is performed; if the primary key and the on-site buffer timestamp exceed the set threshold, the intermediate chain variables before the calculation are transferred to the secondary key and the on-site protection buffer, and the intermediate chain variables and timestamp after the calculation are written into the primary key and the on-site buffer; the calculation result is returned to the business processing CPU, and the next round of message calculation is performed.

[0015] As a preferred solution for a method of implementing high-speed algorithm operation based on multi-level on-site cache, in the process of configuring the management CPU to generate a key number according to the handle, the key number corresponds to the storage address of the key and initialization vector in the DDR memory chip.

[0016] As a preferred solution for a method of realizing high-speed algorithm operation based on multi-level on-site cache, the key library includes: a handle, a key number, a key, and an initialization vector.

[0017] As a preferred solution of a method for realizing high-speed algorithm operation based on multi-level on-site cache, the message to be operated includes data to be operated, a handle number, a sequence number and a tail piece identifier;

[0018] In the subsequent processing according to the sequence judgment result, if the sequence number is 0, the message to be calculated is the first fragment; the corresponding key number is obtained according to the handle number index carried by the first fragment, and the key and initialization vector information stored in the BRAM module are read through the address corresponding to the key number; the read key, initialization vector and the message to be calculated are sent to the cryptographic operation module for calculation;

[0019] If the sequence number is not 0, the message to be calculated is not the first fragment; the intermediate chain variables of the key and the data fragment in the field protection buffer are obtained by reading; the intermediate chain variables and the message to be calculated are sent to the cryptographic operation module for calculation.

[0020] As a preferred solution for realizing high-speed algorithm operation based on multi-level on-site cache, in the subsequent processing according to the tail judgment result, if the tail identification is 1, the tail is the last data fragment; the first-level key and the content of the on-site protection cache area are deleted; the calculation result and the task number are returned to the business processing CPU;

[0021] If the tail piece identifier is 0, the tail piece is not the last data fragment; the statistical value of the primary key and the scene protection buffer area is judged, and if the statistical value reaches the set value, the primary key and the scene buffer time stamp are judged; if the statistical value does not reach the set value, the calculated intermediate chain variable is written into the primary key and the scene protection buffer area, and a timestamp is added; the calculation result is returned to the business processing CPU, and the next round of message calculation is performed;

[0022] The primary key and field protection cache uses internal BRAM to create a cache with a set capacity, and uses a counter to count the cache usage; each time an intermediate chain variable is added, the statistics are incremented by 1, and each time the cache of an intermediate chain variable is released, the statistics are decremented by 1.

[0023] The present invention also provides a device for realizing high-speed algorithm operation based on multi-level on-site cache, based on the above method for realizing high-speed algorithm operation based on multi-level on-site cache, comprising:

[0024] The algorithm parameter sending unit is used to configure the management CPU to send the algorithm parameters to the FPGA chip; the convergence distribution module in the FPGA chip configures the algorithm parameters to the cryptographic operation module, and saves the algorithm parameters through the RAM inside the cryptographic operation module;

[0025] The key number generating unit is used for the business processing CPU to create a handle according to the business data cryptographic operation requirements, and send the handle to the configuration management CPU; the configuration management CPU generates a key number according to the handle;

[0026] The key library sending unit is used to configure the management CPU to send the key library to the FPGA chip;

[0027] The message sending unit to be calculated is used for the business processing CPU to send the message to be calculated to the FPGA chip; the convergence distribution module in the FPGA chip receives the message to be calculated, and forwards the message to be calculated to the algorithm scheduling module;

[0028] A fragmentation judgment processing unit, used for the algorithm scheduling module to perform fragmentation judgment according to the sequence of the message to be calculated, and perform subsequent processing according to the sequence judgment result;

[0029] A first shard processing unit, configured to: if the sequence number is 0, the message to be calculated is the first shard; obtain the corresponding key number according to the handle number index carried by the first shard, read the key and initialization vector information stored in the BRAM module through the address corresponding to the key number; and send the read key, initialization vector and the message to be calculated to the cryptographic operation module for calculation;

[0030] The intermediate chain variable reading processing unit is used for, if the sequence number is not 0, the message to be calculated is not the first fragment; obtaining the intermediate chain variable of the data fragment in the key and the field protection buffer by reading; sending the intermediate chain variable and the message to be calculated to the cryptographic operation module for calculation;

[0031] A cryptographic operation processing unit, which is used for the cryptographic operation module to take the received key, initialization vector or the intermediate chain variable and the message to be operated as input, perform cryptographic operation, and output the calculation result and the intermediate chain variable after the operation;

[0032] A tail piece determination processing unit, used to determine whether it is the last data fragment according to the tail piece identifier of the message to be calculated, and perform subsequent processing according to the tail piece determination result;

[0033] The last data fragment processing unit is used for, if the last fragment identifier is 1, the last fragment is the last data fragment; deleting the first-level key and the content of the on-site protection buffer area; returning the calculation result and the task number to the business processing CPU;

[0034] The primary key and scene protection buffer statistical value judgment processing unit is used to judge the primary key and scene protection buffer statistical value if the tail piece identifier is 0, then the tail piece is not the last data fragment; judge the primary key and scene protection buffer statistical value, if the statistical value reaches the set value, then judge the primary key and scene buffer timestamp; if the statistical value does not reach the set value, then write the calculated intermediate chain variable into the primary key and scene protection buffer, and add a timestamp; return the calculation result to the business processing CPU, and perform the next round of message calculation;

[0035] The first-level key and on-site buffer timestamp judgment processing unit is used to judge the first-level key and on-site buffer timestamp when the statistical value of the first-level key and on-site protection buffer reaches the set value. If the first-level key and on-site buffer timestamp do not exceed the set threshold, the intermediate chain variables and timestamp after the calculation are written into the second-level key and on-site buffer; the calculation result is returned to the business processing CPU, and the next round of message calculation is performed; if the first-level key and on-site buffer timestamp exceed the set threshold, the intermediate chain variables before the calculation are transferred to the second-level key and on-site protection buffer, and the intermediate chain variables and timestamp after the calculation are written into the first-level key and on-site buffer; the calculation result is returned to the business processing CPU, and the next round of message calculation is performed.

[0036] As a preferred solution for a device that implements high-speed algorithm calculation based on multi-level field cache, in the key number generation unit, in the process of configuring the management CPU to generate the key number according to the handle, the key number corresponds to the storage address of the key and initialization vector in the DDR memory chip.

[0037] As a preferred solution for a device for realizing high-speed algorithm operation based on multi-level on-site cache, in the key library issuing unit, the key library includes: a handle, a key number, a key, and an initialization vector.

[0038] As a preferred solution of a device for realizing high-speed algorithm operation based on multi-level on-site cache, in the message sending unit to be operated, the message to be operated includes data to be operated, a handle number, a sequence number and a tail piece identifier;

[0039] Also includes:

[0040] The intermediate chain variable reading processing unit is used for, if the sequence number is not 0, the message to be calculated is not the first fragment; obtaining the intermediate chain variable of the data fragment in the key and the field protection buffer by reading; sending the intermediate chain variable and the message to be calculated to the cryptographic operation module for calculation;

[0041] The cryptographic operation processing unit is used for the cryptographic operation module to take the received key, initialization vector or the intermediate chain variable and the message to be operated as input, perform cryptographic operation, and output the calculation result and the intermediate chain variable after the operation.

[0042] As a preferred solution for a device for realizing high-speed algorithm operation based on multi-level on-site cache, in the statistical value judgment processing unit of the primary key and on-site protection cache area, the primary key and on-site protection cache area use internal BRAM to create a cache area with a set capacity, and use a counter to count the usage of the cache area; each time an intermediate chain variable is added, the statistics are incremented by 1, and each time the cache of an intermediate chain variable is released, the statistics are decremented by 1;

[0043] Also includes;

[0044] The last data fragment processing unit is used for, if the last fragment identifier is 1, the last fragment is the last data fragment; deleting the first-level key and the content of the on-site protection buffer area; returning the calculation result and the task number to the business processing CPU;

[0045] The first-level key and on-site protection buffer statistical value judgment processing unit is used to judge the first-level key and on-site protection buffer statistical value if the tail piece identifier is 0, then the tail piece is not the last data fragment; judge the first-level key and on-site protection buffer statistical value, if the statistical value reaches the set value, judge the first-level key and on-site buffer time stamp; if the statistical value does not reach the set value, write the calculated intermediate chain variable into the first-level key and on-site protection buffer, and add a time stamp; return the calculation result to the business processing CPU, and perform the next round of message calculation.

[0046] The present invention has the following advantages: the present invention sends algorithm parameters to the FPGA chip through the configuration management CPU; the convergence distribution module in the FPGA chip configures the algorithm parameters to the cryptographic operation module, and saves the algorithm parameters through the RAM inside the cryptographic operation module; the business processing CPU creates a handle according to the business data cryptographic operation requirements, and sends the handle to the configuration management CPU; the configuration management CPU generates a key number according to the handle; the configuration management CPU sends the key library to the FPGA chip; the business processing CPU sends the message to be calculated to the FPGA chip; the convergence distribution module in the FPGA chip receives the message to be calculated, and forwards the message to be calculated to the algorithm scheduling module; the algorithm scheduling module performs fragmentation judgment according to the sequence of the message to be calculated, and judges the result according to the sequence. Perform subsequent processing; determine whether it is the last data fragment according to the tail piece identifier of the message to be calculated, and perform subsequent processing according to the tail piece judgment result; when the statistical value of the primary key and the field protection buffer area reaches the set value, the primary key and the field buffer area timestamp are judged, if the primary key and the field buffer area timestamp do not exceed the set threshold, the intermediate chain variables and timestamp after the calculation are written into the secondary key and the field buffer; return the calculation result to the business processing CPU, and perform the next round of message calculation; if the primary key and the field buffer area timestamp exceed the set threshold, the intermediate chain variables before the calculation are transferred to the secondary key and the field protection buffer area, and the intermediate chain variables and timestamp after the calculation are written into the primary key and the field buffer; return the calculation result to the business processing CPU, and perform the next round of message calculation. The present invention establishes a field protection efficient cache unit locally through FPGA, integrates the key library and the field protection and recovery functions, and significantly reduces the number of times the FPGA requests keys from the configuration management CPU. The present invention designs a two-level cache structure composed of an on-chip cache and an external DDR memory chip to share and balance the flow pressure of the storage unit, and prioritizes the intermediate variables generated by the latest and frequent operations to be placed on the chip. The present invention supports multiple data streams sharing the same algorithm core through a field protection mechanism and private cache area, thereby increasing the number of user connections and security of the device. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] In order to more clearly illustrate the implementation methods of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for the implementation methods or the description of the prior art. Obviously, the drawings in the following description are only exemplary, and for ordinary technicians in this field, other implementation drawings can be derived from the provided drawings without creative work.

[0048] The structures, proportions, sizes, etc. illustrated in this specification are only used to match the contents disclosed in the specification so as to facilitate understanding and reading by persons familiar with the technology. They are not used to limit the conditions under which the present invention can be implemented, and therefore have no substantial technical significance. Any structural modification, change in proportion or adjustment of size shall still fall within the scope of the technical contents disclosed in the present invention without affecting the effects and purposes that can be achieved by the present invention.

[0049] Figure 1 A schematic flow chart of a method for implementing high-speed algorithm operation based on multi-level on-site cache provided in Embodiment 1 of the present invention;

[0050] Figure 2 A schematic diagram of a specific implementation flow of a method for realizing high-speed algorithm operation based on multi-level on-site cache provided in Embodiment 1 of the present invention;

[0051] Figure 3 A schematic diagram of an application scenario of a method for realizing high-speed algorithm operation based on multi-level on-site cache provided in Embodiment 1 of the present invention;

[0052] Figure 4 This is a schematic diagram of the architecture of a device for implementing high-speed algorithm calculation based on multi-level on-site cache provided in Example 2 of the present invention. DETAILED DESCRIPTION

[0053] The following is a description of the implementation of the present invention by specific embodiments. People familiar with the art can easily understand other advantages and effects of the present invention from the contents disclosed in this specification. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0054] Example 1

[0055] See also Figure 1 and Figure 2 Embodiment 1 of the present invention provides a method for realizing high-speed algorithm operation based on multi-level on-site cache, comprising the following steps:

[0056] S1. The configuration management CPU sends the algorithm parameters to the FPGA chip; the convergence distribution module in the FPGA chip configures the algorithm parameters to the cryptographic operation module, and saves the algorithm parameters through the RAM inside the cryptographic operation module;

[0057] S2. The business processing CPU creates a handle according to the business data cryptographic operation requirements and sends the handle to the configuration management CPU; the configuration management CPU generates a key number according to the handle;

[0058] S3, the configuration management CPU sends the key library to the FPGA chip;

[0059] S4, the business processing CPU sends the message to be calculated to the FPGA chip; the convergence distribution module in the FPGA chip receives the message to be calculated, and forwards the message to be calculated to the algorithm scheduling module;

[0060] S5, the algorithm scheduling module performs segmentation judgment according to the sequence of the message to be calculated, and performs subsequent processing according to the sequence judgment result;

[0061] S6. If the sequence number is 0, the message to be calculated is the first fragment; obtain the corresponding key number according to the handle number index carried by the first fragment, and read the key and initialization vector information stored in the BRAM module through the address corresponding to the key number; send the read key, initialization vector and the message to be calculated to the cryptographic operation module for calculation;

[0062] S7. If the sequence number is not 0, the message to be calculated is not the first fragment; obtain the key and the intermediate chain variable of the data fragment in the field protection buffer by reading; send the intermediate chain variable and the message to be calculated to the cryptographic operation module for calculation;

[0063] S8, the cryptographic operation module uses the received key, initialization vector or the intermediate chain variable and the message to be operated as input, performs cryptographic operation, and outputs the calculation result and the intermediate chain variable after the operation;

[0064] S9, judging whether it is the last data fragment according to the tail piece identifier of the message to be calculated, and performing subsequent processing according to the tail piece judgment result;

[0065] S10, if the tail piece identifier is 1, the tail piece is the last data fragment; delete the primary key and the content of the field protection buffer area; return the calculation result and the task number to the business processing CPU;

[0066] S11, if the tail piece identifier is 0, the tail piece is not the last data fragment; the statistical value of the primary key and the scene protection buffer area is judged, and if the statistical value reaches the set value, the primary key and the scene buffer time stamp are judged; if the statistical value does not reach the set value, the calculated intermediate chain variable is written into the primary key and the scene protection buffer area, and a timestamp is added; the calculation result is returned to the business processing CPU, and the next round of message calculation is performed;

[0067] S12. When the statistical value of the primary key and the on-site protection buffer reaches the set value, the primary key and the on-site buffer timestamp are judged. If the primary key and the on-site buffer timestamp do not exceed the set threshold, the intermediate chain variables and timestamp after the calculation are written into the secondary key and the on-site buffer; the calculation result is returned to the business processing CPU, and the next round of message calculation is performed; if the primary key and the on-site buffer timestamp exceed the set threshold, the intermediate chain variables before the calculation are transferred to the secondary key and the on-site protection buffer, and the intermediate chain variables and timestamp after the calculation are written into the primary key and the on-site buffer; the calculation result is returned to the business processing CPU, and the next round of message calculation is performed.

[0068] In this embodiment, Figure 3 As shown, the application scenarios of the method for realizing high-speed algorithm operation based on multi-level on-site cache include:

[0069] FPGA chip (A001): implements algorithm core operation, scheduling and field protection functions, and uses the on-chip BRAM storage area as the first-level cache for keys and intermediate results;

[0070] Business processing CPU (A002): connected to A001 through the PCIE interface, responsible for sending and receiving plaintext and ciphertext business data with A001;

[0071] Configuration management CPU (A003): connected to A001 through the eth Ethernet interface to configure and manage the keys and parameters of each functional module inside A001;

[0072] DDR memory chip (A004): connected to A001 through the DDR bus, as the off-chip storage area of ​​A001, used for the secondary cache of keys and intermediate results;

[0073] Convergence and distribution module (B001): A001 internal functional module, responsible for the sending and receiving of management data and business data between A002, A003 and A001;

[0074] Algorithm scheduling module (B002): A001 internal functional module, responsible for the scheduling and control of C001-C00n multi-algorithm cores;

[0075] Site management module (B003): A001 internal functional module, maintaining the algorithm site corresponding to each business data flow of B001, completing site write-back and sequence number update, etc.;

[0076] BRAM module (B004): A001 on-chip storage area, used for the first-level cache of keys and intermediate results;

[0077] DDR controller (B005): A001 internal functional module, responsible for access control between A004 key and intermediate result secondary cache;

[0078] Cryptographic operation module (C001-C00n): A001 internal functional module, responsible for cryptographic operation functions.

[0079] In this embodiment, in step S1, the configuration management CPU sends the algorithm parameters to the FPGA chip; the convergence distribution module in the FPGA chip configures the algorithm parameters to the cryptographic operation module, and saves the algorithm parameters through the RAM inside the cryptographic operation module;

[0080] Specifically, the configuration management CPU sends the algorithm parameters to the FPGA chip; the convergence distribution module in the FPGA chip configures the algorithm parameters to the cryptographic operation module, and saves the algorithm parameters through the RAM inside the cryptographic operation module, so that the cryptographic operation module has the conditions for cryptographic operation.

[0081] In this embodiment, in step S2, the business processing CPU creates a handle according to the business data cryptographic operation requirements, and sends the handle to the configuration management CPU; the configuration management CPU generates a key number according to the handle;

[0082] Specifically, when the business processing CPU has business data that requires cryptographic operations, it creates a handle and sends it to the configuration management CPU; the configuration management CPU generates a key number based on the handle, and the key number corresponds to the storage address of the key and initialization vector in the DDR memory chip.

[0083] In this embodiment, in step S3, the configuration management CPU sends the key library to the FPGA chip;

[0084] The key library includes: a handle, a key number, a key, and an initialization vector.

[0085] In this embodiment, in step S4, the service processing CPU sends the message to be calculated to the FPGA chip; the convergence distribution module in the FPGA chip receives the message to be calculated, and forwards the message to be calculated to the algorithm scheduling module;

[0086] The message to be calculated includes data to be calculated, a handle number, a sequence number and a tail piece identifier.

[0087] In this embodiment, in step S5, the algorithm scheduling module performs segmentation judgment according to the sequence of the message to be calculated, and performs subsequent processing according to the sequence judgment result;

[0088] In this embodiment, in step S6, if the sequence number is 0, the message to be calculated is the first fragment; the corresponding key number is obtained according to the handle number index carried by the first fragment, and the key and initialization vector information stored in the BRAM module are read through the address corresponding to the key number; the read key, initialization vector and the message to be calculated are sent to the cryptographic operation module for calculation;

[0089] In this embodiment, in step S7, if the sequence number is not 0, the message to be calculated is not the first fragment; the intermediate chain variables of the data fragment in the key and the field protection buffer are obtained by reading; the intermediate chain variables and the message to be calculated are sent to the cryptographic operation module for calculation;

[0090] Specifically, the intermediate chain variable of the previous data shard of the key and the on-site protection buffer is read and sent together with the current data shard to the cryptographic operation module for calculation.

[0091] In this embodiment, in step S8, the cryptographic operation module uses the received key, initialization vector or the intermediate chain variable and the message to be operated as input, performs cryptographic operation, and outputs the calculation result and the intermediate chain variable after the operation;

[0092] Specifically, the cryptographic operation module uses the key, initialization vector or intermediate chain variable and data to be operated as input to perform cryptographic operation. After the operation is completed, the calculation result and the intermediate chain variable after the operation are output.

[0093] In this embodiment, in step S9, it is determined whether it is the last data fragment according to the tail piece identifier of the message to be calculated, and subsequent processing is performed according to the tail piece determination result;

[0094] In this embodiment, in step S10, if the tail piece identifier is 1, the tail piece is the last data fragment; the primary key and the content of the field protection buffer are deleted; the calculation result and the task number are returned to the business processing CPU;

[0095] In this embodiment, in step S11, if the tail piece identifier is 0, the tail piece is not the last data fragment; the statistical value of the primary key and the scene protection buffer area is judged, and if the statistical value reaches the set value, the primary key and the scene buffer time stamp are judged; if the statistical value does not reach the set value, the calculated intermediate chain variable is written into the primary key and the scene protection buffer area, and a timestamp is added; the calculation result is returned to the business processing CPU, and the next round of message calculation is performed;

[0096] Among them, the first-level key and field protection cache use internal BRAM to create 1K caches, and use a counter to count the cache usage. Each time an intermediate chain variable is added, the statistics are incremented by 1, and each time the cache of an intermediate chain variable is released, the statistics are decremented by 1; after the cryptographic operation of the business message, it is determined whether the statistical value of the first-level key and field protection cache reaches 1K. If it reaches 1K, the first-level key and field buffer timestamp are determined; if the statistical value does not reach 1K, the intermediate chain variable after the operation is written into the first-level key and field protection cache, and a timestamp is added; the calculation result is returned to the business processing CPU, and the process returns to step S4 for the next round of message operation.

[0097] In this embodiment, in step S12, when the statistical value of the first-level key and the scene protection buffer area reaches the set value, when the first-level key and the scene buffer area timestamp are judged, if the first-level key and the scene buffer area timestamp do not exceed the set threshold, the intermediate chain variables and timestamp after the calculation are written into the second-level key and the scene buffer area; the calculation result is returned to the business processing CPU, and the next round of message calculation is performed; if the first-level key and the scene buffer area timestamp exceed the set threshold, the intermediate chain variables before the calculation are transferred to the second-level key and the scene protection buffer area, and the intermediate chain variables and timestamp after the calculation are written into the first-level key and the scene buffer area; the calculation result is returned to the business processing CPU, and the next round of message calculation is performed.

[0098] Specifically, when the statistical value of the primary key and the scene protection buffer area reaches the set value, the primary key and the scene buffer area timestamp are judged. If the primary key and the scene buffer area timestamp do not exceed the set threshold, the calculated intermediate chain variable and timestamp are written into the secondary key and the scene buffer area; the calculation result is returned to the business processing CPU, and the process returns to step S4 for the next round of message calculation;

[0099] If the first-level key and the on-site buffer timestamp exceed the set threshold, the intermediate chain variables before the calculation (equivalent to the old intermediate chain variables) are transferred to the second-level key and on-site protection cache area, and the intermediate chain variables and timestamps after the calculation are written into the first-level key and on-site buffer; the calculation result is returned to the business processing CPU, and the process returns to step S4 for the next round of message calculation.

[0100] In summary, the present invention sends algorithm parameters to the FPGA chip through the configuration management CPU; the convergence and distribution module in the FPGA chip configures the algorithm parameters to the cryptographic operation module, and saves the algorithm parameters through the RAM inside the cryptographic operation module; the business processing CPU creates a handle according to the business data cryptographic operation requirements, and sends the handle to the configuration management CPU; the configuration management CPU generates a key number according to the handle; the configuration management CPU sends the key library to the FPGA chip; the business processing CPU sends the message to be calculated to the FPGA chip; the convergence and distribution module in the FPGA chip receives the message to be calculated, and forwards the message to be calculated to the algorithm scheduling module; the algorithm scheduling module generates a key number according to the handle; the key library is sent ... The sequence of the message to be operated is judged by sharding, and subsequent processing is performed according to the sequence judgment result; if the sequence number is 0, the message to be operated is the first shard; the corresponding key number is obtained according to the handle number index carried by the first shard, and the key and initialization vector information stored in the BRAM module are read through the address corresponding to the key number; the read key, initialization vector and the message to be operated are sent to the cryptographic operation module for calculation; if the sequence number is not 0, the message to be operated is not the first shard; the intermediate chain variables of the key and the data shard in the field protection buffer area are obtained by reading; the intermediate chain variables and the message to be operated are sent to the cryptographic operation module for calculation; the cryptographic operation module receives the received key, initialization vector or the The intermediate chain variables and the message to be calculated are used as input to perform cryptographic calculations, and the calculation results and the intermediate chain variables after the calculation are output; whether it is the last data fragment is determined according to the tail piece identifier of the message to be calculated, and subsequent processing is performed according to the tail piece judgment result; if the tail piece identifier is 1, the tail piece is the last data fragment; the first-level key and the content of the on-site protection buffer area are deleted; the calculation result and the task number are returned to the business processing CPU; if the tail piece identifier is 0, the tail piece is not the last data fragment; the statistical value of the first-level key and the on-site protection buffer area is judged, and if the statistical value reaches the set value, the first-level key and the on-site buffer time stamp are judged; if the statistical value does not reach the set value, the intermediate chain variables after the calculation are written into the first-level key. The calculation result is returned to the business processing CPU, and the next round of message calculation is performed; when the statistical value of the primary key and the scene protection buffer reaches the set value, the primary key and the scene buffer timestamp are judged, if the primary key and the scene buffer timestamp do not exceed the set threshold, the intermediate chain variables and timestamp after the calculation are written into the secondary key and scene buffer; the calculation result is returned to the business processing CPU, and the next round of message calculation is performed; if the primary key and the scene buffer timestamp exceed the set threshold, the intermediate chain variables before the calculation are transferred to the secondary key and scene protection buffer, and the intermediate chain variables and timestamp after the calculation are written into the primary key and scene buffer;The calculation result is returned to the business processing CPU, and the next round of message calculation is performed. The present invention establishes a local field protection efficient cache unit through FPGA, which integrates the key library and field protection and recovery functions, and significantly reduces the number of times the FPGA requests keys from the configuration management CPU. The present invention designs a two-level cache structure composed of an on-chip cache and an external DDR storage chip to share and balance the flow pressure of the storage unit, and prioritizes the intermediate variables generated by the latest and frequent calculations on the chip. The present invention supports multiple data streams sharing the same algorithm core through a field protection mechanism and private cache area, thereby increasing the number of user connections and security of the device. ;

[0101] It should be noted that the method of the embodiment of the present disclosure can be performed by a single device, such as a computer or a server. The method of the present embodiment can also be applied in a distributed scenario and completed by multiple devices cooperating with each other. In the case of such a distributed scenario, one of the multiple devices can only perform one or more steps in the method of the embodiment of the present disclosure, and the multiple devices will interact with each other to complete the described method.

[0102] It should be noted that the above describes some embodiments of the present disclosure. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the above embodiments and still achieve the desired results. In addition, the processes depicted in the accompanying drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0103] Example 2

[0104] See also Figure 4 Embodiment 2 of the present invention further provides a device for implementing high-speed algorithm operation based on multi-level on-site cache, comprising:

[0105] The algorithm parameter sending unit 001 is used to configure the management CPU to send the algorithm parameters to the FPGA chip; the convergence distribution module in the FPGA chip configures the algorithm parameters to the cryptographic operation module, and saves the algorithm parameters through the RAM inside the cryptographic operation module;

[0106] The key number generating unit 002 is used for the business processing CPU to create a handle according to the business data cryptographic operation requirements, and send the handle to the configuration management CPU; the configuration management CPU generates a key number according to the handle;

[0107] The key library sending unit 003 is used to configure the management CPU to send the key library to the FPGA chip;

[0108] The message sending unit 004 is used for the service processing CPU to send the message to be calculated to the FPGA chip; the convergence distribution module in the FPGA chip receives the message to be calculated, and forwards the message to be calculated to the algorithm scheduling module;

[0109] The fragmentation judgment processing unit 005 is used for the algorithm scheduling module to perform fragmentation judgment according to the sequence of the message to be calculated, and perform subsequent processing according to the sequence judgment result;

[0110] The first shard processing unit 006 is used to, if the sequence number is 0, the message to be calculated is the first shard; obtain the corresponding key number according to the handle number index carried by the first shard, read the key and initialization vector information stored in the BRAM module through the address corresponding to the key number; send the read key, initialization vector and the message to be calculated to the cryptographic operation module for calculation;

[0111] The intermediate chain variable reading processing unit 007 is used for, if the sequence number is not 0, the message to be calculated is not the first fragment; obtaining the intermediate chain variables of the key and the data fragment in the field protection buffer by reading; sending the intermediate chain variables and the message to be calculated to the cryptographic operation module for calculation;

[0112] The cryptographic operation processing unit 008 is used for the cryptographic operation module to take the received key, initialization vector or the intermediate chain variable and the message to be operated as input, perform cryptographic operation, and output the calculation result and the intermediate chain variable after the operation;

[0113] The tail piece determination processing unit 009 is used to determine whether it is the last data fragment according to the tail piece identifier of the message to be calculated, and perform subsequent processing according to the tail piece determination result;

[0114] The last data fragment processing unit 010 is used to, if the last fragment identifier is 1, the last fragment is the last data fragment; delete the first-level key and the content of the on-site protection buffer area; return the calculation result and the task number to the business processing CPU;

[0115] The primary key and scene protection buffer statistical value judgment processing unit 011 is used to judge the primary key and scene protection buffer statistical value if the tail piece identifier is 0, then the tail piece is not the last data fragment; judge the primary key and scene protection buffer statistical value, if the statistical value reaches the set value, then judge the primary key and scene buffer timestamp; if the statistical value does not reach the set value, then write the calculated intermediate chain variable into the primary key and scene protection buffer, and add a timestamp; return the calculation result to the business processing CPU, and perform the next round of message calculation;

[0116] The first-level key and scene buffer timestamp judgment processing unit 012 is used to judge the first-level key and scene buffer timestamp when the statistical value of the first-level key and scene protection buffer reaches the set value. If the first-level key and scene buffer timestamp do not exceed the set threshold, the intermediate chain variables and timestamp after the calculation are written into the second-level key and scene buffer; the calculation result is returned to the business processing CPU, and the next round of message calculation is performed; if the first-level key and scene buffer timestamp exceed the set threshold, the intermediate chain variables before the calculation are transferred to the second-level key and scene protection buffer, and the intermediate chain variables and timestamp after the calculation are written into the first-level key and scene buffer; the calculation result is returned to the business processing CPU, and the next round of message calculation is performed.

[0117] In this embodiment, in the key number generating unit 002, in the process of configuring the management CPU to generate the key number according to the handle, the key number corresponds to the storage address of the key and the initialization vector in the DDR memory chip.

[0118] In this embodiment, in the key library issuing unit 003, the key library includes: a handle, a key number, a key, and an initialization vector.

[0119] In this embodiment, in the message to be calculated sending unit 004, the message to be calculated includes data to be calculated, a handle number, a sequence number and a tail piece identifier.

[0120] In this embodiment, in the first-level key and scene protection cache statistical value judgment processing unit 011, the first-level key and scene protection cache use internal BRAM to create a set capacity cache, and use a counter to count the cache usage; each time an intermediate chain variable is added, the statistics are incremented by 1, and each time the cache of an intermediate chain variable is released, the statistics are decremented by 1.

[0121] It should be noted that the information interaction, execution process, etc. between the modules of the above-mentioned system are based on the same concept as the method embodiment in Example 1 of the present application, and the technical effects they bring are the same as those of the method embodiment of the present application. For specific contents, please refer to the description in the method embodiment shown above in the present application, and will not be repeated here.

[0122] Example 3

[0123] Embodiment 3 of the present invention provides a non-transitory computer-readable storage medium, in which a program code for a method for implementing high-speed algorithm calculation based on multi-level on-site cache is stored. The program code includes instructions for executing embodiment 1 or any possible implementation method of the method for implementing high-speed algorithm calculation based on multi-level on-site cache.

[0124] The computer-readable storage medium may be any available medium that can be accessed by a computer or a data storage device such as a server or a data center that includes one or more available media. The available medium may be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state drive (SSD)).

[0125] Example 4

[0126] Embodiment 4 of the present invention provides an electronic device, including: a memory and a processor;

[0127] The processor and the memory communicate with each other via a bus; the memory stores program instructions that can be executed by the processor, and the processor calls the program instructions to execute embodiment 1 or any possible implementation thereof, a method for high-speed algorithm calculation based on multi-level on-site cache.

[0128] Specifically, the processor can be implemented by hardware or by software. When implemented by hardware, the processor can be a logic circuit, an integrated circuit, etc.; when implemented by software, the processor can be a general-purpose processor implemented by reading software codes stored in a memory. The memory can be integrated in the processor or can be located outside the processor and exist independently.

[0129] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present invention is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable systems. The computer instructions can be stored in a computer-readable storage medium, or transmitted from a computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions can be transmitted from a website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center.

[0130] Obviously, those skilled in the art should understand that the above modules or steps of the present invention can be implemented by a general computing system, they can be concentrated on a single computing system, or distributed on a network composed of multiple computing systems, and optionally, they can be implemented by a program code executable by a computing system, so that they can be stored in a storage system and executed by the computing system, and in some cases, the steps shown or described can be executed in a different order than here, or they can be made into individual integrated circuit modules, or multiple modules or steps therein can be made into a single integrated circuit module for implementation. Thus, the present invention is not limited to any specific combination of hardware and software.

[0131] Although the present invention has been described in detail above by general description and specific embodiments, it is obvious to those skilled in the art that some modifications or improvements can be made to the present invention. Therefore, these modifications or improvements made without departing from the spirit of the present invention all belong to the scope of protection claimed by the present invention.

Claims

1. A method for realizing high-speed algorithm operation based on multi-level on-site cache, characterized in that: include: The configuration management CPU sends the algorithm parameters to the FPGA chip; the convergence distribution module in the FPGA chip configures the algorithm parameters to the cryptographic operation module, and saves the algorithm parameters through the RAM inside the cryptographic operation module; The business processing CPU creates a handle according to the business data cryptographic operation requirements, and sends the handle to the configuration management CPU; the configuration management CPU generates a key number according to the handle; The configuration management CPU sends the key library to the FPGA chip; The business processing CPU sends the message to be calculated to the FPGA chip; the convergence distribution module in the FPGA chip receives the message to be calculated, and forwards the message to be calculated to the algorithm scheduling module; The algorithm scheduling module performs fragmentation judgment according to the sequence of the message to be calculated, and performs subsequent processing according to the sequence judgment result; The cryptographic operation module takes the received key, initialization vector or intermediate chain variable and the message to be operated as input, performs cryptographic operation, and outputs the calculation result and the intermediate chain variable after the operation; Determine whether it is the last data fragment according to the tail piece identifier of the message to be calculated, and perform subsequent processing according to the tail piece determination result; When the statistical value of the primary key and the on-site protection buffer reaches the set value, the primary key and the on-site buffer timestamp are judged. If the primary key and the on-site buffer timestamp do not exceed the set threshold, the intermediate chain variables and timestamp after the calculation are written into the secondary key and the on-site buffer; the calculation result is returned to the business processing CPU, and the next round of message calculation is performed; if the primary key and the on-site buffer timestamp exceed the set threshold, the intermediate chain variables before the calculation are transferred to the secondary key and the on-site protection buffer, and the intermediate chain variables and timestamp after the calculation are written into the primary key and the on-site buffer; the calculation result is returned to the business processing CPU, and the next round of message calculation is performed.

2. A method for realizing high-speed algorithm operation based on multi-level on-site cache according to claim 1, characterized in that: In the process of configuring the management CPU to generate a key number according to the handle, the key number corresponds to the storage address of the key and the initialization vector in the DDR memory chip.

3. A method for realizing high-speed algorithm operation based on multi-level on-site cache according to claim 2, characterized in that: The key library includes: a handle, a key number, a key, and an initialization vector.

4. The method for realizing high-speed algorithm operation based on multi-level on-site cache according to claim 3, characterized in that: The message to be calculated includes the data to be calculated, the handle number, the sequence number and the tail piece identifier; In the subsequent processing according to the sequence judgment result, if the sequence number is 0, the message to be calculated is the first fragment; the corresponding key number is obtained according to the handle number index carried by the first fragment, and the key and initialization vector information stored in the BRAM module are read through the address corresponding to the key number; the read key, initialization vector and the message to be calculated are sent to the cryptographic operation module for calculation; If the sequence number is not 0, the message to be calculated is not the first fragment; The intermediate chain variables of the key and the data slice in the field protection buffer area are obtained by reading; the intermediate chain variables and the message to be calculated are sent to the cryptographic calculation module for calculation.

5. The method for realizing high-speed algorithm operation based on multi-level on-site cache according to claim 4, characterized in that: In the subsequent processing according to the tail piece judgment result, if the tail piece identifier is 1, the tail piece is the last data fragment; the first-level key and the content of the field protection buffer area are deleted; the calculation result and the task number are returned to the business processing CPU; If the tail piece identifier is 0, the tail piece is not the last data fragment; the statistical value of the primary key and the scene protection buffer area is judged, and if the statistical value reaches the set value, the primary key and the scene buffer time stamp are judged; if the statistical value does not reach the set value, the calculated intermediate chain variable is written into the primary key and the scene protection buffer area, and a timestamp is added; the calculation result is returned to the business processing CPU, and the next round of message calculation is performed; The primary key and field protection cache uses internal BRAM to create a cache with a set capacity, and uses a counter to count the cache usage; each time an intermediate chain variable is added, the statistics are incremented by 1, and each time the cache of an intermediate chain variable is released, the statistics are decremented by 1.

6. A device for realizing high-speed algorithm operation based on multi-level on-site cache, adopting a method for realizing high-speed algorithm operation based on multi-level on-site cache as claimed in any one of claims 1 to 5, characterized in that: include: The algorithm parameter sending unit is used to configure the management CPU to send the algorithm parameters to the FPGA chip; the convergence distribution module in the FPGA chip configures the algorithm parameters to the cryptographic operation module, and saves the algorithm parameters through the RAM inside the cryptographic operation module; The key number generating unit is used for the business processing CPU to create a handle according to the business data cryptographic operation requirements, and send the handle to the configuration management CPU; the configuration management CPU generates a key number according to the handle; The key library sending unit is used to configure the management CPU to send the key library to the FPGA chip; The message sending unit to be calculated is used for the business processing CPU to send the message to be calculated to the FPGA chip; the convergence distribution module in the FPGA chip receives the message to be calculated, and forwards the message to be calculated to the algorithm scheduling module; A fragmentation judgment processing unit, used for the algorithm scheduling module to perform fragmentation judgment according to the sequence of the message to be calculated, and perform subsequent processing according to the sequence judgment result; A first shard processing unit, configured to: if the sequence number is 0, the message to be calculated is the first shard; obtain the corresponding key number according to the handle number index carried by the first shard, read the key and initialization vector information stored in the BRAM module through the address corresponding to the key number; and send the read key, initialization vector and the message to be calculated to the cryptographic operation module for calculation; A tail piece determination processing unit, used to determine whether it is the last data fragment according to the tail piece identifier of the message to be calculated, and perform subsequent processing according to the tail piece determination result; The first-level key and on-site buffer timestamp judgment processing unit is used to judge the first-level key and on-site buffer timestamp when the statistical value of the first-level key and on-site protection buffer reaches the set value. If the first-level key and on-site buffer timestamp do not exceed the set threshold, the intermediate chain variables and timestamp after the calculation are written into the second-level key and on-site buffer; the calculation result is returned to the business processing CPU, and the next round of message calculation is performed; if the first-level key and on-site buffer timestamp exceed the set threshold, the intermediate chain variables before the calculation are transferred to the second-level key and on-site protection buffer, and the intermediate chain variables and timestamp after the calculation are written into the first-level key and on-site buffer; the calculation result is returned to the business processing CPU, and the next round of message calculation is performed.

7. The device for realizing high-speed algorithm operation based on multi-level on-site cache according to claim 6, characterized in that: In the key number generating unit, in the process of configuring the management CPU to generate the key number according to the handle, the key number corresponds to the storage address of the key and the initialization vector in the DDR memory chip.

8. The device for realizing high-speed algorithm operation based on multi-level on-site cache according to claim 7, characterized in that: In the key library issuing unit, the key library includes: a handle, a key number, a key, and an initialization vector.

9. The device for realizing high-speed algorithm operation based on multi-level on-site cache according to claim 8, characterized in that: In the message sending unit to be calculated, the message to be calculated includes data to be calculated, a handle number, a sequence number and a tail piece identifier; Also includes: The intermediate chain variable reading processing unit is used for, if the sequence number is not 0, the message to be calculated is not the first fragment; obtaining the intermediate chain variable of the data fragment in the key and the field protection buffer by reading; sending the intermediate chain variable and the message to be calculated to the cryptographic operation module for calculation; The cryptographic operation processing unit is used for the cryptographic operation module to take the received key, initialization vector or the intermediate chain variable and the message to be operated as input, perform cryptographic operation, and output the calculation result and the intermediate chain variable after the operation.

10. The device for realizing high-speed algorithm operation based on multi-level on-site cache according to claim 9, characterized in that: In the primary key and scene protection buffer statistical value judgment processing unit, the primary key and scene protection buffer use internal BRAM to create a set capacity buffer, and use a counter to count the usage of the buffer; each time an intermediate chain variable is added, the statistics are incremented by 1, and each time a cache of an intermediate chain variable is released, the statistics are decremented by 1; Also includes; A last data fragment processing unit, for determining that if the last fragment identifier is 1, the last fragment is the last data fragment; Deleting the primary key and the content of the on-site protection buffer; returning the calculation result and the task number to the business processing CPU; The first-level key and on-site protection buffer statistical value judgment processing unit is used to judge the first-level key and on-site protection buffer statistical value if the tail piece identifier is 0, then the tail piece is not the last data fragment; judge the first-level key and on-site protection buffer statistical value, if the statistical value reaches the set value, judge the first-level key and on-site buffer time stamp; if the statistical value does not reach the set value, write the calculated intermediate chain variable into the first-level key and on-site protection buffer, and add a time stamp; return the calculation result to the business processing CPU, and perform the next round of message calculation.

Images