A method and device for implementing high-speed operation of an algorithm based on a multi-level field cache

Abstract

The application discloses a method and device for realizing high-speed operation of an algorithm based on a multi-level field cache, which comprises the following steps: a configuration management CPU sends algorithm parameters to an FPGA chip and saves the algorithm parameters in a RAM; a service processing CPU creates a handle and sends the handle to the configuration management CPU; the configuration management CPU generates a key number according to the handle; the configuration management CPU sends a key library to the FPGA chip; the service processing CPU sends a to-be-operated message to the FPGA chip; an algorithm scheduling module performs fragmentation judgment, and performs subsequent processing according to a sequence judgment result; a password operation module takes the received key, an initialization vector or an intermediate chain variable and the to-be-operated message as input, performs password operation, and outputs a calculation result and an operated intermediate chain variable; whether the to-be-operated message is the last data fragment is judged according to a tail fragment identifier, and subsequent processing is performed according to a tail fragment judgment result. The application can reduce the communication interface and CPU access times, realize high-speed operation of a password algorithm, and improve the overall performance of a password service system.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of cryptographic security technology, in particular to a method and device for realizing high-speed operation of algorithm based on multi-level on-site cache. BACKGROUND

[0002] The new network architecture and information service environment of the big data center based on cloud computing, distributed storage and other technologies have put forward many new technical requirements for cryptographic products. The demand for high-performance, large-concurrency cryptographic products with support for virtualization and service is very urgent. How to improve the algorithm running rate in a multi-task, high-concurrency environment has become a key technology for the successful development of a high-performance cryptographic service system.

[0003] Currently, in a multi-task, high-concurrency cryptographic service scenario, task switching frequently occurs during algorithm operation, which requires high-speed access and query of key resources and intermediate results. In the past, the cryptographic resource management CPU frequently configured keys and parameters for algorithm cores. Although the CPU and algorithm chips can be interconnected through high-speed parallel buses, PCIE, high-speed Ethernet and other communication interfaces, the key request data packet and the intermediate result data packet are mostly short messages of tens or hundreds of bytes. Frequent small packet communication can cause a sharp decline in communication bandwidth, and frequent configuration tasks can also put a heavy burden on the CPU.

[0004] Therefore, how to invent a high-speed operation method to reduce the access frequency of communication interfaces and CPUs, realize high-speed operation of cryptographic algorithms, and improve the overall performance of cryptographic service systems has become a problem to be solved. SUMMARY

[0005] To this end, the present application provides a method and device for realizing high-speed operation of algorithm based on multi-level on-site cache, which uses FPGA on-chip BRAM and external DDR storage chips to establish a multi-level key library and on-site protection efficient cache unit, reduces the access frequency of communication interfaces and CPUs, realizes high-speed operation of cryptographic algorithms, and improves the overall performance of cryptographic service systems.

[0006] In order to achieve the above purpose, the present application provides the following technical scheme: a method for realizing high-speed operation of algorithm based on multi-level on-site cache, comprising:

[0007] The configuration management CPU sends algorithm parameters to the FPGA chip; the aggregation and distribution module in the FPGA chip configures the algorithm parameters to the cryptographic operation module, and saves the algorithm parameters through the RAM inside the cryptographic operation module;

[0008] The service processing CPU creates a handle according to a password operation requirement of service data, and sends the handle to the configuration management CPU; the configuration management CPU generates a key number according to the handle;

[0009] The configuration management CPU issues a key library to the FPGA chip;

[0010] The service processing CPU sends a to-be-operated message to the FPGA chip; a convergence and distribution module in the FPGA chip receives the to-be-operated message, and forwards the to-be-operated message to an algorithm scheduling module;

[0011] The algorithm scheduling module performs fragmentation judgment according to a sequence of the to-be-operated message, and performs subsequent processing according to a sequence judgment result;

[0012] The password operation module takes the received key, initialization vector or intermediate chain variable and the to-be-operated message as input, performs password operation, and outputs a calculation result and an operated intermediate chain variable;

[0013] According to the tail piece identifier of the to-be-operated message, it is judged whether it is the last data fragment, and subsequent processing is performed according to the tail piece judgment result;

[0014] When the statistical value of the primary key and the on-site protection buffer area reaches the set value, the primary key and the on-site buffer area timestamp are judged, if the primary key and the on-site buffer area timestamp do not exceed the set threshold, the operated intermediate chain variable and the timestamp are written into the secondary key and the on-site buffer area; the calculation result is returned to the service processing CPU, and the next round of message operation is performed; if the primary key and the on-site buffer area timestamp exceed the set threshold, the pre-operation intermediate chain variable is stored in the secondary key and the on-site protection buffer area, and the operated intermediate chain variable and the timestamp are written into the primary key and the on-site buffer area; the calculation result is returned to the service processing CPU, and the next round of message operation is performed.

[0015] As a preferred scheme of the method for realizing high-speed operation of an algorithm based on a multi-level on-site cache, in the process in which the configuration management CPU generates a key number according to the handle, the key number corresponds to the storage address of a key and an initialization vector in a DDR storage chip.

[0016] As a preferred scheme of the method for realizing high-speed operation of an algorithm based on a multi-level on-site cache, the key library comprises a handle, a key number, a key, and an initialization vector.

[0017] As a preferred scheme of the method for realizing high-speed operation of an algorithm based on a multi-level on-site cache, the to-be-operated message comprises to-be-operated data, a handle number, a sequence number, and a tail piece identifier.

[0018] According to the sequence judgment result, if the sequence number is 0, the to-be-operated message is a first fragment; according to the handle number index carried by the first fragment, a corresponding key number is obtained, a key and initialization vector information stored in a BRAM module are read through an address corresponding to the key number, and the read key, initialization vector and to-be-operated message are sent to a cryptographic operation module for calculation.

[0019] If the sequence number is not 0, the to-be-operated message is not a first fragment; a middle chain variable of a data fragment in the key and on-site protection cache area is obtained by reading; and the middle chain variable and the to-be-operated message are sent to the cryptographic operation module for calculation.

[0020] As a preferred scheme of the method for realizing high-speed operation of an algorithm based on a multi-level on-site cache, according to the tail piece judgment result, if the tail piece identifier is 1, the tail piece is a last data fragment; the content of the first-level key and the on-site protection cache area is deleted; and the calculation result and the task number are returned to the business processing CPU.

[0021] If the tail piece identifier is 0, the tail piece is not a last data fragment; a statistical value of the first-level key and the on-site protection cache area is judged, if the statistical value reaches a set value, a timestamp of the first-level key and the on-site cache area is judged, if the statistical value does not reach the set value, the operated middle chain variable is written into the first-level key and the on-site protection cache area, and is marked with a timestamp; the calculation result is returned to the business processing CPU, and the next round of message operation is performed.

[0022] The first-level key and the on-site protection cache area use an internal BRAM to create a cache area with a set capacity, and use a counter to count the cache area usage; every time an intermediate chain variable is added, the count is increased by 1, and every time a cache of an intermediate chain variable is released, the count is decreased by 1.

[0023] The application further provides a device for realizing high-speed operation of an algorithm based on a multi-level on-site cache, based on the above method for realizing high-speed operation of an algorithm based on a multi-level on-site cache, comprising:

[0024] An algorithm parameter issuing unit is configured to issue algorithm parameters to an FPGA chip by a configuration management CPU; a convergence and distribution module in the FPGA chip configures the algorithm parameters to a cryptographic operation module, and saves the algorithm parameters through a RAM in the cryptographic operation module.

[0025] A key number generating unit is configured to create a handle by a business processing CPU according to a business data cryptographic operation requirement, and send the handle to a configuration management CPU; the configuration management CPU generates a key number according to the handle.

[0026] The key library issuing unit is configured to manage a CPU to issue a key library to an FPGA chip;

[0027] The to-be-operated message sending unit is configured to manage a business processing CPU to send a to-be-operated message to the FPGA chip; a convergence and distribution module in the FPGA chip receives the to-be-operated message and forwards the to-be-operated message to an algorithm scheduling module;

[0028] The fragmentation judgment processing unit is configured to manage the algorithm scheduling module to perform fragmentation judgment according to a sequence of the to-be-operated message and perform subsequent processing according to a sequence judgment result;

[0029] The first fragmentation processing unit is configured to manage the to-be-operated message to be a first fragment if the sequence number is 0; to obtain a corresponding key number according to a handle number index carried by the first fragment; to read a key and initialization vector information stored in a BRAM module through an address corresponding to the key number; and to send the read key, initialization vector and the to-be-operated message to a cryptographic operation module for calculation;

[0030] The intermediate chain variable reading processing unit is configured to manage the to-be-operated message to not be the first fragment if the sequence number is not 0; to obtain an intermediate chain variable of a data fragment in a key and live protection cache area through reading; and to send the intermediate chain variable and the to-be-operated message to the cryptographic operation module for calculation;

[0031] The cryptographic operation processing unit is configured to manage the cryptographic operation module to take the received key, initialization vector or the intermediate chain variable and the to-be-operated message as input, perform cryptographic operation, and output a calculation result and an operated intermediate chain variable;

[0032] The tail fragment judgment processing unit is configured to manage whether the to-be-operated message tail fragment identification is the last data fragment according to the to-be-operated message tail fragment identification, and to perform subsequent processing according to a tail fragment judgment result;

[0033] The last data fragment processing unit is configured to manage the tail fragment to be the last data fragment if the tail fragment identification is 1; to delete the content of the primary key and the live protection cache area; and to return the calculation result and the task number to the business processing CPU;

[0034] The primary key and live protection cache area statistical value judgment processing unit is configured to manage the tail fragment to not be the last data fragment if the tail fragment identification is 0; to judge a statistical value of the primary key and the live protection cache area; to judge the primary key and live buffer area time stamp if the statistical value reaches a set value; to write the operated intermediate chain variable into the primary key and live protection cache area and stamp a time stamp if the statistical value does not reach the set value; and to return the calculation result to the business processing CPU and perform next round message operation;

[0035] The first-level key and on-site buffer time stamp judgment processing unit is configured to, when the statistical value of the first-level key and on-site protection buffer reaches the set value, judge the first-level key and on-site buffer time stamp, if the first-level key and on-site buffer time stamp does not exceed the set threshold, write the intermediate chain variable and the time stamp after operation into the second-level key and on-site buffer, return the calculation result to the service processing CPU, and perform the next round of packet operation, if the first-level key and on-site buffer time stamp exceeds the set threshold, store the intermediate chain variable before operation into the second-level key and on-site protection buffer, and write the intermediate chain variable and the time stamp after operation into the first-level key and on-site buffer, return the calculation result to the service processing CPU, and perform the next round of packet operation.

[0036] As a preferred scheme of the device for realizing high-speed operation of an algorithm based on multi-level on-site cache, in the key number generation unit, in the process of generating a key number by the management CPU according to the handle, the key number corresponds to a key and an initialization vector in a storage address of a DDR storage chip.

[0037] As a preferred scheme of the device for realizing high-speed operation of an algorithm based on multi-level on-site cache, in the key library issuing unit, the key library includes a handle, a key number, a key, and an initialization vector.

[0038] As a preferred scheme of the device for realizing high-speed operation of an algorithm based on multi-level on-site cache, in the to-be-operated packet sending unit, the to-be-operated packet includes to-be-operated data, a handle number, a sequence number, and a tail piece identifier.

[0039] Further comprising:

[0040] The intermediate chain variable reading processing unit is configured to, if the sequence number is not 0, the to-be-operated packet is not the first fragment, obtain the intermediate chain variable of the data fragment in the key and on-site protection buffer by reading, and send the intermediate chain variable and the to-be-operated packet to the cryptographic operation module for calculation.

[0041] The cryptographic operation processing unit is configured to, the cryptographic operation module takes the received key, initialization vector, or the intermediate chain variable and the to-be-operated packet as input, performs cryptographic operation, and outputs a calculation result and an intermediate chain variable after operation.

[0042] As a preferred scheme of the device for realizing high-speed operation of an algorithm based on multi-level on-site cache, in the first-level key and on-site protection buffer statistical value judgment processing unit, the first-level key and on-site protection buffer uses an internal BRAM to create a buffer with a set capacity, and uses a counter to count the buffer usage; every time an intermediate chain variable is added, the count is increased by 1, and every time a buffer of an intermediate chain variable is released, the count is decreased by 1.

[0043] Also included are;

[0044] A last data fragment processing unit is configured to, if the tail piece identifier is 1, determine that the tail piece is a last data fragment; delete the content of the primary key and the field protection cache area; and return the calculation result and the task number to the service processing CPU.

[0045] A primary key and field protection cache area statistical value judgment processing unit is configured to, if the tail piece identifier is 0, determine that the tail piece is not a last data fragment; judge the statistical value of the primary key and the field protection cache area, if the statistical value reaches a set value, judge the primary key and the field cache area timestamp; if the statistical value does not reach the set value, write the intermediate chain variable after the operation into the primary key and the field protection cache area, and stamp the timestamp; return the calculation result to the service processing CPU, and perform the next round of packet operation.

[0046] The application has the following advantages: the application configures the management CPU to send algorithm parameters to the FPGA chip; the aggregation and distribution module in the FPGA chip configures the algorithm parameters to the cryptographic operation module, and saves the algorithm parameters through the RAM inside the cryptographic operation module; the service processing CPU creates a handle according to the cryptographic operation requirement of service data, and sends the handle to the configuration management CPU; the configuration management CPU generates a key number according to the handle; the configuration management CPU sends a key library to the FPGA chip; the service processing CPU sends a to-be-operated message to the FPGA chip; the aggregation and distribution module in the FPGA chip receives the to-be-operated message, and forwards the to-be-operated message to the algorithm scheduling module; the algorithm scheduling module judges the fragmentation according to the sequence of the to-be-operated message, and performs subsequent processing according to the sequence judgment result; whether it is the last data fragment is judged according to the tail piece identification of the to-be-operated message, and subsequent processing is performed according to the tail piece judgment result; when the statistical value of the primary key and the on-site protection cache area reaches the set value, the primary key and the on-site buffer timestamp are judged, if the primary key and the on-site buffer timestamp do not exceed the set threshold, the intermediate chain variable after operation and the timestamp are written into the secondary key and the on-site buffer area; the calculation result is returned to the service processing CPU, and the next round of message operation is performed; if the primary key and the on-site buffer timestamp exceed the set threshold, the intermediate chain variable before operation is stored in the secondary key and the on-site protection cache area, and the intermediate chain variable after operation and the timestamp are written into the primary key and the on-site buffer area; the calculation result is returned to the service processing CPU, and the next round of message operation is performed. The application establishes an on-site protection efficient cache unit locally through the FPGA, integrates the key library, on-site protection and recovery functions, and significantly reduces the number of times that the FPGA requests the key from the configuration management CPU. The application designs a two-level cache structure composed of the on-chip cache and the external DDR storage chip to share and balance the traffic pressure of the storage unit, and preferentially places the intermediate variables generated by the latest and frequent operation in the on-chip. The application supports multiple data streams to share the same algorithm core through the on-site protection mechanism and the cache area privacy, improves the number of user connections and the security of the device. BRIEF DESCRIPTION OF DRAWINGS

[0047] In order to more clearly illustrate the embodiments of the application or the technical solutions in the prior art, the following will briefly introduce the drawings needed to be used in the embodiments or the prior art description. Obviously, the drawings in the following description are only exemplary, and for those skilled in the art, other drawings can be obtained from the provided drawings without creative labor.

[0048] The structures, proportions, sizes, etc. shown in the specification are only used to cooperate with the disclosed content, to be understood and read by those skilled in the art, and do not have technical significance to limit the conditions that can be implemented by the application. Any modification of the structure, change of the proportional relationship, or adjustment of the size, without affecting the effects and purposes that can be achieved by the application, should still fall within the scope covered by the disclosed technology.

[0049] Figure 1 A flowchart of a method for implementing high-speed operation of an algorithm based on a multi-level field cache is provided in Embodiment 1 of the present application.

[0050] Figure 2 A specific implementation flowchart of a method for implementing high-speed operation of an algorithm based on a multi-level field cache is provided in Embodiment 1 of the present application.

[0051] Figure 3 An application scenario diagram of a method for implementing high-speed operation of an algorithm based on a multi-level field cache is provided in Embodiment 1 of the present application.

[0052] Figure 4 An architecture diagram of a device for implementing high-speed operation of an algorithm based on a multi-level field cache is provided in Embodiment 2 of the present application. DETAILED DESCRIPTION

[0053] The embodiments of the present application are described below by specific embodiments, and those skilled in the art can easily understand other advantages and effects of the present application from the disclosed content. Obviously, the described embodiments are part of the embodiments of the present application, not all. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor fall within the scope of the present application.

[0054] Embodiment 1

[0055] Referring to Figure 1 and Figure 2 Embodiment 1 of the present application provides a method for implementing high-speed operation of an algorithm based on a multi-level field cache, comprising the following steps:

[0056] S1, the configuration management CPU sends the algorithm parameters to the FPGA chip; the aggregation and distribution module in the FPGA chip configures the algorithm parameters to the password operation module, and saves the algorithm parameters through the RAM inside the password operation module;

[0057] S2, the service processing CPU creates a handle according to the password operation demand of the service data, and sends the handle to the configuration management CPU; the configuration management CPU generates a key number according to the handle;

[0058] S3, the configuration management CPU distributes the key library to the FPGA chip;

[0059] S4, the service processing CPU sends the to-be-operated packet to the FPGA chip; the convergence and distribution module in the FPGA chip receives the to-be-operated packet and forwards the to-be-operated packet to the algorithm scheduling module;

[0060] S5, the algorithm scheduling module performs fragmentation judgment according to the sequence of the to-be-operated packet and performs subsequent processing according to the sequence judgment result;

[0061] S6, if the sequence number is 0, the to-be-operated packet is the first fragment; the corresponding key number is obtained according to the handle number index carried by the first fragment, the key and the initialization vector information stored in the BRAM module are read through the address corresponding to the key number; the read key, the initialization vector and the to-be-operated packet are sent to the cryptographic operation module for calculation;

[0062] S7, if the sequence number is not 0, the to-be-operated packet is not the first fragment; the intermediate chain variable of the data fragment in the key and the live protection cache area is obtained by reading; the intermediate chain variable and the to-be-operated packet are sent to the cryptographic operation module for calculation;

[0063] S8, the cryptographic operation module takes the received key, initialization vector or intermediate chain variable and to-be-operated packet as input, performs cryptographic operation, and outputs the calculation result and the intermediate chain variable after operation;

[0064] S9, whether it is the last data fragment is judged according to the tail piece identification of the to-be-operated packet, and subsequent processing is performed according to the tail piece judgment result;

[0065] S10, if the tail piece identification is 1, the tail piece is the last data fragment; the contents of the primary key and the live protection cache area are deleted; the calculation result and the task number are returned to the service processing CPU;

[0066] S11, if the tail piece identification is 0, the tail piece is not the last data fragment; the statistical value of the primary key and the live protection cache area is judged, if the statistical value reaches the set value, the primary key and the live buffer area timestamp are judged; if the statistical value does not reach the set value, the intermediate chain variable after operation is written into the primary key and the live protection cache area, and is marked with a timestamp; the calculation result is returned to the service processing CPU, and the next round of packet operation is performed;

[0067] S12, when the first level key and the statistics value of the on-site protection buffer reach the set value, the first level key and the on-site buffer timestamp are judged, if the first level key and the on-site buffer timestamp do not exceed the set threshold, the intermediate chain variable after operation and the timestamp are written into the second level key and the on-site buffer; the calculation result is returned to the business processing CPU, and the next round of packet operation is carried out; if the first level key and the on-site buffer timestamp exceed the set threshold, the intermediate chain variable before operation is stored in the second level key and the on-site protection buffer, and the intermediate chain variable after operation and the timestamp are written into the first level key and the on-site buffer; the calculation result is returned to the business processing CPU, and the next round of packet operation is carried out.

[0068] In the embodiment, as shown in the application scenario of the method for realizing high-speed operation of algorithm based on multi-level on-site cache includes: Figure 3

[0069] FPGA chip (A001): realize algorithm kernel operation, scheduling and on-site protection function, and use the on-site BRAM storage area as the first level cache of key and intermediate result;

[0070] Business processing CPU (A002): connected with A001 through PCIE interface, responsible for transmitting and receiving clear text and cipher text business data between A001;

[0071] Configuration management CPU (A003): connected with A001 through eth Ethernet interface, realize the configuration and management of key and parameter of each functional module in A001;

[0072] DDR storage chip (A004): connected with A001 through DDR bus, as the off-chip storage area of A001, used for second level cache of key and intermediate result;

[0073] Converge distribution module (B001): A001 internal functional module, responsible for transmitting and receiving management data and business data between A002, A003 and A001;

[0074] Algorithm scheduling module (B002): A001 internal functional module, responsible for scheduling and control of C001-C00n multi-algorithm kernel;

[0075] On-site management module (B003): A001 internal functional module, maintain the algorithm on-site corresponding to each business data stream of B001, complete on-site write back and serial number update, etc.

[0076] BRAM module (B004): A001 on-chip storage area, used for first level cache of key and intermediate result;

[0077] ​DDR controller (B005): an internal functional module of A001, responsible for access control between A004 key and intermediate result secondary cache;

[0078] Cryptographic operation module (C001-C00n): an internal functional module of A001, responsible for cryptographic operation function.

[0079] In this embodiment, in step S1, the configuration management CPU sends algorithm parameters to the FPGA chip; the aggregation and distribution module in the FPGA chip configures the algorithm parameters to the cryptographic operation module, and saves the algorithm parameters through the RAM inside the cryptographic operation module;

[0080] Specifically, the configuration management CPU sends algorithm parameters to the FPGA chip; the aggregation and distribution module in the FPGA chip configures the algorithm parameters to the cryptographic operation module, and saves the algorithm parameters through the RAM inside the cryptographic operation module, so that the cryptographic operation module has the condition for cryptographic operation.

[0081] In this embodiment, in step S2, the service processing CPU creates a handle according to the cryptographic operation requirement of service data, and sends the handle to the configuration management CPU; the configuration management CPU generates a key number according to the handle;

[0082] Specifically, when the service processing CPU has service data requiring cryptographic operation, a handle is created and sent to the configuration management CPU; the configuration management CPU generates a key number according to the handle, and the key number corresponds to the storage address of the key and initialization vector in the DDR storage chip.

[0083] In this embodiment, in step S3, the configuration management CPU sends a key library to the FPGA chip;

[0084] The key library includes: handle, key number, key, and initialization vector.

[0085] In this embodiment, in step S4, the service processing CPU sends a to-be-operated message to the FPGA chip; the aggregation and distribution module in the FPGA chip receives the to-be-operated message, and forwards the to-be-operated message to the algorithm scheduling module;

[0086] The to-be-operated message includes to-be-operated data, handle number, sequence number, and tail piece identifier.

[0087] In this embodiment, in step S5, the algorithm scheduling module performs fragmentation judgment according to the sequence of the to-be-operated message, and performs subsequent processing according to the sequence judgment result;

[0088] In this embodiment, in step S6, if the sequence number is 0, the to-be-operated message is the first fragment; a corresponding key number is obtained according to a handle number index carried by the first fragment, a key and initialization vector information stored in a BRAM module are read through an address corresponding to the key number; and the read key, initialization vector and the to-be-operated message are sent to a cryptographic operation module for calculation.

[0089] In this embodiment, in step S7, if the sequence number is not 0, the to-be-operated message is not the first fragment; a middle chain variable of a data fragment in the key and on-site protection cache area is obtained by reading; and the middle chain variable and the to-be-operated message are sent to the cryptographic operation module for calculation.

[0090] Specifically, the middle chain variable of the last data fragment in the key and on-site protection cache area is read, and the data fragment is sent to the cryptographic operation module for calculation.

[0091] In this embodiment, in step S8, the cryptographic operation module takes the received key, initialization vector or the middle chain variable and the to-be-operated message as input, performs cryptographic operation, and outputs a calculation result and an operated middle chain variable.

[0092] Specifically, the cryptographic operation module takes the key, initialization vector or the middle chain variable and the to-be-operated data as input, performs cryptographic operation, and outputs the calculation result and the operated middle chain variable after the operation.

[0093] In this embodiment, in step S9, whether the to-be-operated message tail piece is the last data fragment is determined according to a tail piece identifier, and subsequent processing is performed according to a tail piece determination result.

[0094] In this embodiment, in step S10, if the tail piece identifier is 1, the tail piece is the last data fragment; the content of the primary key and on-site protection cache area is deleted; and the calculation result and task number are returned to the business processing CPU.

[0095] In this embodiment, in step S11, if the tail piece identifier is 0, the tail piece is not the last data fragment; a statistical value of the primary key and on-site protection cache area is determined, if the statistical value reaches a set value, a primary key and on-site cache area timestamp is determined, if the statistical value does not reach the set value, the operated middle chain variable is written into the primary key and on-site protection cache area and is stamped with a timestamp; the calculation result is returned to the business processing CPU, and the next round of message operation is performed.

[0096] If the statistical value of the primary key and on-site protection cache reaches the set value, the timestamp of the primary key and on-site cache is judged. If the timestamp of the primary key and on-site cache does not exceed the set threshold, the intermediate chain variable after the operation and the timestamp are written into the secondary key and on-site cache. The calculation result is returned to the service processing CPU, and the next round of message operation is performed. If the timestamp of the primary key and on-site cache exceeds the set threshold, the intermediate chain variable before the operation is stored in the secondary key and on-site protection cache, and the intermediate chain variable after the operation and the timestamp are written into the primary key and on-site cache. The calculation result is returned to the service processing CPU, and the next round of message operation is performed.

[0097] In the embodiment, when the statistical value of the primary key and on-site protection cache reaches the set value, the timestamp of the primary key and on-site cache is judged. If the timestamp of the primary key and on-site cache does not exceed the set threshold, the intermediate chain variable after the operation and the timestamp are written into the secondary key and on-site cache. The calculation result is returned to the service processing CPU, and the next round of message operation is performed. If the timestamp of the primary key and on-site cache exceeds the set threshold, the intermediate chain variable before the operation is stored in the secondary key and on-site protection cache, and the intermediate chain variable after the operation and the timestamp are written into the primary key and on-site cache. The calculation result is returned to the service processing CPU, and the next round of message operation is performed.

[0098] Specifically, when the statistical value of the primary key and on-site protection cache reaches the set value, the timestamp of the primary key and on-site cache is judged. If the timestamp of the primary key and on-site cache does not exceed the set threshold, the intermediate chain variable after the operation and the timestamp are written into the secondary key and on-site cache. The calculation result is returned to the service processing CPU, and the next round of message operation is performed.

[0099] If the timestamp of the primary key and on-site cache exceeds the set threshold, the intermediate chain variable before the operation (equivalent to the old intermediate chain variable) is stored in the secondary key and on-site protection cache, and the intermediate chain variable after the operation and the timestamp are written into the primary key and on-site cache. The calculation result is returned to the service processing CPU, and the next round of message operation is performed.

[0100] According to the application, the algorithm parameters are sent to the FPGA chip by the configuration management CPU; the algorithm parameters are configured to the cryptographic operation module by the convergence distribution module in the FPGA chip, and the algorithm parameters are saved by the RAM inside the cryptographic operation module; the handle is created by the service processing CPU according to the cryptographic operation requirement of the service data, and the handle is sent to the configuration management CPU; the key number is generated by the configuration management CPU according to the handle; the key library is sent to the FPGA chip by the configuration management CPU; the to-be-operated message is sent to the FPGA chip by the service processing CPU; the to-be-operated message is received by the convergence distribution module in the FPGA chip, and the to-be-operated message is forwarded to the algorithm scheduling module; the fragmentation is judged according to the sequence of the to-be-operated message, and the subsequent processing is performed according to the sequence judgment result; if the sequence number is 0, the to-be-operated message is the first fragment; the corresponding key number is obtained according to the handle number index carried by the first fragment, the key and the initialization vector information stored in the BRAM module are read through the address corresponding to the key number; the read key, the initialization vector and the to-be-operated message are sent to the cryptographic operation module for calculation; if the sequence number is not 0, the to-be-operated message is not the first fragment; the intermediate chain variable of the data fragment in the key and the field protection cache area is obtained by reading; the intermediate chain variable and the to-be-operated message are sent to the cryptographic operation module for calculation; the key, the initialization vector or the intermediate chain variable and the to-be-operated message received by the cryptographic operation module are taken as inputs for cryptographic operation, and the calculation result and the intermediate chain variable after operation are output; whether the last data fragment is judged according to the tail piece identification of the to-be-operated message, and the subsequent processing is performed according to the tail piece judgment result; if the tail piece identification is 1, the tail piece is the last data fragment; the content of the primary key and the field protection cache area is deleted; the calculation result and the task number are returned to the service processing CPU; if the tail piece identification is 0, the tail piece is not the last data fragment; the statistical value of the primary key and the field protection cache area is judged, if the statistical value reaches the set value, the primary key and the field buffer area timestamp are judged; if the statistical value does not reach the set value, the intermediate chain variable after operation is written into the primary key and the field protection cache area, and is marked with a timestamp; the calculation result is returned to the service processing CPU, and the next round of message operation is performed; when the statistical value of the primary key and the field protection cache area reaches the set value, the primary key and the field buffer area timestamp are judged, if the primary key and the field buffer area timestamp do not exceed the set threshold, the intermediate chain variable after operation and the timestamp are written into the secondary key and the field buffer area; the calculation result is returned to the service processing CPU, and the next round of message operation is performed; if the primary key and the field buffer area timestamp exceed the set threshold, the intermediate chain variable before operation is stored in the secondary key and the field protection cache area, and the intermediate chain variable after operation and the timestamp are written into the primary key and the field buffer area.The calculation result is returned to the service processing CPU, and the next round of packet operation is performed. The application establishes a live protection efficient cache unit locally through the FPGA, integrates the key library and live protection and recovery functions, and significantly reduces the number of times that the FPGA requests the key from the configuration management CPU. The application designs a two-level cache structure composed of the on-chip cache and the externally hung DDR storage chip to share and balance the traffic pressure of the storage unit, and preferentially places the latest and frequently operated intermediate variables on the chip. The application supports multiple data streams to share the same algorithm core through the live protection mechanism and the cache area privacy, improves the user connection number and security of the device.

[0101] It should be noted that the method of the embodiments of the present disclosure can be executed by a single device, such as a computer or a server. The method of the embodiments can also be applied to a distributed scenario, and be completed by multiple devices cooperating with each other. In the distributed scenario, one of the multiple devices can only execute one or more steps in the method of the embodiments of the present disclosure, and the multiple devices can interact with each other to complete the method.

[0102] It should be noted that some embodiments of the present disclosure have been described above. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims can be performed in a different order than the order described above and still achieve the desired result. In addition, the processes depicted in the figures do not necessarily require the particular order shown or sequential order to achieve the desired results. In certain implementations, multitasking and parallel processing can be advantageous.

[0103] Embodiment 2

[0104] Referring to Figure 4 , the embodiment 2 of the present disclosure further provides a device for implementing high-speed algorithm operation based on a multi-level live cache, comprising:

[0105] An algorithm parameter issuing unit 001 is configured to issue algorithm parameters from the configuration management CPU to the FPGA chip; a convergence and distribution module in the FPGA chip configures the algorithm parameters to the cryptographic operation module, and saves the algorithm parameters through the RAM inside the cryptographic operation module;

[0106] A key number generating unit 002 is configured to create a handle according to the cryptographic operation demand of the service data by the service processing CPU, and send the handle to the configuration management CPU; the configuration management CPU generates a key number according to the handle;

[0107] A key library issuing unit 003 is configured to issue the key library from the configuration management CPU to the FPGA chip;

[0108] The to-be-operated message sending unit 004 is configured to send a to-be-operated message to an FPGA chip by a service processing CPU; a convergence and distribution module in the FPGA chip receives the to-be-operated message and forwards the to-be-operated message to an algorithm scheduling module;

[0109] The fragmentation judgment processing unit 005 is configured to perform fragmentation judgment on the to-be-operated message according to a sequence of the to-be-operated message, and perform subsequent processing according to a sequence judgment result.

[0110] The first fragmentation processing unit 006 is configured to determine that the to-be-operated message is a first fragment if the sequence number is 0; obtain a corresponding key number according to a handle number index carried by the first fragment, read a key and initialization vector information stored in a BRAM module through an address corresponding to the key number, and send the read key, initialization vector and the to-be-operated message to a cryptographic operation module for calculation.

[0111] The intermediate chain variable reading processing unit 007 is configured to determine that the to-be-operated message is not the first fragment if the sequence number is not 0; obtain an intermediate chain variable of a data fragment in a key and live protection cache area by reading; and send the intermediate chain variable and the to-be-operated message to the cryptographic operation module for calculation.

[0112] The cryptographic operation processing unit 008 is configured to take the received key, initialization vector or intermediate chain variable and to-be-operated message as input, perform cryptographic operation, and output a calculation result and an operated intermediate chain variable.

[0113] The tail fragment judgment processing unit 009 is configured to determine whether the to-be-operated message is a last data fragment according to a tail fragment identifier of the to-be-operated message, and perform subsequent processing according to a tail fragment judgment result.

[0114] The last data fragment processing unit 010 is configured to determine that the tail fragment is the last data fragment if the tail fragment identifier is 1; delete the content of the primary key and live protection cache area; and return the calculation result and task number to the service processing CPU.

[0115] The primary key and live protection cache area statistical value judgment processing unit 011 is configured to determine that the tail fragment is not the last data fragment if the tail fragment identifier is 0; judge a statistical value of the primary key and live protection cache area; if the statistical value reaches a set value, judge a primary key and live cache area timestamp; if the statistical value does not reach the set value, write the operated intermediate chain variable into the primary key and live protection cache area and stamp a timestamp; return the calculation result to the service processing CPU and perform next round message operation.

[0116] The first-level key and on-site buffer timestamp judgment processing unit 012 is configured to, when the statistical value of the first-level key and on-site protection buffer reaches the set value, judge the first-level key and on-site buffer timestamp, if the first-level key and on-site buffer timestamp does not exceed the set threshold, write the intermediate chain variable and the timestamp after operation into the second-level key and on-site buffer, return the calculation result to the service processing CPU, and perform the next round of packet operation, if the first-level key and on-site buffer timestamp exceeds the set threshold, store the intermediate chain variable before operation into the second-level key and on-site protection buffer, and write the intermediate chain variable and the timestamp after operation into the first-level key and on-site buffer, return the calculation result to the service processing CPU, and perform the next round of packet operation.

[0117] In the key number generation unit 002 in the embodiment, in the process in which the configuration management CPU generates a key number according to the handle, the key number corresponds to a key and an initialization vector in a storage address of a DDR storage chip.

[0118] In the key library issuing unit 003 in the embodiment, the key library comprises a handle, a key number, a key, and an initialization vector.

[0119] In the to-be-operated packet sending unit 004 in the embodiment, the to-be-operated packet comprises to-be-operated data, a handle number, a sequence number, and a tail piece identifier.

[0120] In the first-level key and on-site protection buffer statistical value judgment processing unit 011 in the embodiment, the first-level key and on-site protection buffer uses an internal BRAM to create a buffer with a set capacity, and uses a counter to count the buffer usage; the counter is incremented by 1 for each newly added intermediate chain variable, and is decremented by 1 for each released intermediate chain variable buffer.

[0121] It is explained that the information interaction and execution process between the modules of the system are based on the same concept as the method embodiment in the embodiment 1 of the application, and the technical effects brought by the method embodiment are the same as those of the method embodiment, and the specific content can be referred to the description in the method embodiment described above, which will not be described here.

[0122] Embodiment 3

[0123] The embodiment 3 of the application provides a non-transitory computer readable storage medium, and the computer readable storage medium stores a program code of a method for implementing high-speed operation of an algorithm based on a multi-level on-site cache, and the program code comprises instructions for executing the method for implementing high-speed operation of an algorithm based on a multi-level on-site cache in the embodiment 1 or any possible implementation manner thereof.

[0124] The computer-readable storage medium can be any available medium or data storage that can be accessed by a computer and can be integral to or external to a server, data center, etc. data storage device that includes one or more of the available media. The available medium can be a magnetic medium, (e.g., a floppy diskette, a hard disk drive, a magnetic tape), an optical medium, (e.g., a Compact Disc (CD), a DVD), or a semiconductor medium (e.g., a Solid State Disk (SSD)), etc.

[0125] Embodiment 4

[0126] Embodiment 4 of the present application provides an electronic device, comprising: a memory and a processor;

[0127] The processor and the memory complete the communication between each other through a bus; the memory stores program instructions that can be executed by the processor, and the processor calling the program instructions can execute the method for high-speed operation of the algorithm based on the multi-level field cache of embodiment 1 or any possible implementation manner thereof.

[0128] Specifically, the processor can be implemented by hardware or software. When implemented by hardware, the processor can be a logic circuit, an integrated circuit, etc. When implemented by software, the processor can be a general-purpose processor, which realizes by reading software codes stored in a memory. The memory can be integrated in the processor or exist independently outside the processor.

[0129] In the above embodiments, all or part of the embodiments can be implemented by software, hardware, firmware or any combination thereof. When implemented by software, all or part of the embodiments can be implemented in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of the present application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network or other programmable systems. The computer instructions can be stored in a computer-readable storage medium or transferred from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions can be transferred from one website, computer, server or data center to another website, computer, server or data center through wired (such as coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (such as infrared, wireless, microwave, etc.) mode.

[0130] It should be apparent to those skilled in the art that the modules or steps of the application described above can be implemented with a general purpose computing system, which can be centralized on a single computing system or distributed over a network of multiple computing systems, and optionally implemented with program code executable by a computing system, which can be stored in a storage system and executed by a computing system, and in some cases, the steps shown or described can be performed in a different order than shown or described, or made into individual integrated circuit modules or multiple modules or steps made into a single integrated circuit module. Thus, the application is not limited to any particular combination of hardware and software.

[0131] While the application has been described in detail and with reference to specific embodiments thereof, it will be apparent to one skilled in the art that various modifications or changes can be made therein without departing from the spirit and scope of the application. Accordingly, it is intended that all such modifications and changes be included within the scope of the application as claimed.

Claims

1. A method for implementing high-speed operation of an algorithm based on a multi-level field cache, comprising a two-level cache structure composed of a BRAM in an FPGA and an external DDR memory chip, characterized in that, The method comprises: The configuration management CPU sends algorithm parameters to the FPGA chip; the aggregation and distribution module in the FPGA chip configures the algorithm parameters to the cryptographic operation module, and saves the algorithm parameters through the RAM inside the cryptographic operation module; The service processing CPU creates a handle according to the cryptographic operation requirement of service data, and sends the handle to the configuration management CPU; the configuration management CPU generates a key number according to the handle; The configuration management CPU sends a key library to the FPGA chip; The service processing CPU sends a to-be-operated message to the FPGA chip; the aggregation and distribution module in the FPGA chip receives the to-be-operated message, and forwards the to-be-operated message to the algorithm scheduling module; The algorithm scheduling module performs fragmentation judgment according to the sequence of the to-be-operated message, and performs subsequent processing according to the sequence judgment result; The cryptographic operation module takes the received key, initialization vector or intermediate chain variable and the to-be-operated message as input, performs cryptographic operation, and outputs the calculation result and the operated intermediate chain variable; According to the tail piece identification of the to-be-operated message, it is judged whether it is the last data fragment, and subsequent processing is performed according to the tail piece judgment result; When the statistical value of the primary key and the on-site protection buffer area reaches the set value, the primary key and the on-site buffer area timestamp are judged, if the primary key and the on-site buffer area timestamp do not exceed the set threshold, the operated intermediate chain variable and the timestamp are written into the secondary key and the on-site buffer area; the calculation result is returned to the service processing CPU, and the next round of message operation is performed; if the primary key and the on-site buffer area timestamp exceed the set threshold, the pre-operation intermediate chain variable is stored in the secondary key and the on-site protection buffer area, and the operated intermediate chain variable and the timestamp are written into the primary key and the on-site buffer area; the calculation result is returned to the service processing CPU, and the next round of message operation is performed; In the process of generating a key number by the configuration management CPU according to the handle, the key number corresponds to the storage address of the key and the initialization vector in the DDR storage chip; The key library comprises: a handle, a key number, a key, and an initialization vector; The to-be-operated message comprises to-be-operated data, a handle number, a sequence number, and a tail piece identification; In the subsequent processing process according to the sequence judgment result, if the sequence number is 0, the to-be-operated message is the first fragment; the corresponding key number is obtained according to the handle number index carried by the first fragment, the key and the initialization vector information stored in the BRAM module are read through the address corresponding to the key number; the read key, initialization vector and to-be-operated message are sent to the cryptographic operation module for calculation.

2. The method for high-speed operation of an algorithm based on a multi-level field cache according to claim 1, characterized in that, If the sequence number is not 0, the to-be-operated message is not the first fragment; the intermediate chain variable of the data fragment in the key and on-site protection buffer area is obtained by reading; the intermediate chain variable and the to-be-operated message are sent to the cryptographic operation module for calculation.

3. The method for high-speed computation based on multi-level field cache implementation algorithm according to claim 2, characterized in that, According to the tail piece judgment result, if the tail piece identifier is 1, the tail piece is the last data piece; the primary key and the content of the on-site protection cache area are deleted; the calculation result and the task number are returned to the business processing CPU; If the tail piece identifier is 0, the tail piece is not the last data piece; the statistical value of the primary key and the on-site protection cache area is judged, if the statistical value reaches the set value, the primary key and the on-site cache area timestamp are judged; if the statistical value does not reach the set value, the intermediate chain variable after the operation is written into the primary key and the on-site protection cache area, and is stamped with a timestamp; the calculation result is returned to the business processing CPU, and the next round of message operation is performed; The primary key and the on-site protection cache area use internal BRAM to create a cache area with a set capacity, and use a counter to count the cache area usage; each newly added intermediate chain variable is incremented by 1, and each released intermediate chain variable cache is decremented by 1.

4. A device for implementing high-speed algorithm operation based on multi-level field cache, adopting the method for implementing high-speed algorithm operation based on multi-level field cache according to any one of claims 1-3, characterized in that, Comprise: An algorithm parameter issuing unit, configured to configure a management CPU to issue algorithm parameters to an FPGA chip; a convergence and distribution module in the FPGA chip configures the algorithm parameters to a cryptographic operation module, and saves the algorithm parameters through RAM inside the cryptographic operation module; A key number generating unit, configured to have a business processing CPU create a handle according to business data cryptographic operation requirements, and send the handle to a configuration management CPU; the configuration management CPU generates a key number according to the handle; A key library issuing unit, configured to have a configuration management CPU issue a key library to an FPGA chip; A to-be-operated message sending unit, configured to have a business processing CPU send a to-be-operated message to an FPGA chip; a convergence and distribution module in the FPGA chip receives the to-be-operated message, and forwards the to-be-operated message to an algorithm scheduling module; A piece judgment and processing unit, configured to have an algorithm scheduling module perform piece judgment according to a sequence of the to-be-operated message, and perform subsequent processing according to a sequence judgment result; A first piece processing unit, configured to, if the sequence number is 0, the to-be-operated message is the first piece; according to a handle number index carried by the first piece, a corresponding key number is obtained, a key and initialization vector information stored in a BRAM module are read through an address corresponding to the key number; the read key, initialization vector, and the to-be-operated message are sent to a cryptographic operation module for calculation; A tail piece judgment and processing unit, configured to judge whether the to-be-operated message is the last data piece according to a tail piece identifier of the to-be-operated message, and perform subsequent processing according to a tail piece judgment result. The first key and on-site buffer timestamp judgment processing unit is configured to, when the statistical value of the first key and on-site protection buffer reaches the set value, judge the first key and on-site buffer timestamp, and if the first key and on-site buffer timestamp does not exceed the set threshold, write the intermediate chain variable after operation and the timestamp into the second key and on-site buffer; return the calculation result to the service processing CPU, and perform the next round of packet operation; if the first key and on-site buffer timestamp exceeds the set threshold, store the intermediate chain variable before operation into the second key and on-site protection buffer, and write the intermediate chain variable after operation and the timestamp into the first key and on-site buffer; return the calculation result to the service processing CPU, and perform the next round of packet operation.

5. The apparatus for high-speed computation based on a multi-level field cache implementation algorithm of claim 4, wherein, In the key number generation unit, in the process of generating a key number by the configuration management CPU according to the handle, the key number corresponds to a key and an initialization vector in a storage address of a DDR storage chip.

6. The apparatus for high-speed computation based on a multi-level field cache implementation algorithm of claim 5, wherein, The key library issuing unit, the key library includes: handle, key number, key, initialization vector.

7. The apparatus for high-speed computation based on a multi-level field cache implementation algorithm of claim 6, wherein, The to-be-operated packet sending unit, the to-be-operated packet includes to-be-operated data, handle number, sequence number and tail piece identifier; Further comprising: The intermediate chain variable reading processing unit is configured to, if the sequence number is not 0, the to-be-operated packet is not the first fragment; obtain the intermediate chain variable of the data fragment in the key and on-site protection buffer by reading; send the intermediate chain variable and the to-be-operated packet to the password operation module for calculation; The password operation processing unit is configured to, the password operation module takes the received key, initialization vector or the intermediate chain variable and the to-be-operated packet as input, performs password operation, and outputs the calculation result and the intermediate chain variable after operation.

8. The apparatus for implementing high-speed operation of an algorithm based on a multi-level field cache according to claim 7, wherein, The first key and on-site protection buffer statistical value judgment processing unit is configured to, the first key and on-site protection buffer uses an internal BRAM to create a buffer with a set capacity, and uses a counter to count the buffer usage; each time an intermediate chain variable is added, the counter is incremented by 1, and each time an intermediate chain variable buffer is released, the counter is decremented by 1. Further comprising: The last data fragment processing unit is configured to, if the tail piece identifier is 1, the tail piece is the last data fragment; Delete the content of the first key and on-site protection buffer; return the calculation result and the task number to the service processing CPU; The first key and on-site protection buffer statistical value judgment processing unit is configured to, if the tail piece identifier is 0, the tail piece is not the last data fragment; judge the statistical value of the first key and on-site protection buffer, if the statistical value reaches the set value, judge the first key and on-site buffer timestamp; if the statistical value does not reach the set value, write the intermediate chain variable after operation into the first key and on-site protection buffer and stamp the timestamp; return the calculation result to the service processing CPU, and perform the next round of packet operation.

Images