National cryptographic algorithm system architecture and national cryptographic algorithm packaging system

Abstract

The invention relates to the field of data security, and discloses a national cryptographic algorithm system architecture and a national cryptographic algorithm packaging system. The cryptographic algorithm system architecture comprises a direct memory access module, a data flow control module, a register module and an algorithm module. And the direct memory access module is used for calling memory data. And the data flow control module is in communication connection with the direct memory access module. The register module is in communication connection with the data flow control module, and the register module is used for storing secret key information and parameter information. And the algorithm module is in communication connection with the data flow control module, and the algorithm module is used for performing encryption or decryption operation on the first preset data in the data flow control module. Wherein data interaction communication is carried out between the data flow control module and the direct memory access module in a data frame mode. The cryptographic algorithm system architecture provided by the invention avoids occupying the load of a processor through data interaction hardware direct transmission so as to improve the operation efficiency.

Description

Technical Field

[0001] The present invention relates to the field of data security, and in particular to a national secret algorithm system architecture and a national secret algorithm encapsulation system. Background Art

[0002] With the rapid development of information technology, information security is becoming increasingly important in key areas such as finance, medical care, and government units. As a domestic cryptographic algorithm standard, the national cryptographic algorithm is one of the key technologies for achieving information security. However, in the process of decrypting or encrypting data in the existing architecture, context communication in the business operation process requires data transmission through the processor control software, which leads to a high processor load occupancy rate, affecting the overall efficiency of encryption or decryption operations. Summary of the invention

[0003] In view of this, the present invention provides a national secret algorithm system architecture and a national secret algorithm encapsulation system, which are used to solve the problem that the processor load occupancy rate is high due to the communication transmission of context data by the processor control software, thereby affecting the overall efficiency of encryption or decryption operations.

[0004] In the first aspect, the present invention provides a national secret algorithm system architecture, including a direct memory access module, a data flow control module, a register module and an algorithm module. The direct memory access module is used to retrieve memory data. The data flow control module is communicatively connected to the direct memory access module. The register module is communicatively connected to the data flow control module, and the register module is used to store secret key information and parameter information. The algorithm module is communicatively connected to the data flow control module, and the algorithm module is used to encrypt or decrypt the first preset data in the data flow control module. Among them, the data flow control module and the direct memory access module perform data exchange communication through the data frame mode.

[0005] Beneficial effect: In the national secret algorithm system architecture provided by the embodiment of the present invention, the direct memory access module can directly access the memory module, thereby retrieving memory data, so as to interactively communicate the retrieved memory data with the data flow control module. In the data flow control module, the data flow control module can configure the key information and parameter information through the register module, and call the corresponding algorithm through the algorithm module to perform encryption or decryption operations on the first preset data, so as to encrypt or decrypt the first preset data through the national secret algorithm to ensure information security.

[0006] On this basis, in the process of data interactive communication between the direct memory access module and the data flow control module, data is transmitted between the data flow control module and the direct memory access module through data frames. That is, during the operation of the national secret algorithm, the parameter configuration required by the algorithm and the context communication of the business operation can be interactively communicated between the direct memory access module and the data flow control module through data frames, that is, the interactive communication of a large amount of data is scheduled and transmitted through hardware without the participation of software. This method reduces the participation of the host, can relieve the pressure on processors such as the main control module, and is conducive to improving the overall efficiency of the national secret system during the operation process.

[0007] In addition, due to the hardware characteristics of the direct memory access module itself, the peripheral device does not need the intervention of the main control module and other processors when accessing the data in the memory module. This enables high-speed data transmission between the memory module and the direct memory access module, which can also further relieve the pressure of the main control module and other processors, and is conducive to improving the overall efficiency of the national secret system during the operation process.

[0008] In some embodiments, the direct memory access module includes a data input buffer, a data output buffer, a first state controller, a downlink framing unit, and an uplink deframing unit. The data input buffer is used to cache the downlink data information sent to the data flow control module. The data output buffer is used to cache the uplink data information received by the data flow control module. The first state controller is connected to the data input buffer and the data output buffer in communication to control the sending of the downlink data information and the recovery of the uplink data information. The downlink framing unit is used to reorganize the downlink data information into downlink data frames. The uplink deframing unit is used to parse the uplink data frame and cache the uplink data information obtained by the parsing into the data output buffer.

[0009] Beneficial effect: The operating state of the direct memory access module can be controlled by the first state controller, such as controlling the sending of downlink data information and the recovery of uplink data information. Exemplarily, when the first state controller detects that the data input cache is not empty, the downlink framing unit is controlled to reorganize the downlink data information in the data input cache into downlink data frames for rapid sending to the data flow control module. When the first state controller detects that the uplink transmission unit is not empty, the first state controller controls the uplink deframing unit to receive the uplink data frame and parse it, thereby parsing and obtaining the uplink data information, and caching it in the data output cache. For example, the uplink data information may be data information after an encryption operation or a decryption operation is performed on the first preset data.

[0010] In some embodiments, the data flow control module includes a downlink frame buffer, an operation data buffer, a second state controller, a frame header parsing unit, a downlink verification unit, an uplink framing unit, and an uplink transmission unit. The downlink frame buffer is used to receive and cache downlink data frames. The operation data buffer is used to receive and cache the second preset data after the algorithm module calculates. The second state controller is communicatively connected with the downlink frame buffer and the operation data buffer. The frame header parsing unit is used to parse the downlink data frame and feed back the parsing information to the second state controller. The downlink verification unit is used to verify the frame header of the downlink data frame. The uplink framing unit is used to reorganize the second preset data into an uplink data frame. The uplink transmission unit is used to transmit the uplink data frame to the uplink deframing unit.

[0011] Beneficial effect: the operation state of the data flow control module can be directly controlled by the second state controller. The frame header parsing unit parses the downlink data frame to obtain the service type, algorithm type, data length / parameter length and other information transmitted by the downlink data frame, and feeds the above information back to the second state controller. After the algorithm module encrypts or decrypts the first preset data, the second preset data after the encryption or decryption operation is cached in the operation data cache, so that the uplink framing unit reorganizes the second preset data into an uplink data frame, so that the uplink transmission unit can quickly transmit the uplink data frame to the uplink deframing unit of the direct memory access module for deframing.

[0012] Based on this, in the embodiment of the present invention, by configuring the interactive communication structure of the data frame between the direct memory access module and the data flow control module, the memory access module and the data flow control module only need to schedule and configure the hardware structure in the process of performing a large amount of data interaction through the data frame, without the need for software participation. This reduces the participation of the host, can relieve the pressure of the processor such as the main control module, and is conducive to improving the overall efficiency of the national secret system in the operation process.

[0013] In some implementations, the downlink data frame includes a management frame and a service frame. The management frame includes a management frame header and management information, and the management information is used to configure key information and parameter information. The service frame includes a service frame header and first preset data.

[0014] Beneficial effects: By setting the management frame, it is convenient to initialize or update the configuration key in the data flow control module. By setting the service frame, during the encryption or decryption operation, the service frame header can be used to indicate which service is to be executed, such as encryption / decryption, hashing, signing and signature verification, etc., which is conducive to the fast and stable transmission of the first preset data.

[0015] In some embodiments, the direct memory access module further includes a management register, a descriptor cache, and a descriptor processing unit. The management register is connected to the first state controller. The descriptor cache is connected to the first state controller, and the management register controls the reading of the descriptor linked list and caches it in the descriptor cache. The descriptor processing unit is connected to the descriptor cache and the first state controller. The first state controller is configured as follows:

[0016] When the descriptor cache is not empty, the first state controller starts the descriptor processing unit to read the descriptor linked list from the descriptor cache to obtain at least the memory first address information and the service type information.

[0017] Beneficial effect: Since the data, parameters and other information cached in the memory module are not necessarily in a continuous area at the physical level, the descriptor cache and the descriptor processing unit are set to make the direct memory access module a chain structure, so that the direct memory access module can read and transmit data in discontinuous areas in the memory module through the descriptor linked list.

[0018] That is, through the above structure, the first preset data is allowed to be dispersedly stored in the areas of multiple non-contiguous memory modules and organized through a descriptor linked list, so it can reduce the number of interruptions during data transmission, thereby improving transmission efficiency. However, ordinary DMA usually needs to initiate an interrupt after transmitting a block of physically continuous data, and then the host transmits the next block of data, which will introduce additional overhead.

[0019] Since the number of interruptions is reduced during the data transfer process from the memory module, the host (or processor) can focus more on performing other tasks without frequently intervening in the data transfer process. This helps to reduce the burden on the host (or processor) to improve the overall performance of the national secret computing packaging system.

[0020] In some embodiments, the register module includes a register interface unit, a first identifier storage unit, a key storage unit, a second identifier storage unit, and a parameter storage unit. The register module is connected to the data flow control module through the register interface unit. The first identifier storage unit is used to store a key sequence number of the key information, and a storage address of the key information corresponding to the key sequence number. The key storage unit is used to store multiple key information, and one key information is set corresponding to at least one key sequence number. The second identifier storage unit is used to store a parameter sequence number of the parameter information, and a storage address of the parameter information corresponding to the parameter sequence number. And the parameter storage unit is used to store multiple parameter information, and one parameter information is set corresponding to at least one parameter sequence number.

[0021] Beneficial effects: By configuring the first identifier storage unit and the second identifier storage unit in the register module, it is convenient to index and identify specific secret keys and parameters. While facilitating rapid access and management of secret keys and parameter information, it is possible to avoid direct leakage of information in the secret key storage unit and the parameter storage unit, so as to provide preliminary protection for the secret keys and parameters required by the algorithm. This is conducive to increasing the security, reliability and confidentiality of the cryptographic services of the entire system.

[0022] In some implementations, the register interface unit is configured to control the key storage unit and the parameter storage unit to communicate only through hardware transmission.

[0023] Beneficial effect: By configuring the register interface unit, the data such as the keys and parameters in the key storage unit and the parameter storage unit can only be read and written through hardware, and cannot be read through software mode. Combined with the above solution, it is possible to avoid the leakage of information in the key storage unit and the parameter storage unit through software channels, so as to provide secondary protection for the keys and parameters required by the algorithm. This is conducive to further increasing the security, reliability and confidentiality of the entire system cryptographic business.

[0024] In some embodiments, the algorithm module includes an algorithm interface unit and a plurality of data operation units. The algorithm interface unit is in communication with the data flow control module so that the data flow control module is used to call the data operation unit to perform encryption operation or decryption operation on the first preset data. The plurality of data operation units include at least SM2, SM3 and SM4 algorithms, and the data operation unit for executing the SM4 algorithm is configured as a multi-threaded structure.

[0025] Beneficial effect: The algorithm module, as an internal module of the present invention, mainly interacts with the data flow control module. The algorithm interface unit is used to adapt the communication handshake protocol of the data flow control module. The algorithm module integrates multiple data operation units, and the multiple data operation units include at least national secret SM2 / SM3 / SM4 and other algorithms. For example, a data operation unit is used to implement key exchange, data encryption, decryption, digital signature and signature verification functions through the SM2 algorithm (SM2 cryptograohic algorithm, i.e. SM2 public key cryptographic algorithm). A data operation unit can use the SM3 algorithm (Security Message Digest Algorithm, i.e. security message digest algorithm) to perform algorithmic operations on first preset data of any length to generate a hash value (hash value) of a fixed length, which is usually used to verify the integrity and authenticity of the data. A data operation unit implements a multi-level (e.g., 32-level) pipeline internally through the SM4 algorithm (SM4 Block Cipher Algorithm), supports ECB, CBC, CFB, OFB, and CTR algorithm modes, and realizes data encryption and decryption services in different scenarios and with different needs, with high security and efficiency.

[0026] In a second aspect, the present invention provides a national secret algorithm encapsulation system, comprising an I / O module, a main control module, a memory module, and the national secret algorithm system architecture in the first aspect. The I / O module, the main control module, the memory module, and the national secret algorithm system architecture are connected through a system bus.

[0027] Beneficial effects: Since the national secret algorithm encapsulation system includes the national secret algorithm system architecture in the first aspect, the national secret algorithm encapsulation system has all the beneficial effects of the above-mentioned national secret algorithm system architecture, which will not be repeated here.

[0028] In some embodiments, the main control module is configured to:

[0029] The preset data is cached in the memory module, and the first addresses of several areas in the memory module where the preset data is cached are recorded as several first memory first addresses. The preset data includes the first preset data, the second preset data, the key information and the parameter information.

[0030] The characteristic information of the preset data is recorded in a plurality of descriptor linked lists, the descriptor linked lists are cached in a memory module, and the first address of the area in the memory module where the descriptor linked lists are cached is recorded as the second memory first address. The characteristic information includes at least the first memory first address of the preset data, the data type, the data byte length, and the frame type.

[0031] The main control module configures the direct memory access module through the second memory first address, so that the memory access module reads and caches the descriptor linked list from the memory module, and parses and obtains the preset data in the memory module according to the descriptor linked list.

[0032] Beneficial effect: that is, when the main control module caches data in the memory module, the descriptor linked list is configured so that the direct memory access module can continuously read the discontinuous data in the memory module. Since the number of interruptions is reduced during the data transmission process, the main control module can focus more on performing other tasks without frequently intervening in the data transmission process. This helps to reduce the burden on the main control module and improve the overall performance of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] In order to more clearly illustrate the specific embodiments of the present invention or the technical solutions in the related technologies, the drawings required for use in the specific embodiments or the related technical descriptions will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0034] Figure 1 A schematic diagram of the overall structure of a national secret algorithm system architecture provided by an embodiment of the present invention;

[0035] Figure 2 for Figure 1 A structural diagram of a direct memory access module shown in;

[0036] Figure 3 for Figure 1 A structural schematic diagram of a data flow control module shown in;

[0037] Figure 4 A schematic diagram of the structure of a management frame and a service frame provided in an embodiment of the present invention;

[0038] Figure 5 for Figure 1 A structural schematic diagram of the storage module and the algorithm module described in;

[0039] Figure 6 A schematic diagram of the structure of a national secret algorithm encapsulation system provided by an embodiment of the present invention;

[0040] Figure 7 A management service flow chart provided by an embodiment of the present invention;

[0041] Figure 8 A data service flow chart provided by an embodiment of the present invention;

[0042] Fig. 9A data flow control flow chart provided for an embodiment of the present invention.

[0043] Reference numerals:

[0044] 100. National secret algorithm system architecture;

[0045] 10. Direct memory access module; 11. First state controller; 12. Data input cache; 13. Downlink framing unit; 14. Uplink deframing unit; 15. Data output cache; 16. Management register; 17. Descriptor cache; 18. Descriptor processing unit; 19. Interrupt control unit;

[0046] 20. Data flow control module; 21. Second state controller; 22. Downlink frame buffer; 23. Frame header parsing unit; 24. Downlink check unit; 25. Operation data buffer; 26. Uplink framing unit; 27. Uplink transmission unit; 281. Configuration parameter unit; 282. Algorithm scheduling unit; 283. Business operation unit;

[0047] 30. Register module; 31. Register interface unit; 32. First identifier storage unit; 33. Key storage unit; 34. Second identifier storage unit; 35. Parameter storage unit;

[0048] 40. Algorithm module; 41. Algorithm interface unit; 42. Data operation unit;

[0049] 200. I / O module;

[0050] 300, main control module;

[0051] 400. Memory module. DETAILED DESCRIPTION

[0052] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0053] Combine the following Figures 1 to 9 The present application describes the national secret algorithm system architecture and national secret algorithm packaging system provided by the present application, so as to solve the problem that the processor load occupancy rate is high due to the communication transmission of context data by the processor control software, thereby affecting the overall efficiency of encryption or decryption operations.

[0054] In the first aspect, the present invention provides a national secret algorithm system architecture, such as Figure 1 and Figure 2 As shown, the national secret algorithm system architecture 100 includes a direct memory access module 10, a data flow control module 20, a register module 30 and an algorithm module 40. The direct memory access module 10 is used to retrieve memory data. The data flow control module 20 is communicatively connected to the direct memory access module 10. The register module 30 is communicatively connected to the data flow control module 20, and the register module 30 is used to store secret key information and parameter information. The algorithm module 40 is communicatively connected to the data flow control module 20, and the algorithm module 40 is used to perform encryption or decryption operations on the first preset data in the data flow control module 20. Among them, the data flow control module 20 and the direct memory access module 10 perform data exchange communication through the data frame mode.

[0055] In the national secret algorithm system architecture 100 provided in the embodiment of the present invention, the direct memory access module 10 can directly access the memory module, thereby retrieving memory data, so as to interactively communicate the retrieved memory data with the data flow control module 20. In the data flow control module 20, the data flow control module 20 can configure the key information and parameter information through the register module 30, and retrieve the corresponding algorithm through the algorithm module 40 to perform encryption or decryption operations on the first preset data, thereby encrypting or decrypting the first preset data through the national secret algorithm to ensure information security.

[0056] On this basis, in the process of data interactive communication between the direct memory access module 10 and the data flow control module 20, data is transmitted between the data flow control module 20 and the direct memory access module 10 through data frames. That is, during the operation of the national secret algorithm, the parameter configuration required by the algorithm and the context communication of the business operation can be interactively communicated between the direct memory access module 10 and the data flow control module 20 through data frames, that is, the interactive communication of a large amount of data is scheduled and transmitted through hardware without the participation of software. This method reduces the participation of the host, can relieve the pressure of the processor such as the main control module, and is conducive to improving the overall efficiency of the national secret system during the operation process.

[0057] In addition, due to the hardware characteristics of the direct memory access module 10 itself, the peripheral device does not need the intervention of the main control module or other processors when accessing the data in the memory module. This enables high-speed data transmission between the memory module and the direct memory access module 10, which can also further relieve the pressure of the main control module and other processors, which is conducive to improving the overall efficiency of the national secret system during the operation process.

[0058] In some embodiments, Figure 2As shown, the direct memory access module 10 includes a first state controller 11, a data input buffer 12, a downlink framing unit 13, an uplink deframing unit 14, and a data output buffer 15. The data input buffer 12 is used to cache the downlink data information sent to the data flow control module 20. The data output buffer 15 is used to cache the uplink data information received by the data flow control module 20. The first state controller 11 is connected to the data input buffer 12 and the data output buffer 15 in communication to control the sending of the downlink data information and the recovery of the uplink data information. The downlink framing unit 13 is used to reorganize the downlink data information into downlink data frames. The uplink deframing unit 14 is used to parse the uplink data frame and cache the uplink data information obtained by the parsing into the data output buffer 15.

[0059] In this way, the operation state of the direct memory access module 10 can be controlled by the first state controller 11, such as controlling the sending of downlink data information and the recovery of uplink data information. Exemplarily, when the first state controller 11 detects that the data input buffer 12 is not empty, the downlink framing unit 13 is controlled to reorganize the downlink data information in the data input buffer 12 into a downlink data frame for rapid sending to the data flow control module 20. When the first state controller 11 detects that the uplink transmission unit is not empty, the first state controller 11 controls the uplink deframing unit 14 to receive the uplink data frame and parse it, thereby parsing and obtaining the uplink data information, and caching it in the data output buffer 15. For example, the uplink data information can be data information (i.e., the second preset data) after the first preset data is encrypted or decrypted.

[0060] In some embodiments, Figure 3 As shown, the data flow control module 20 includes a second state controller 21, a downlink frame buffer 22, a frame header parsing unit 23, a downlink check unit 24, a calculation data buffer 25, an uplink framing unit 26 and an uplink transmission unit 27.

[0061] Among them, the downlink frame buffer 22 is used to receive and cache downlink data frames. The calculation data buffer 25 is used to receive and cache the second preset data after the algorithm module 40 calculates. The second state controller 21 is connected to the downlink frame buffer 22 and the calculation data buffer 25. The frame header parsing unit 23 is used to parse the downlink data frame and feed back the parsing information to the second state controller 21. The downlink verification unit 24 is used to verify the frame header of the downlink data frame. The uplink framing unit 26 is used to reorganize the second preset data into an uplink data frame. The uplink transmission unit 27 is used to transmit the uplink data frame to the uplink deframing unit 14.

[0062] That is, the operation state of the data flow control module 20 can be directly controlled by the second state controller 21. The frame header parsing unit 23 parses the downlink data frame to obtain the service type, algorithm type, data length / parameter length and other information transmitted by the downlink data frame, and feeds the above information back to the second state controller 21. After the algorithm module 40 performs encryption or decryption operation on the first preset data, the second preset data after encryption or decryption operation is cached in the operation data cache 25, so that the uplink framing unit 26 reassembles the second preset data into an uplink data frame, so that the uplink transmission unit 27 can quickly transmit the uplink data frame to the uplink deframing unit 14 of the direct memory access module 10 for deframing.

[0063] Based on this, in the embodiment of the present invention, by configuring the interactive communication structure of the data frame between the direct memory access module 10 and the data flow control module 20, the process of large-scale data interaction between the direct memory access module 10 and the data flow control module 20 through the data frame only requires the hardware structure scheduling configuration, without the need for software participation. This reduces the host participation, can relieve the pressure of the main control module and other processors, and is conducive to improving the overall efficiency of the national secret system in the operation process.

[0064] It should be noted that when the first preset data is data to be encrypted, the second preset data is data after encryption operation is completed. When the first preset data is data to be decrypted, the second preset data is data after decryption operation is completed.

[0065] The uplink transmission unit 27 may be a cache structure. At this time, the uplink transmission unit 27 is used to cache uplink data frames. When the first state controller 11 detects that the uplink transmission unit 27 is not empty, the first state controller 11 controls the uplink deframing unit 14 to receive and read the uplink frame data to parse it.

[0066] At this time, the uplink transmission unit 27 can be set at one side of the data flow control module 20, or at one side of the direct memory access control module 10, which is not limited.

[0067] In some embodiments, Figure 4 As shown, the downlink data frame includes a management frame and a service frame. The management frame includes a management frame header and management information, and the management information is used to configure the secret key information and parameter information. The management frame header includes information such as the service type, parameter description, and parameter sequence number. The management information includes information such as the secret key, elliptic curve parameters a / b, and base point G coordinates (Gx, Gy). The service frame includes a service frame header and first preset data. The service frame header includes information such as the service type, algorithm type, and data length. The first pre-examination data is the data to be calculated (encrypted or decrypted) obtained from the cache.

[0068] By setting the management frame, it is convenient to initialize or update the configuration key in the data flow control module 20. By setting the service frame, during the encryption or decryption operation, the service frame header can be used to indicate which service is to be executed, such as encryption / decryption, hashing, signing and signature verification, etc., which is conducive to the fast and stable transmission of the first preset data.

[0069] In some embodiments, continue to refer to Figure 2 , the direct memory access module 10 also includes a management register 16, a descriptor cache 17 and a descriptor processing unit 18. The management register 16 is connected to the first state controller 11 in communication. The descriptor cache 17 is connected to the first state controller 11 in communication, and the management register 16 controls the reading of the descriptor linked list and caches it in the descriptor cache 17. The descriptor processing unit 18 is connected to the descriptor cache 17 and the first state controller 11 in communication. And the first state controller 11 is configured as:

[0070] When the descriptor buffer 17 is not empty, the first state controller 11 starts the descriptor processing unit 18 to read the descriptor linked list from the descriptor buffer 17 to obtain at least the memory first address information and the service type information.

[0071] Since the data, parameters and other information cached in the memory module are not necessarily in a continuous area at the physical level, the descriptor cache 17 and the descriptor processing unit 18 are set to make the direct memory access module 10 a chain structure, so that the direct memory access module 10 can read and transmit data in discontinuous areas in the memory module through the descriptor linked list.

[0072] That is, through the above structure, the first preset data is allowed to be dispersedly stored in the areas of multiple non-contiguous memory modules and organized through a descriptor linked list, so it can reduce the number of interruptions during data transmission, thereby improving transmission efficiency. However, ordinary DMA usually needs to initiate an interrupt after transmitting a block of physically continuous data, and then the host transmits the next block of data, which will introduce additional overhead.

[0073] Since the number of interruptions is reduced during the data transfer process from the memory module, the host (or processor) can focus more on performing other tasks without frequently intervening in the data transfer process. This helps to reduce the burden on the host (or processor) to improve the overall performance of the national secret computing packaging system.

[0074] In the embodiment of the present invention, multiple descriptor linked lists can also be configured to be written into the memory module. In this way, by configuring the descriptor head address and the descriptor length, a read operation of the direct memory access module 10 is initiated, and a series of data transmission tasks can be automatically completed, further improving work efficiency.

[0075] For example, Figure 2 As shown, the direct memory access module 10 may further include an interrupt control unit 19, and the first state controller 11 is communicatively connected with the interrupt control unit 19 to facilitate issuing an interrupt instruction.

[0076] If the downlink check unit 24 checks the frame header of the downlink data frame and finds that the frame header check information does not meet the requirements (i.e., the check fails), the first state controller 11 sends an instruction to interrupt the operation through the interrupt control unit 19 to notify the main control module. In addition, after the national encryption algorithm system architecture 100 completes and outputs the encryption or decryption operation of the first preset data, the interrupt control unit 19 can also send an instruction to interrupt the operation.

[0077] In some embodiments, Figure 5 As shown, the register module 30 includes a register interface unit 31, a first identifier storage unit 32, a key storage unit 33, a second identifier storage unit 34 and a parameter storage unit 35. The register module 30 is communicatively connected with the data flow control module 20 via the register interface unit 31.

[0078] The first identifier storage unit 32 is used to store the key serial number of the key information and the storage address of the key information corresponding to the key serial number. The key storage unit 33 is used to store multiple types of key information, one type of key information is set corresponding to at least one key serial number. The second identifier storage unit 34 is used to store the parameter serial number of the parameter information and the storage address of the parameter information corresponding to the parameter serial number. And the parameter storage unit 35 is used to store multiple types of parameter information, one type of parameter information is set corresponding to at least one parameter serial number.

[0079] For example, in the national encryption algorithm, the key is a secret information used in the encryption and decryption algorithm, which must be kept confidential to ensure the security of the data. In symmetric encryption algorithms (such as SM4), the same key is used for encryption and decryption. In asymmetric encryption algorithms (such as SM2), a pair of keys, namely a public key and a private key, are used, where the public key can be made public, but the private key must be kept strictly confidential.

[0080] Parameters are configuration information required when the algorithm is running and usually do not contain sensitive information. In the national secret algorithm, parameters may include the version of the algorithm, the specific mathematical curve used (for elliptic curve algorithms such as SM2), the output size of the hash algorithm (such as SM3), etc. They define how the algorithm works but are not directly used in the encryption or decryption process.

[0081] In the above scheme, the first identifier storage unit 32 and the second identifier storage unit 34 are configured in the register module 30 to facilitate indexing and identifying specific keys and parameters. While facilitating rapid access and management of key and parameter information, direct leakage of information in the key storage unit 33 and the parameter storage unit 35 can be avoided to provide preliminary protection for the keys and parameters required by the algorithm. This is beneficial to increasing the security, reliability and confidentiality of the cryptographic services of the entire system.

[0082] In some embodiments, the storage interface unit 31 is configured to control the key storage unit 33 and the parameter storage unit 35 to communicate with each other only through hardware transmission.

[0083] By configuring the register interface unit 31, the data such as the keys and parameters in the key storage unit 33 and the parameter storage unit 35 can only be read and written through hardware, and cannot be read through software mode. In combination with the above scheme, the leakage of information in the key storage unit 33 and the parameter storage unit 35 through software channels can be avoided, so as to provide secondary protection for the keys and parameters required by the algorithm. This is conducive to further increasing the security, reliability and confidentiality of the cryptographic business of the entire system.

[0084] In some embodiments, continue to refer to Figure 5 The algorithm module 40 includes an algorithm interface unit 41 and a plurality of data operation units 42. The algorithm interface unit 41 is connected to the data flow control module 20 for communication, so that the data flow control module 20 is used to call the data operation unit 42 to perform encryption or decryption operations on the first preset data. The plurality of data operation units 42 at least include SM2, SM3 and SM4 algorithms, and the data operation unit 42 for executing the SM4 algorithm is configured as a multi-threaded structure.

[0085] Exemplarily, the algorithm module 40, as an internal module of the present invention, mainly performs data interaction with the data flow control module 20. The algorithm interface unit 41 is used to adapt the communication handshake protocol of the data flow control module 20. The algorithm module 40 integrates multiple data operation units 42, and the multiple data operation units 42 include at least national secret algorithms such as SM2 / SM3 / SM4. For example, a data operation unit 42 is used to implement key exchange, data encryption, decryption, digital signature and signature verification functions through the SM2 algorithm (SM2 cryptographic algorithm, i.e., SM2 public key cryptographic algorithm). A data operation unit 42 can use the SM3 algorithm (Security Message Digest Algorithm, i.e., security message digest algorithm) to perform algorithmic operations on first preset data of any length to generate a hash value (hash value) of a fixed length, which is usually used to verify the integrity and authenticity of the data. A data operation unit 42 implements a multi-level (e.g., 32-level) pipeline internally through the SM4 algorithm (SM4 Block Cipher Algorithm), supports ECB, CBC, CFB, OFB, and CTR algorithm modes, and realizes data encryption and decryption services in different scenarios and with different needs, with high security and high efficiency.

[0086] It should be noted that the algorithm interface unit 41 and the register interface unit 31 may be static random access memories.

[0087] Based on this, Figure 3 As shown, the data flow control module 20 also includes a configuration parameter unit 281 , an algorithm scheduling unit 282 and a business operation unit 283 .

[0088] The configuration parameter unit 281 mainly writes / reads the algorithm parameters in the register module 30 through the mapping relationship through the frame header parameter sequence number. The algorithm scheduling unit 282 selects the appropriate data operation unit 42 to perform algorithm operation according to the instruction of the second state controller 21. The business operation unit 283 enables the scheduled data operation unit 42 to perform encryption or decryption operation on the first preset data.

[0089] In a second aspect, the present invention also provides a national secret algorithm packaging system, such as Figure 6 As shown, the national secret algorithm encapsulation system includes an I / O module 200, a main control module 300, a memory module 400, and a national secret algorithm system architecture 100 as described in any embodiment of the first aspect. Among them, the I / O module 200, the main control module 300, the memory module 400, and the national secret algorithm system architecture 100 are connected through a system bus communication.

[0090] Since the national secret algorithm encapsulation system includes the national secret algorithm system architecture 100 in the first aspect, the national secret algorithm encapsulation system has all the beneficial effects of the above-mentioned national secret algorithm system architecture 100, which will not be repeated here.

[0091] In some embodiments, the main control module 300 is configured as:

[0092] The preset data is cached in the memory module, and the first addresses of several areas in the memory module where the preset data is cached are recorded as several first memory first addresses. The preset data includes the first preset data, the second preset data, the key information and the parameter information.

[0093] The characteristic information of the preset data is recorded in a plurality of descriptor linked lists, the descriptor linked lists are cached in a memory module, and the first address of the area in the memory module where the descriptor linked lists are cached is recorded as the second memory first address. The characteristic information includes at least the first memory first address of the preset data, the data type, the data byte length, and the frame type.

[0094] The main control module configures the direct memory access module through the second memory first address, so that the memory access module reads and caches the descriptor linked list from the memory module, and parses and obtains the preset data in the memory module according to the descriptor linked list.

[0095] That is, when the main control module 300 caches data in the memory module 400, the descriptor linked list is configured so that the direct memory access module 10 can continuously read the discontinuous data in the memory module 400. Since the number of interruptions is reduced during the data transmission process, the main control module 300 can focus more on performing other tasks without frequently intervening in the data transmission process. This helps to reduce the burden on the main control module 300 and improve the overall performance of the system.

[0096] For example, Figure 7 As shown, the workflow of the national encryption algorithm system architecture 100 when executing management services is as follows:

[0097] 1. The software caches multiple parameters required by the algorithm into the memory module 400. For example, the memory first address is recorded as A1 (i.e., the first memory first address), and the first memory first address, parameter type, parameter byte length, and frame type (management frame) are written into one or more descriptor linked lists, and then the descriptor linked lists are written into the memory module 400, and the memory first address is recorded as B1 (i.e., the second memory first address).

[0098] 2. Software configures the direct memory access module 10 to control the management register 16, configures the second memory first address of the descriptor linked list, configures the descriptor byte length register, and configures the management register 16 to start the first state controller 11.

[0099] 3. The direct memory access module 10 reads a descriptor linked list of a specified length from the memory module 400 and caches it in the descriptor cache 17 .

[0100] 4. The first state controller 11 detects that the descriptor cache 17 is not empty, initiates a read operation of the descriptor cache 17 to read out the descriptor linked list, and parses it to obtain the first memory first address of the data to be calculated, the byte length of the data to be measured, the service type and other information.

[0101] 5. The first state controller 11 drives the direct memory access module 10 read logic to read the data to be calculated from the memory module 400 and cache it in the data input cache 12. When the first state controller 11 detects that the data input cache 12 is not empty, it reassembles the management frame header of the downlink data frame according to the previously known information.

[0102] 6. After the management frame header of the downlink data frame is assembled, the operation of reading the data input buffer 12 is initiated, and the frame header+data is transmitted to the data flow control module 20 at the same time.

[0103] 7. When the first state controller 11 detects that the uplink frame buffer is not empty, it initiates a read operation to read the frame header and parses it, and obtains that the service type is a management frame. It can be seen that the returned uplink frame does not carry any data but only the uplink frame header, so the FSM controller initiates an interrupt to inform the CPU that the service has been completed.

[0104] In some embodiments, Figure 8 As shown, the workflow of the national encryption algorithm system architecture 100 when executing data services is as follows:

[0105] 1. The software caches the data to be calculated into the memory module 400, records the first address of the memory module 400 as A (the first memory first address), and writes the first memory first address, the byte length to be measured, and the frame type (business frame) into one or more descriptor linked lists, and then writes the descriptor linked lists into the memory module, recording the first address as B (the second memory first address).

[0106] 2. The software configures the direct memory access module 10 to control the management register 16, configures the second memory first address of the descriptor linked list, the descriptor byte length register, and configures the management register 16 to start the direct memory access module 10.

[0107] 3. The direct memory access module 10 reads a descriptor linked list of a specified length from the memory module 400 and caches it in the descriptor cache 17 .

[0108] 4. The first state controller 11 detects that the descriptor cache 17 is not empty, initiates a cache read operation to read out the descriptor linked list, and parses it to obtain the first memory head address of the data to be calculated, the byte length of the data to be measured, the service type and other information.

[0109] 5. The first state controller 11 drives the read logic to read the data to be calculated from the memory module 400 and caches it in the data input cache 12. When the first state controller 11 detects that the data input cache 12 is not empty, it reassembles the service frame header of the downlink data frame according to the previously acquired information.

[0110] 6. After the service frame header of the downlink data frame is assembled, an operation of reading the data input buffer is initiated, and the service frame header+data is transmitted to the data flow control module 20 at the same time.

[0111] 7. When the first state controller 11 detects that the data output buffer 15 is not empty, it initiates a read operation to read the frame header and parse it to obtain information such as the service type, algorithm type, data length, and write-back address. If the data result needs to be written back, the first state controller 11 drives the direct memory access module 10 to write and write the calculation result data back to the specified memory module. If it does not need to be written back, an interrupt is initiated to inform the CPU that the service has been completed.

[0112] 8. After the last piece of data is written back, an interrupt is initiated to inform the CPU that the business has been completed.

[0113] Thus, the national secret algorithm system architecture 100 of the present invention has the following advantages:

[0114] Higher transmission efficiency allows the data to be operated to be stored in multiple non-continuous memory areas of the memory module 400 and organized through a linked list, so it can reduce the number of interruptions during data transmission, thereby improving transmission efficiency. Ordinary DMA usually needs to initiate an interrupt after transmitting a block of physically continuous data, and then the main control module 300 transmits the next block of data. This method will introduce additional overhead.

[0115] Simplify the processing of the main control module. Since the number of interruptions during data transmission is reduced, the main control module can focus more on performing other tasks without frequently intervening in the data transmission process. This helps to reduce the burden on the main control module and improve the overall performance of the system.

[0116] Support batch work and support the implementation of batch work. In this design, the software can write multiple descriptor linked lists into the corresponding memory, configure the descriptor head address and descriptor length, and initiate a direct memory access module 10 read operation, which can automatically complete a series of data transmission tasks and further improve work efficiency.

[0117] In addition, if Fig. 9 As shown, the control process of the data flow control module 20 includes the following steps:

[0118] 1. The second state controller 21 detects that the downlink frame buffer 22 is not empty, initiates a read operation, and reads out the frame header of the downlink data frame. The downlink data frame may be a management frame or a service frame.

[0119] 2. The frame header parsing unit 23 checks the fields of the frame header. If it does not meet the protocol requirements of the frame field, such as a descriptor other than the SM2 / SM3 / SM4 algorithm appears in the frame field, it is fed back to the first state controller 11, and the first state controller 11 issues an error interrupt to inform the main control module. If the check is correct, the following operations are performed.

[0120] 3. The frame header parsing unit 23 parses the frame header and feeds back key information to the second state controller 21 .

[0121] 4. The second state controller 21 jumps to different states for processing according to the feedback information. If it is a management frame, execute steps 5 and 6. If it is a service frame, execute steps 7-10.

[0122] 5. Read the algorithm parameter information in the cache, write it into the register module 30 according to the parameter description and parameter sequence number, and wait for the signal indicating that the register module 30 has completed writing.

[0123] 6. After receiving the write completion signal, the second state controller 21 jumps to the management frame header reorganization state, reorganizes the frame header of the uplink data frame of the management frame, and sends the frame header to the direct memory access module 10, then ends the management frame processing flow and jumps to step 1.

[0124] 7. Read the data to be calculated in the cache, and reassemble the frame information into the frame header of the uplink data frame. Unlike the management frame, the frame header of the uplink data frame is reassembled in advance mainly to improve the transmission efficiency of the uplink data frame.

[0125] 8. The configuration parameter unit 281 obtains the parameters required by the algorithm from the register module 30 according to the parameter sequence number, such as the key, elliptic curve parameters, etc. The algorithm scheduling unit 282 passes the data to the corresponding data operation unit 42 for operation.

[0126] 9. The second state controller 21 detects that the operation data cache 25 is not empty, indicating that there is an operation result output, sends the frame header of the uplink data frame and reads the result data in the operation data cache 25 and continuously sends it to the direct memory access module 10.

[0127] 10. After the last data transfer is completed, jump to step 1.

[0128] by Figure 6The national secret algorithm encapsulation system shown in the figure integrates the national secret algorithm system architecture 100 as an example. The user encrypts the sensitive information using the SM4 algorithm to obtain data A (i.e., the second preset data). Then, the data A is hashed using SM3 to obtain a hash value B. Finally, the hash value B is data signed using SM2 to obtain a signature value C. In order to obtain the user's sensitive information (i.e., the first preset data) that has not been tampered with and cannot be denied, the usage process is described as follows:

[0129] First, the user stores data A, hash value B and signature value C in an external medium such as a mobile memory according to regulations. Then, the relevant instructions are written into the ICCM (Instruction Closely Coupled Memory) instruction cache of the main control module 300, and the CPU executes the instructions.

[0130] The national secret algorithm packaging system moves the data in the mobile memory into the memory module 400 through the serial port of the I / O module 200, such as SPI (Service Provider Interface), USB (Universal Serial Bus), I2C (Inter-Integrated Circuit) or UART (Universal Asynchronous Receiver / Transmitter). That is, the data to be calculated is cached in the memory such as DDR (Double Data Rate Synchronous Dynamic Random Access Memory) or AMBA (Advanced Microcontroller Bus Architecture), which can be a continuous address cache or a discrete address cache.

[0131] The main control module 300 records the location, business type, data length, etc. of the data cached in the memory module into one or more descriptor linked lists, and caches the descriptor linked lists to a continuous address of the memory module 400. The main control module 300 configures the location and byte length of the descriptor linked list in the memory to the direct memory access module 10, and starts the direct memory access module 10 to move the data cached in the memory module 400.

[0132] The national secret algorithm system architecture 100 starts the direct memory access module 10 to carry the descriptor linked list. After the direct memory access module 10 parses the descriptor linked list, it reads the data and groups the downlink data frames to transmit to the data flow control module 20. The data flow control module 20 first performs the SM3 algorithm core hash operation on the data A through frame header analysis, frame disassembly, etc., and compares the result with the hash value B. After the comparison is passed, the SM2 algorithm core is called to perform digital signature verification of the signature value C. After the signature verification is passed, the SM4 algorithm core is called to decrypt the information A, and finally the sensitive data is obtained. The data flow control module 20 reassembles the uplink data frame and sends it to the direct memory access module 10.

[0133] After parsing the frame header and disassembling the uplink data frame, the direct memory access module 10 writes the sensitive data back to the corresponding position of the pre-defined memory module 400. After the writing is completed, an interrupt is sent to inform the main control module 300.

[0134] Finally, the main control module 300 reads the decrypted data of the corresponding address in the memory module 400, and thus obtains the user sensitive information (such as the decrypted second preset data).

[0135] Although the embodiments of the present invention have been described in conjunction with the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present invention, and such modifications and variations are all within the scope defined by the appended claims.

Claims

1. A national secret algorithm system architecture, characterized in that: include: A direct memory access module (10), the direct memory access module (10) being used to retrieve memory data; A data flow control module (20) is communicatively connected to the direct memory access module (10); A register module (30) is communicatively connected to the data flow control module (20), and the register module (30) is used to store key information and parameter information; and an algorithm module (40) which is in communication with the data flow control module (20), the algorithm module (40) being used to perform encryption or decryption operations on first preset data in the data flow control module (20); The data flow control module (20) and the direct memory access module (10) perform data interactive communication via a data frame mode.

2. According to the national secret algorithm system architecture of claim 1, it is characterized in that: The direct memory access module (10) comprises: A data input buffer (12) for buffering downlink data information sent to the data flow control module (20); A data output buffer (15) for buffering uplink data information received by the data flow control module (20); A first state controller (11) is connected in communication with the data input buffer (12) and the data output buffer (15) to control the sending of the downlink data information and the recovery of the uplink data information; A downlink framing unit (13), used for recombining the downlink data information into downlink data frames; The uplink deframing unit (14) is used to parse the uplink data frame and cache the uplink data information obtained by parsing into the data output cache (15).

3. The national secret algorithm system architecture according to claim 2 is characterized in that: The data flow control module (20) comprises: A downlink frame buffer (22), the downlink frame buffer (22) is used to receive and buffer the downlink data frame; A calculation data cache (25) is used to receive and cache the second preset data calculated by the algorithm module (40); A second state controller (21) is communicatively connected to the downlink frame buffer (22) and the operation data buffer (25); A frame header parsing unit (23), configured to parse the downlink data frame and feed back parsing information to the second state controller (21); A downlink verification unit (24), the downlink verification unit (24) being used to verify the frame header of the downlink data frame; An uplink framing unit (26), the uplink framing unit (26) being used for reassembling the second preset data into the uplink data frame; and an uplink transmission unit (27), configured to transmit the uplink data frame to the uplink deframing unit (14).

4. The national secret algorithm system architecture according to claim 2 is characterized in that: The downlink data frame includes: A management frame, the management frame comprising a management frame header and management information, the management information being used to configure the key information and the parameter information; And a service frame, wherein the service frame includes a service frame header and the first preset data.

5. The national secret algorithm system architecture according to any one of claims 2 to 4, characterized in that: The direct memory access module (10) further comprises: A management register (16), the management register (16) being communicatively connected to the first state controller (11); A descriptor cache (17) is connected to the first state controller (11) for communication, and the management register (16) controls reading of the descriptor linked list and caching it in the descriptor cache (17); and a descriptor processing unit (18), the descriptor processing unit (18) being communicatively connected with the descriptor buffer (17) and the first state controller (11); The first state controller (11) is configured as follows: When the descriptor cache (17) is not empty, the first state controller (11) starts the descriptor processing unit (18) to read the descriptor linked list from the descriptor cache (17) to obtain at least memory first address information and service type information.

6. The national secret algorithm system architecture according to any one of claims 1 to 4, characterized in that: The register module (30) comprises: A register interface unit (31), the register module (30) and the data flow control module (20) are communicatively connected via the register interface unit (31); A first identifier storage unit (32), used for storing a key serial number of the key information and a storage address of the key information corresponding to the key serial number; A key storage unit (33) is used to store a plurality of the key information, wherein one type of the key information is set corresponding to at least one of the key serial numbers; A second identifier storage unit (34) is used to store a parameter sequence number of the parameter information and a storage address of the parameter information corresponding to the parameter sequence number; And a parameter storage unit is used to store multiple types of parameter information, one type of parameter information is set corresponding to at least one parameter sequence number.

7. The national secret algorithm system architecture according to claim 6 is characterized in that: The register interface unit (31) is configured as follows: The secret key storage unit (33) and the parameter storage unit are controlled to be communicatively connected only by means of hardware transmission.

8. The national secret algorithm system architecture according to any one of claims 1 to 4, characterized in that: The algorithm module (40) comprises an algorithm interface unit (41) and a plurality of data operation units (42); The algorithm interface unit (41) is in communication connection with the data flow control module (20), so that the data flow control module (20) is used to call the data operation unit (42) to perform encryption operation or decryption operation on the first preset data; The plurality of data operation units (42) include at least SM2, SM3 and SM4 algorithms, and the data operation unit (42) for executing the SM4 algorithm is configured as a multi-threaded structure.

9. A national secret algorithm packaging system, characterized in that: It comprises an I / O module (200), a main control module (300), a memory module (400) and a national secret algorithm system architecture as claimed in any one of claims 1 to 8; The I / O module (200), the main control module (300), the memory module (400) and the national encryption algorithm system architecture are communicatively connected via a system bus.

10. The national secret algorithm packaging system according to claim 9 is characterized in that: The main control module (300) is configured as follows: caching preset data in the memory module (400), and recording the first addresses of a plurality of areas in the memory module (400) where the preset data is cached as a plurality of first memory first addresses; the preset data comprises first preset data, second preset data, key information and parameter information; Recording characteristic information of the preset data in a plurality of descriptor linked lists, caching the descriptor linked lists in the memory module (400), and recording the first address of an area in the memory module (400) where the descriptor linked lists are cached as a second memory first address; the characteristic information at least includes the first memory first address, data type, data byte length and frame type of the preset data; The main control module (300) configures the direct memory access module (10) through the second memory first address, so that the memory access module reads and caches the descriptor linked list from the memory module (400), and parses and obtains the preset data in the memory module (400) according to the descriptor linked list.

Images