Data query method, system and device, medium and program product

Abstract

The invention relates to the technical field of data processing, and discloses a data query method, system and device, a medium and a program product.The method comprises the steps that in response to a data query request initiated by a user, to-be-queried target data is determined; the target data is data obtained after encryption processing; obtaining target data from the data storage device, sending the target data to the programmable logic device, and instructing the programmable logic device to perform decryption processing and query processing on the target data in sequence to obtain a corresponding query result; the programmable logic device comprises a data encryption and decryption core for decryption processing and a data query core for query processing; and obtaining a query result from the programmable logic device, and returning the query result to the user side. The hardware encryption and decryption task and the hardware query task are completed by the programmable logic device, and the host only needs to perform scheduling, so that the resource consumption of a host processor is greatly reduced, and safe and efficient data query can be realized.

Description

Technical Field

[0001] The present invention relates to the field of data processing technology, and in particular to a data query method, system, device, medium and program product. Background Art

[0002] In order to ensure the security of data in databases such as data centers, data can generally be encrypted and stored; when users query data, the data is decrypted and queried to complete the user's query task. Traditional data encryption and decryption technology and accelerated query technology are generally implemented based on software. Since software encryption and decryption and software accelerated query need to be executed by the CPU (Central Processing Unit), this will occupy a large amount of CPU resources, especially when processing large-scale data. Excessive consumption of CPU resources will affect the performance of other applications, resulting in a decrease in the overall efficiency of the system. The efficiency of software encryption and decryption and accelerated query is usually low, affecting query efficiency. Summary of the invention

[0003] In view of this, the present invention provides a data query method, system, device, medium and program product to solve the problem of low database query efficiency.

[0004] In a first aspect, the present invention provides a data query method, applied to a host, comprising: In response to a data query request initiated by a user, determining target data to be queried; the target data is data obtained after encryption processing; Acquire the target data from the data storage device, send the target data to the programmable logic device, and instruct the programmable logic device to perform decryption processing and query processing on the target data in sequence to obtain corresponding query results; the programmable logic device includes a data encryption and decryption core for decryption processing and a data query core for query processing; The query result is obtained from the programmable logic device, and the query result is returned to the user side.

[0005] In a second aspect, the present invention provides a data query system, comprising: a host, a data storage device and a programmable logic device; the programmable logic device comprises a data encryption and decryption core and a data query core; The host is connected to the data storage device and the programmable logic device, and the host is used to execute the data query method of the first aspect or any corresponding implementation method thereof.

[0006] In a third aspect, the present invention provides a computer device, comprising: a memory and a processor, the memory and the processor being communicatively connected to each other, the memory storing computer instructions, and the processor executing the data query method of the first aspect or any corresponding embodiment thereof by executing the computer instructions.

[0007] In a fourth aspect, the present invention provides a computer-readable storage medium having computer instructions stored thereon, the computer instructions being used to enable a computer to execute the data query method of the first aspect or any corresponding embodiment thereof.

[0008] In a fifth aspect, the present invention provides a computer program product, comprising computer instructions for causing a computer to execute the data query method of the first aspect or any corresponding embodiment thereof.

[0009] The host in the present invention is configured with a programmable logic device that can realize hardware encryption and decryption and hardware query, forming a heterogeneous accelerated computing system; the host sends the corresponding target data to the programmable logic device in response to the data query request initiated by the user, and then the data encryption and decryption core and data query core of the programmable logic device can be used to decrypt and query the target data in turn, thereby realizing the query of the encrypted target data. The programmable logic device is scheduled by using the host's software stack, and data writing, decryption, query and other operations are completed successively, and the data query task is quickly completed by combining software and hardware; and the programmable logic device completes the hardware encryption and decryption tasks and the hardware query tasks, and the host only needs to perform scheduling, which greatly reduces the resource consumption of the host processor and can realize safe and efficient data query. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] In order to more clearly illustrate the specific embodiments of the present invention or the technical solutions in the related technologies, the drawings required for use in the specific embodiments or the related technical descriptions will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0011] Figure 1 is a structural schematic diagram of a data query system according to an embodiment of the present invention; Figure 2 is a schematic diagram of a data transport process according to an embodiment of the present invention; Figure 3 is a flow chart of a data query method according to an embodiment of the present invention; Figure 4 is a flow chart of another data query method according to an embodiment of the present invention; Figure 5 is a schematic diagram of a process of encrypting data according to an embodiment of the present invention; Figure 6 is a schematic diagram of realizing software and hardware integration of a host and a programmable logic device according to an embodiment of the present invention; Figure 7 is a schematic diagram of performing data query based on a five-level processing flow according to an embodiment of the present invention; Figure 8 is a schematic diagram of serial scheduling according to an embodiment of the present invention; Fig. 9 is a schematic diagram of parallel scheduling based on five-level processing flows according to an embodiment of the present invention; Fig.10 is a schematic diagram of an overall flow chart of a data query method according to an embodiment of the present invention; Fig.11 is another structural schematic diagram of a data query system according to an embodiment of the present invention; Fig.12 is a structural block diagram of a data query device according to an embodiment of the present invention; Fig.13 It is a schematic diagram of the hardware structure of a computer device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0012] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0013] For ease of understanding, some parts involved in the embodiments of the present invention are first explained.

[0014] Heterogeneous computing: Heterogeneous computing refers to the use of computing resources of multiple different architectures, processors or accelerators, combined together to achieve higher performance and more efficient computing. This approach can improve the overall performance of the system by assigning tasks to the devices that are best suited to execute them. Heterogeneous computing usually involves integrating different types of processors such as CPU, GPU (Graphics Processing Unit), FPGA (Field Programmable Gate Array) to achieve acceleration and optimization of various applications.

[0015] Database: A database is a warehouse that organizes, stores, and manages data in a certain structure. It is not just a simple collection of files, but also a complex system that allows users to efficiently insert, query, update, and delete data. The database is designed to ensure the security, integrity, and consistency of data.

[0016] Encryption and decryption: Encryption and decryption refer to the process of protecting or hiding data by using cryptographic techniques. Encryption is the process of converting raw data into data processed by a specific algorithm, making it difficult to understand or interpret when unauthorized access occurs. Decryption is the process of restoring the encrypted data to its original form. Encryption and decryption are usually used to ensure the confidentiality, integrity and authentication of data to prevent unauthorized access and modification. This technology is widely used in the field of information security, such as data transmission, storage and communication.

[0017] With the advent of the big data era, the demand for data security is increasing, and the amount of data is also growing rapidly. In order to protect data security, data encryption technology has become indispensable. In order to improve the efficiency and speed of querying massive data, database heterogeneous accelerated query technology located in data centers has also received more and more attention in the industry.

[0018] As for data security and data acceleration query technology, traditional technology can use software methods to encrypt and decrypt data and perform software acceleration query. However, this traditional software encryption and decryption and software acceleration database query method has many disadvantages in the computer system of the data center. Whether it is software encryption and decryption or software acceleration database query, it belongs to the category of software acceleration technology and ultimately requires the CPU to execute, which will consume a large amount of CPU computing resources in the server and will affect other software programs in the system. In addition, the efficiency of software acceleration technology is generally low and the acceleration effect is poor.

[0019] Traditional database accelerated query and encryption and decryption are usually implemented at the software level. This method has the following main problems: 1) Slow processing speed: Software-implemented database accelerated query and encryption rely on the processing power of the CPU. For large-scale data processing, the CPU performance bottleneck will lead to slow processing speed. 2) High CPU computing resource consumption: Software implementation requires a large amount of CPU computing resources and memory resources. Especially in a multi-tasking environment, resource competition can easily lead to performance degradation and affect query efficiency.

[0020] In order to solve the above problems, hardware acceleration technology can be introduced into the database system to implement data encryption and decryption or accelerated query at the hardware level. Existing hardware solutions mainly include the following: 1. Hardware encryption and decryption, the advantages are fast processing speed and high security, the disadvantage is that it only focuses on encryption and decryption, and does not solve the problem of data query for the database. 2. Hardware-implemented database accelerated query technology, the advantage is fast query processing speed, the disadvantage is that it only focuses on accelerated database query and does not solve the problem of data security.

[0021] These hardware technologies have solved some of the problems of querying data to a certain extent, but they cannot meet the requirements of high security and high query efficiency at the same time. Realizing query acceleration and encryption and decryption calculations at the hardware level has become an urgent problem to be solved.

[0022] The data query method provided by the embodiment of the present invention configures a programmable logic device that can realize hardware encryption and decryption and hardware query for the host of the server to build a heterogeneous accelerated computing system; and the host's software stack realizes query scheduling for the programmable logic device, and quickly completes the data query task in a combination of software and hardware. The encryption and decryption tasks and query tasks are completed by the programmable logic device, which greatly reduces the resource consumption of the host processor and can realize safe and efficient data query.

[0023] Figure 1 FIG. 1 shows a schematic diagram of a data query system structure, which can realize heterogeneous accelerated computing. Figure 1 As shown, the data query system includes: a host, a data storage device and a programmable logic device. The host is connected to the data storage device and the programmable logic device. Moreover, the host can execute the data query method provided in this embodiment to realize software and hardware collaborative query.

[0024] In this embodiment, Figure 1 As shown, the host is a host of a server, which may be, for example, a system of an x86 architecture. The host may be connected to a data storage device via a PCIe (Peripheral Component Interconnect express, a high-speed serial computer expansion bus standard) bus, so that data can be stored between the host and the data storage device. The data storage device may be a device with a storage function such as a disk, which specifically stores data in a database.

[0025] Furthermore, the host is connected to the programmable logic device via a PCIe bus to achieve data transmission between the two. The programmable logic device may be, for example, an FPGA, a CPLD (Complex Programmable Logic Device), or the like.

[0026] In this embodiment, the programmable logic device includes a data encryption and decryption core and a data query core. Among them, the data encryption and decryption core is an IP (Intellectual Property) core that can realize data encryption and data decryption; the data query core is an IP core that can realize data query function. It can be understood that the IP cores in programmable logic devices such as FPGA are essentially a kind of logic circuit, that is, the data encryption and decryption core and the data query core are both a kind of hardware logic circuit that realizes the corresponding functions, so that tasks such as data encryption and decryption, data query, etc. can be completed based on hardware acceleration technology.

[0027] Optionally, to improve data reading and writing efficiency, data reading and writing can be realized between the host and the data storage device and the programmable logic device through DMA (Direct Memory Access). Figure 1 As shown, the data storage device and the programmable logic device are provided with corresponding direct memory access engines, namely, DMA engines. For the convenience of description, the two are respectively referred to as the first direct memory access engine and the second direct memory access engine, namely, the first DMA engine and the second DMA engine.

[0028] The first DMA engine is used to implement DMA reading and writing of data storage devices, and the second DMA engine is used to implement DMA reading and writing of device memory in programmable logic devices.

[0029] In this embodiment, the data of the database is stored in the data storage device, and the data in the data storage device is read by the first DMA engine to send the corresponding data to the host memory ( Figure 1 In the example, the blocks in the host memory represent the data blocks to be transferred), and then the host transfers the data to the device memory of the programmable logic device through the write mode of the second DMA engine. Similarly, the programmable logic device can also transfer the calculated data to the host memory on the host side through the read mode of the second DMA engine, and transfer the data to the data storage device through the write mode of the second DMA engine. The data transfer process can be seen in Figure 2 shown.

[0030] In this embodiment, a data query method is provided, which can be applied to the above-mentioned host, for example, can be applied to a processor (CPU) of the host. Figure 3 is a flow chart of a data query method according to an embodiment of the present invention. Figure 3 As shown, the process includes the following steps.

[0031] Step S301, in response to a data query request initiated by a user, determining target data to be queried; the target data is data obtained after encryption processing.

[0032] In this embodiment, in order to ensure the security of data, the data stored in the database are all encrypted data, that is, the data in the data storage device (such as a disk) are encrypted data.

[0033] When a user needs to query certain information in a database, he can initiate a request to query the database, i.e., a data query request. The data query request may include a query object, query conditions, etc. The query object is used to represent the data involved in the query operation, i.e., the data to be queried. For ease of description, the data to be queried is called target data, i.e., the data required by the user needs to be queried from the target data.

[0034] For example, the data query request may include a table ID for the specified query, and then the data table corresponding to the table ID may be used as the target data. Since the target data itself is stored in a data storage device, the target data is also encrypted data, that is, the target data needs to be decrypted before the data query operation can be performed.

[0035] Step S302, obtain the target data from the data storage device, send the target data to the programmable logic device, and instruct the programmable logic device to perform decryption processing and query processing on the target data in sequence to obtain corresponding query results; the programmable logic device includes a data encryption and decryption core for decryption processing and a data query core for query processing.

[0036] In this embodiment, for the target data that the user needs to query, the host can obtain the target data from the data storage device, and then send the target data to the programmable logic device. As mentioned above, since the target data is encrypted data, the programmable logic device needs to decrypt it first and then query it.

[0037] As described above, the programmable logic device includes a data encryption and decryption core and a data query core. In order to achieve efficient collaboration between the two IP cores (i.e., the data encryption and decryption core and the data query core), the host controls the workflow of the programmable logic device. After sending the target data to the programmable logic device, the host instructs the programmable logic device to perform decryption processing and query processing on the target data in sequence.

[0038] Specifically, the host can initiate a request to the programmable logic device to decrypt the target data, so that the programmable logic device decrypts the target data based on the data encryption and decryption core to obtain the decrypted data corresponding to the target data, and the decrypted data is the plaintext corresponding to the target data. Afterwards, the host initiates a request to query the target data to the programmable logic device, so that the programmable logic device queries the decrypted data corresponding to the target data based on the data query core, and finally obtains the query result corresponding to the target data.

[0039] Step S303, obtaining the query result from the programmable logic device, and returning the query result to the user side.

[0040] In this embodiment, after the hardware decryption and hardware query are completed by the programmable logic device, the query result of the target data can be obtained, and the query result is located on the programmable logic device side, so the host can obtain the query result from the programmable logic device. For example, the host can actively obtain the query result, or the programmable logic device can actively send the query result to the host after obtaining the query result, which is not limited in this embodiment.

[0041] After the host obtains the query result of the target data, it can return the query result to the user side for the user to view. For example, the user can initiate a data query request based on the client, and the host can return the corresponding query result to the client, so that the client interface can display the query result to the user.

[0042] In the data query method provided in this embodiment, the host is configured with a programmable logic device that can realize hardware encryption and decryption and hardware query, forming a heterogeneous accelerated computing system; the host sends the corresponding target data to the programmable logic device in response to the data query request initiated by the user, and then the data encryption and decryption core and data query core of the programmable logic device can be used to decrypt and query the target data in turn, thereby realizing the query of the encrypted target data. The programmable logic device is scheduled by using the host's software stack to complete data writing, decryption, query and other operations in succession, and the data query task is quickly completed by combining software and hardware; and the programmable logic device completes the hardware encryption and decryption tasks and the hardware query tasks, and the host only needs to perform scheduling, which greatly reduces the resource consumption of the host processor and can realize safe and efficient data query.

[0043] In this embodiment, a data query method is provided, which can be applied to the above-mentioned host, for example, can be applied to a processor of the host. Figure 4 is a flow chart of a data query method according to an embodiment of the present invention. Figure 4 As shown, the process includes the following steps.

[0044] Step S401, in response to a data query request initiated by a user, determining target data to be queried; the target data is data obtained after encryption processing.

[0045] For details, please see Figure 3 Step S301 of the illustrated embodiment will not be described in detail here.

[0046] In some optional implementations, before the above step S401, it is also necessary to add corresponding data to the database, and the data is encrypted. Specifically, the method further includes the following steps A1 to A3.

[0047] Step A1, obtaining original data to be stored.

[0048] Step A2, encrypting the original data to generate corresponding encrypted data.

[0049] Specifically, the above step A2 may include the following steps A21 to A22.

[0050] Step A21, sending the original data to the programmable logic device.

[0051] Step A22, initiating an encryption request to the programmable logic device to instruct the programmable logic device to encrypt the original data based on the data encryption and decryption check, obtain corresponding encrypted data, and return the encrypted data to the host.

[0052] Step A3: storing the encrypted data in a data storage device.

[0053] In this embodiment, in the early stage of creating a database, or when new data needs to be added to the database later, the original data needs to be encrypted and then written into a data storage device such as a disk.

[0054] Specifically, for the original data that needs to be stored in the data storage device, the host sends the original data to the programmable logic device, and then initiates an encryption request to the programmable logic device, so that the programmable logic device can encrypt the original data based on the data encryption and decryption core to obtain the ciphertext corresponding to the original data, that is, the encrypted data. In addition, the host obtains the encrypted data from the programmable logic device and finally stores the encrypted data in the data storage device.

[0055] Among them, data transmission between the host and the programmable logic device can be achieved based on DMA. Figure 5 A schematic diagram of the process of encrypting data is shown, such as Figure 5 As shown, the process includes steps S501 to S504.

[0056] Step S501: the host writes original data into the device memory of the programmable logic device through the write mode of the second DMA engine.

[0057] In step S502, the programmable logic device uses the data encryption and decryption core to perform an encryption operation on the original data to obtain encrypted data, and stores the encrypted data in the local device memory.

[0058] Step S503: write the encrypted data into the host memory through the second DMA engine read mode.

[0059] Step S504: the host transfers the encrypted data from the host memory to the data storage device through the first DMA engine write mode.

[0060] It can be understood that when storing data, the data (the above-mentioned original data) needs to be encrypted to ensure the security of the data; in the subsequent query process, the data does not need to be encrypted.

[0061] In this embodiment, hardware encryption of data can be implemented by using the data encryption and decryption core of the programmable logic device. The host only needs to schedule the work of the programmable logic device, and does not need to run the encryption algorithm at the software level to avoid occupying the host processing resources.

[0062] Step S402, dividing the target data into multiple data blocks.

[0063] Since the target data targeted by the data query request generally has a large amount of data, and the device memory of the programmable logic device is relatively small and its memory space is limited; in order to improve the query efficiency and reduce the requirements for the device memory of the programmable logic device, in this embodiment, the target data to be queried is divided into multiple data blocks, so that the query operation can be performed on each data block separately, and finally the query result of the entire target data is obtained.

[0064] The target data may be divided into N data blocks, where N≥2. The number of data blocks N may be determined based on actual conditions. For example, the size of the data block may be determined based on the processing capability of the programmable logic device, the size of the device memory space, etc., and then the specific value of N may be determined based on the amount of target data.

[0065] Step S403, obtain the target data from the data storage device, send the target data to the programmable logic device, and instruct the programmable logic device to perform decryption processing and query processing on the target data in sequence to obtain corresponding query results; the programmable logic device includes a data encryption and decryption core for decryption processing and a data query core for query processing.

[0066] Specifically, Figure 4 As shown, the above step S403 "obtains target data from the data storage device, sends the target data to the programmable logic device, and instructs the programmable logic device to perform decryption processing and query processing on the target data in sequence" includes steps S4031 to S4032.

[0067] Step S4031, obtaining data blocks from the data storage device in units of data blocks, and sending the data blocks to the programmable logic device.

[0068] In this embodiment, when the host obtains the target data, it obtains it in units of data blocks, that is, the host obtains the data block from the data storage device; after obtaining the data block, the data block is sent to the programmable logic device. Other data blocks are also processed in the same way until all data blocks (that is, the entire target data) are sent to the programmable logic device.

[0069] In some optional implementations, the above step S4031 "obtaining a data block from a data storage device and sending the data block to a programmable logic device" includes steps B1 and B2.

[0070] Step B1, for a target data block among multiple data blocks, after a previous data block is obtained from a data storage device, obtain the target data block from the data storage device.

[0071] Step B2: after acquiring the target data block, sending the target data block to the programmable logic device until all the data blocks are sent to the programmable logic device.

[0072] In this embodiment, when the host reads and writes target data in the data storage device to the programmable logic device, since the target data is divided into multiple data blocks, and the read and write operations of each data block include at least two steps, namely, a read operation and a write operation, it is not necessary to wait until one data block is written to the programmable logic device before performing a read and write operation on the next data block.

[0073] Specifically, if the multiple data blocks are data blocks A, B, and C in sequence, after the host obtains data block A (the previous data block, that is, the previous data block of the target data block), it can immediately obtain data block B (the target data block) from the data storage device. At this time, the host simultaneously sends data block A to the programmable logic device; thereafter, the host sends the data block B to the programmable logic device, and at the same time, the host obtains the next data block C from the data storage device, and so on. This enables the read and write operations of the target data to be completed more efficiently, which is beneficial to improving query efficiency.

[0074] In this embodiment, after the host obtains the previous data block, it directly obtains the next target data block from the data storage device, so that reading data blocks and writing data blocks can be run in parallel, effectively reducing the reading and writing time of the entire target data and improving the efficiency of the query operation.

[0075] Optionally, the above step B1 “obtaining a target data block from a data storage device” may specifically include the following steps B11.

[0076] Step B11, initiating a data read request to the data storage device according to the first address information of the target data block in the data storage device; the data read request is used to instruct the first direct memory access engine of the data storage device to read the target data block according to the first address information, and write the target data block to the host memory of the host; Furthermore, the above step B2 "sending the target data block to the programmable logic device" may specifically include the following step B21.

[0077] Step B21, initiating a data write request to the programmable logic device based on the second address information of the target data block in the host memory and the third address information in the device memory of the programmable logic device specified for storing the target data block; the data write request is used to instruct the second direct memory access engine of the programmable logic device to read the target data block according to the second address information, and write the target data block to the memory space corresponding to the third address information in the device memory.

[0078] In this embodiment, the host uses DMA to realize the reading and writing of each data block. Specifically, after the host determines the target data and divides it into blocks, it can determine the relevant information of each data block, which includes the size of the data block, the location of the target data in the data storage device, the address offset of each data block, etc. Based on this information, the storage address of each data block in the data storage device can be determined.

[0079] Taking one of the target data blocks as an example, for the target data block, the relevant information of the storage address of the target data block in the data storage device, that is, the first address information (also called the source address) can be determined. The host can initiate a data read request (DMA read) to the data storage device based on the first address information. After the first DMA engine of the data storage device obtains the data read request, it can obtain the target data block based on the first address information, and then write the target data block directly to the host's memory, that is, the host memory. Among them, the data read request can also include a destination address, which indicates which memory space of the host memory the target data block needs to be written to.

[0080] After the data storage device writes the target data block to the host memory, it can initiate an interrupt to the host to indicate that the write operation is completed. After the host obtains the target data block, it can determine the second address information of the target data block in the host memory, which is the host memory address where the first DMA engine writes the target data block; and the host specifies which memory spaces in the device memory of the programmable logic device store the target data block, that is, the host specifies the address information of the target data block in the device memory, that is, the third address information, and then initiates a corresponding data write request to the programmable logic device. In the data write request, the second address information represents the source address, and the third address information represents the destination address.

[0081] After the programmable logic device receives the data write request, its second DMA engine can move the data in the source address to the destination address corresponding to its own device memory based on the source address and destination address in the data write request, so that the target data block can be written to the memory space in the device memory corresponding to the third address information, thereby completing the write operation of the target data block.

[0082] Similar to the first DMA engine, after the second DMA engine completes the write operation of the target data block, it can also initiate another interrupt to the host, so that the host can continue to perform subsequent scheduling processing, that is, the host can execute subsequent steps S4032 and so on.

[0083] In this embodiment, the host schedules the two DMA engines, which can achieve unified management of the data reading and writing process, and is conducive to seamless connection between the reading and writing operations of each data block, that is, reading the next data block immediately after reading a data block, to ensure query efficiency.

[0084] Step S4032, instructing the programmable logic device to perform decryption processing and query processing on the data blocks in sequence until all data blocks are traversed.

[0085] In this embodiment, for each data block, after writing the data block to the device memory, the host can initiate a corresponding decryption request and query request to the programmable logic device, so that the programmable logic device can use its own IP core to complete hardware decryption and hardware query tasks to obtain query results for each data block; for the convenience of distinguishing descriptions, the result obtained after query processing on the decrypted data block is called a query sub-result.

[0086] In some optional implementations, the above step S4032 "instructing the programmable logic device to perform decryption processing and query processing on the data block in sequence" may specifically include the following steps C1 to C2.

[0087] Step C1, for a target data block among multiple data blocks, after sending the target data block to the programmable logic device, a decryption request corresponding to the target data block is initiated to the programmable logic device; the decryption request is used to instruct the programmable logic device to decrypt the target data block based on data encryption and decryption verification to obtain decrypted sub-data corresponding to the target data block.

[0088] Step C2, after the programmable logic device completes the decryption processing of the target data block, a query request corresponding to the target data block is initiated to the programmable logic device; the query request is used to instruct the programmable logic device to perform query processing on the decrypted sub-data corresponding to the target data block based on the data query verification, and obtain the query sub-result of the target data block; the query result includes the query sub-result.

[0089] In this embodiment, after the host sends the target data block to the programmable logic device, it can initiate a decryption request corresponding to the target data block to the programmable logic device; based on the decryption request, the programmable logic device can use its own data encryption and decryption check to decrypt the target data block, thereby obtaining the decryption result corresponding to the target data block, that is, the decrypted sub-data.

[0090] Moreover, after the programmable logic device completes the decryption processing of the target data block, it can initiate a corresponding interrupt to the host, indicating that the decryption processing has been completed. The host can then initiate a query request corresponding to the target data block to the programmable logic device, so that the programmable logic device continues to use its own data query core to query the decrypted sub-data obtained in the previous step, and finally determine the query sub-result of the target data block.

[0091] It can be understood that the query sub-result is only a part of the query result of the entire target data, that is, the query result includes the query sub-result.

[0092] Among them, since the data required by the user may not exist in the target data block, the query sub-result is empty at this time. The programmable logic device can send the empty query sub-result to the host, or send a notification message to the host indicating that the query sub-result is empty, so that the host can determine that the query sub-result of the target data block is empty.

[0093] In this embodiment, the host can simply and conveniently implement the scheduling of the IP core in the programmable logic device by initiating corresponding decryption requests and query requests to the programmable logic device. In addition, after writing the target data block, the decryption request and query request can be initiated in sequence, so that when the programmable logic device performs hardware decryption and hardware query, it can also perform data writing and other operations synchronously, which can further improve the query efficiency.

[0094] For example, if the multiple data blocks are data blocks A, B, and C in sequence, after writing data block A to the device memory of the programmable logic device, the data encryption and decryption core can decrypt the data block A, and at the same time, can also synchronously write data block B to the device memory; after completing the decryption processing of data block A, the data query core can query the decrypted sub-data of the data block A, and at the same time, the data encryption and decryption core can decrypt the next data block B, and can also synchronously write data block C to the device memory, and so on, to achieve parallel processing of data reading, data writing, decryption, query and other operations, which can effectively ensure the overall efficiency of data query.

[0095] Optionally, in order to ensure that the data query core can perform queries according to user needs, it is necessary to provide corresponding query statements to the programmable logic device; specifically, the method also includes: converting the query statement corresponding to the data query request into a query code stream, and sending the query code stream to the programmable logic device; the query request is used to instruct the data query core of the programmable logic device to query the decrypted sub-data corresponding to the target data block according to the query code stream to obtain the query sub-result of the target data block.

[0096] In this embodiment, for a query statement corresponding to a data query request, such as an SQL query statement, the query statement is converted into a code stream recognizable by a programmable logic device, namely, a query code stream, and the query code stream is sent to the programmable logic device, so that the programmable logic device can subsequently perform a corresponding query operation based on the query code stream. Specifically, the data query core of the programmable logic device can load the query code stream, so that the decrypted sub-data can be queried and processed according to user requirements to obtain the query sub-results required by the user.

[0097] Optionally, the programmable logic device is provided with registers required for query, and the host can coordinate with the programmable logic device to complete operations such as hardware decryption and hardware query by adaptively configuring each register.

[0098] In this embodiment, the programmable logic device is provided with a data source address register, and the data source address register is used to record a data source address, and the data source address is a memory address corresponding to the data stored in the device memory that needs to be decrypted.

[0099] Among them, the data write request initiated by the host includes a first configuration instruction; the first configuration instruction is used to configure the data source address register of the programmable logic device to a first memory address; the first memory address is the memory address corresponding to the memory space in the device memory where the target data block is written.

[0100] Similarly, the programmable logic device may also be provided with a result address register, which is used to record the memory address of the query sub-result after query processing in the device memory. The query request initiated by the host includes a second configuration instruction; the second configuration instruction is used to configure the result address register of the programmable logic device to a second memory address; the second memory address is the memory address corresponding to the memory space in the device memory where the query sub-result is written.

[0101] Figure 6 A schematic diagram showing the hardware and software integration of a host and a programmable logic device is shown. Figure 6 As shown, after the target data is divided into blocks, the host initiates a data read request to the data storage device for the target data block ( Figure 6The host then initiates a data write request to the programmable logic device ( Figure 6 A write request is referred to as a write request in the text to write the target data block to a memory space in the device memory, namely, the first memory.

[0102] Among them, the host specifies the memory space in the device memory where the target data block is written, that is, the host specifies the first memory; and the first memory has a corresponding address in the device memory, that is, the first memory address. The data write request initiated by the host will also configure the data source address register of the programmable logic device, and configure the data source address register to the first memory address, that is, the information recorded by the data source address register is the first memory address. When the host subsequently initiates a decryption request to the programmable logic device, the data encryption and decryption core can determine the memory address of the target data block by reading the data source address register, that is, the first memory address, and then read the target data block from the first memory address of the device memory, and decrypt the target data block.

[0103] It can be understood that if the data write request includes the third address information mentioned above, the memory space corresponding to the third address information is the first memory of the device memory, and the memory address corresponding to the third address information is the data source address.

[0104] like Figure 6 As shown, after the data encryption and decryption core completes the decryption process, the decrypted sub-data of the target data block can be determined, and the decrypted sub-data can be temporarily stored in the intermediate memory of the device memory. The host then initiates a query request, so that the data query core obtains the decrypted sub-data from the intermediate memory, and performs query processing on the decrypted sub-data to obtain the corresponding query sub-result.

[0105] Furthermore, the host specifies the storage location of the query sub-result in the device memory, and the host specifies that the query sub-result is stored in the second memory of the device memory, then the query request initiated by the host also includes the second memory address, and the result address register of the programmable logic device is configured as the second memory address; after the data query core obtains the query sub-result, it can read the result address register to determine the second memory address, thereby storing the query sub-result in the memory space corresponding to the second memory address, that is, storing it in the second memory. When the host subsequently obtains the query sub-result, the data in the second memory can be returned to the host.

[0106] In addition, the programmable logic device may also be provided with a code stream address register, which is used to record the address of the storage query code stream, which is generally also the memory address of the device memory. When the data query core performs query processing, it first reads the code stream address register to obtain the address of the storage query code stream, and then can read the corresponding query code stream to complete the data query operation.

[0107] In this embodiment, not only data transmission is achieved between the host and the programmable logic device, but the programmable logic device is also provided with a variety of registers such as a code stream address register and a result address register. When the host initiates a request, the corresponding register is configured so that the IP core of the programmable logic device completes the corresponding data decryption and query operations by reading the corresponding register. The host and the programmable logic device work together to ensure efficient transmission of data between the host and the programmable logic device, and safely and efficiently complete the decryption, query and other operations required by the user.

[0108] Step S404, obtaining the query result from the programmable logic device, and returning the query result to the user side.

[0109] For details, please see Figure 3 Step S303 of the illustrated embodiment will not be described in detail here.

[0110] In some optional implementations, the above-mentioned step S404 "obtaining query results from the programmable logic device" may specifically include: for a target data block among multiple data blocks, after the programmable logic device obtains the query sub-result of the target data block, initiating an acquisition request for obtaining the query sub-result to the programmable logic device; the acquisition request is used to instruct the second direct memory access engine of the programmable logic device to write the query sub-result to the host memory of the host.

[0111] In this embodiment, the host actively obtains the query sub-results of each data block, which simplifies the processing function of the programmable logic device. The host schedules the programmable logic device throughout the process, which can achieve efficient collaboration between software and hardware.

[0112] Among them, the process of the second DMA engine of the programmable logic device moving the query sub-result from its own device memory (such as the second memory) to the host memory is similar to the process of the host obtaining the target data block from the data storage device, which is not repeated here.

[0113] Optionally, the kernel layer of the host is provided with: a read scheduling function, a write scheduling function, a decryption scheduling function, a query scheduling function and a result processing function.

[0114] The read scheduling function is used to initiate a data read request to a data storage device to obtain a target data block; the target data block is one of the multiple data blocks.

[0115] The write scheduling function is used to initiate a data write request to the programmable logic device to write a target data block.

[0116] The decryption scheduling function is used to initiate a decryption request to the programmable logic device to perform decryption processing on the target data block, so as to obtain the decrypted sub-data corresponding to the target data block.

[0117] The query scheduling function is used to initiate a query request to the programmable logic device for query processing of the decrypted sub-data corresponding to the target data block, so as to obtain the query sub-result of the target data block.

[0118] The result processing function is used to initiate an acquisition request for obtaining the query sub-result to the programmable logic device.

[0119] In this embodiment, the operating system (e.g., Linux operating system) running on the host is divided into a user layer and a kernel layer. In the application layer, the user can initiate query operations on data files, including data encryption, data decryption, and data query. In the kernel layer, the memory resources of the host are managed and allocated through the memory management mechanism, and then requests such as DMA data transfer are issued. Among them, the scheduling functions for implementing each request are all implemented in the kernel state, which can reduce system calls and process switching between the kernel state and the user state.

[0120] Specifically, when a user initiates a data query request to the database, the data query request enters the kernel layer through a system call; after the kernel layer receives the data query request, it can divide the target data to be queried into blocks, and then perform subsequent processing on each data block in the kernel layer (kernel state).

[0121] For the target data block, the host generates a corresponding data read request based on the read scheduling function at the kernel layer and sends it to the data storage device, thereby obtaining the target data block in the data storage device. Then, the write scheduling function is called to generate a corresponding data write request and send it to the programmable logic device, thereby writing the target data to the device memory of the programmable logic device. Then, the decryption scheduling function is called to generate a decryption request and send it to the programmable logic device, so that the data encryption and decryption core of the programmable logic device can be used to implement hardware decryption and obtain decrypted sub-data. Then, the query scheduling function is called to generate a query request and send it to the programmable logic device, so that the data query core of the programmable logic device can be used to implement hardware query and obtain the query sub-result. Finally, the result processing function is called to generate an acquisition request and obtain the query sub-result from the programmable logic device.

[0122] Optionally, the method further includes: storing the query result in a cache of the host; and obtaining and returning the query result from the cache when another data query request for querying the target data is obtained later.

[0123] In this embodiment, after the host obtains the query result, it temporarily stores the query result in the host's cache, so that when the user or other users subsequently perform the same query on the target data again, the host can directly obtain the query result from the cache without the need to use programmable logic devices for heterogeneous computing, which is convenient for the next query.

[0124] For example, the host moves each query sub-result from the device memory on the PLD side to the cache of the host operating system for caching, thereby caching the entire query result. The next time the user queries the same data, the query result can be directly obtained from the cache without the need for heterogeneous computing and other operations, thereby improving the efficiency of the next query. If the host is shut down, the cache space is insufficient, or the cache length of the query result has reached the preset length, the query result in the cache can be cleared.

[0125] In some optional implementations, in order to achieve parallel processing, the host sets multiple levels of processing flows that can run in parallel. Specifically, the process shown in the above steps S4031 to S4032, i.e., taking data blocks as units, obtaining data blocks from the data storage device, sending the data blocks to the programmable logic device, and instructing the programmable logic device to perform decryption processing and query processing on the data blocks in sequence until each data block is traversed, can specifically include the following step D1.

[0126] Step D1, processing the M data blocks respectively according to the pre-configured M-level processing flow.

[0127] The k-th level processing flow is specifically used to execute the following steps D11 to D14.

[0128] Step D11, after the k-1th level processing flow obtains the M×i+k-1th data block from the data storage device, obtains the M×i+kth data block from the data storage device; k=1,2,…,M, i is the number of cycles of the processing flow. Wherein, i is an integer between 0 and (NM) / M, and N is the number of data blocks.

[0129] Step D12, sending the M×i+kth data block to the programmable logic device; wherein, when the M×i+kth data block is not the last data block, instructing the k+1th level processing flow to obtain the M×i+k+1th data block from the data storage device.

[0130] Step D13, instructing the programmable logic device to perform decryption processing on the M×i+kth data block to obtain decrypted sub-data corresponding to the M×i+kth data block.

[0131] Step D14, instructing the programmable logic device to perform query processing on the decrypted sub-data corresponding to the M×i+k-th data block to obtain the query sub-result corresponding to the M×i+k-th data block.

[0132] In this embodiment, the host pre-configures M levels of processing flows, and some tasks are interleaved between each level of processing flows to achieve parallel processing of different tasks, thereby reducing the time for data processing and improving overall query efficiency.

[0133] The M-level processing flow of this embodiment completes the processing of all data blocks by looping once or multiple times. Specifically, the 1st-level processing flow to the Mth-level processing flow first processes the 1st-level data block to the Mth-level data block in sequence; then, the 1st-level processing flow to the Mth-level processing flow processes the M+1th-level data block to the 2Mth-level data block in sequence, and so on, until the processing of all data blocks is completed.

[0134] It can be understood that, for the i-th loop number, the 1st-level processing flow to the M-th-level processing flow processes the M×i+1th data block to the M×i+Mth data block respectively; correspondingly, for the k-th-level processing flow (k is the index of the processing flow, and k=1,2,…,M), it specifically processes the M×i+kth data block.

[0135] In this embodiment, if there is a processing task in the k-1th level processing flow, then for the k-1th level processing flow, after the k-1th level processing flow obtains the corresponding data block (the M×i+k-1th data block) from the data storage device, the k-th level processing flow can initiate a data read request to obtain the M×i+kth data block from the data storage device. For the data storage device, it can continuously send each data block to the host to ensure that the host can quickly read the complete target data.

[0136] Furthermore, the k-th processing flow obtains the M×i+k-th data block, and based on the data write request, it sends the M×i+k-th data block to the programmable logic device. At the same time, if the M×i+k-th data block is not the last data block at this time, that is, there are still unread data blocks, then the k+1-th processing flow also starts to obtain the corresponding data block from the data storage device, that is, the M×i+k+1-th data block; it can be understood that if k=M, the k+1-th processing flow is the 1-th processing flow. Similarly, if k=1, the k-1-th processing flow is the M-th processing flow.

[0137] Afterwards, the k-th level processing flow is used to sequentially initiate a decryption request for decrypting the M×i+k-th data block and a query request for query processing to the programmable logic device, and finally the query sub-result corresponding to the M×i+k-th data block can be obtained.

[0138] Among them, the processing speed of the data encryption and decryption core and the data query core of the programmable logic device is relatively fast, and the data encryption and decryption core and the data query core can also realize parallel processing based on their own hardware logic circuits. For example, parallel decryption processing of a certain data block can quickly realize hardware decryption and hardware query, which generally takes less time than data reading and data writing. Therefore, for the k-th level processing flow, it can be understood that it initiates a corresponding decryption request when sending the M×i+k-th data block to the programmable logic device; or, after the k+1-th level processing flow (if it exists) obtains the M×i+k+1-th data block, the k-th level processing flow will initiate a decryption request for the M×i+k-th data block, which is not limited in this embodiment.

[0139] In this embodiment, the query process of the data block mainly includes five tasks: data reading, data writing, decryption, query, and result processing. Therefore, a five-level processing flow can be set for loop processing to achieve parallel query, that is, M=5. Currently, M can also be greater than 5, and this embodiment does not limit the specific value of M. In this embodiment, M threads can be set, each thread corresponds to a level of processing flow, and executes the above five tasks; or, 5 threads can be set, each thread executes a unique task; taking the thread that executes data reading as an example, after the thread completes the read request for a certain data block, it can continue to make a read request for the next data block, and repeat this process until all data blocks are read.

[0140] Taking M=5 as an example, the k-th processing flow is used to process the 5i+k-th data block. Figure 7 A schematic diagram of data query based on a five-level processing flow is shown.

[0141] like Figure 7 As shown in the figure, the entire data query system is divided into three layers: user layer, kernel layer, and device layer. The user layer and kernel layer are two different layers in the host-side operating system. The device layer corresponds to two devices, namely, a data storage device (such as a disk) and a programmable logic device (such as an FPGA accelerator board). Both devices are mounted on the host. The programmable logic device in the device layer contains data encryption and decryption cores, data query cores, device memory, etc. The data encryption and decryption core and the data query core are logic circuits for data acceleration calculations. Their function is to unload the encryption and decryption algorithms and data query algorithms by hardware, that is, to implement the encryption and decryption algorithms and data query algorithms by hardware.

[0142] The host software stack adopts a five-level processing flow, which can improve the parallel scheduling capability at the system software level, so as to adapt to the data processing throughput of parallel computing of programmable logic devices. For each level of processing flow, five scheduling tasks are performed, namely, data reading of data storage devices, data writing of programmable logic devices, data decryption, data query, and result processing, and each scheduling task can be implemented based on the corresponding scheduling function of the kernel layer.

[0143] Specifically, when a user initiates a data query request, the data query request enters the kernel layer through a system call. After receiving the data query request, the kernel divides the target data to be queried into task blocks and determines each data block, for example, data block 1, data block 2, ..., data block N, etc. Each data block corresponds to a corresponding task block, and the information of the task block can describe the relevant information of the data block. In general, the target data is a file in a database, and the task block information may include: the size of the data block to be processed, the file information of the database (file size, file location, file offset, etc.), the code stream of the data SQL query statement, the data block id, the task block id, and other information.

[0144] When the first level processing line of the five-level processing line receives task block 1, it can start to sequentially perform data reading, data writing, data decryption, data query, and result processing on the corresponding data block 1. In addition, according to the characteristics of the processing line, the data reading of the second level processing line and the data writing of the first level processing line can be at the same time, that is, when the first level processing line is writing data, the second level processing line starts to read data from data block 2 at the same time... and so on.

[0145] Among them, Figure 7 As shown in the figure, the data block ids corresponding to each level of the five-level processing line are 5i+1, 5i+2, 5i+3, 5i+4, and 5i+5, respectively. i represents the number of cycles of task distribution, and its value range is 0 to (n-5) / 5. Each time a task is distributed to the fifth level processing line, the value of i will increase by 1. After each level of processing line is completed, the result will be moved from the device memory of the programmable logic device to the cache of the host side operating system for caching to facilitate the next query.

[0146] If a serial system call is used, it will take a long time, which will cause a large delay and reduce the overall system performance. For example, if five data blocks (N=5) need to be processed, Figure 8 A schematic diagram showing serial scheduling is shown, Fig. 9 A schematic diagram based on parallel scheduling of five-level processing flows is shown, wherein the horizontal axis represents the time axis.

[0147] like Figure 8As shown, if a serial scheduling method is adopted, it will take 25 cycle units to complete the processing of five data blocks by cyclic scheduling for 5 times; while if the five-level processing line of this embodiment is adopted, it will only take 9 cycle units. This greatly reduces the delay and can improve the overall system performance.

[0148] Fig.10 The figure shows a flow chart of implementing data hardware decryption and query based on heterogeneous computing. Fig.10 As shown, the process includes the following steps.

[0149] Step S1001: A user initiates a data query request.

[0150] Step S1002: the operating system kernel layer receives a data query request.

[0151] Step S1003, the kernel layer block mechanism divides the database file to be queried into N task blocks of equal size. Each task block corresponds to a corresponding data block, and its related information includes the size of the data block to be processed, the file information of the database (file size, file offset, etc.), the code stream of the database query statement, the data block id, the task block id, etc.

[0152] Step S1004, allocating each task block to the five-level processing line software stack.

[0153] Among them, a for loop mechanism can be used to allocate task block information to the five-level processing line software stack. Fig.10 As shown, the processing process of each level of processing line includes: (1) Start the disk DMA and read the data to the host DDR (Double Data Rate) memory. That is, the first DMA engine reads the corresponding data block to the host memory.

[0154] (2) Start the device DMA to write data from the host DDR memory to the FPGA. The device DMA represents the second DMA engine, which writes the corresponding data block to the device memory of the FPGA.

[0155] (3) FPGA receives the data block and performs decryption operations.

[0156] (4) Send the query code stream corresponding to the data query request to the FPGA. The FPGA performs the data query operation based on the query code stream for the decrypted data block.

[0157] Among them, the FPGA can send the query code stream only once, and the FPGA can directly call it later.

[0158] (5) Process the query results and send them to the cache of the kernel layer on the host side.

[0159] The purpose of caching query results is to obtain the results directly from the cache without going through FPGA accelerated query the next time the same data is queried.

[0160] Step S1005, determining whether there are any unprocessed data blocks, if so, re-execute step S1004, otherwise, execute step S1006.

[0161] It should be noted that, whenever a first-level processing line completes a corresponding task block, step S1005 can be executed. If there is an unprocessed data block, the next data block can be scheduled. After the five-level processing line completes all scheduling, for example, when i is greater than (N-5) / 5, it can be determined that the query of all data blocks has been completed.

[0162] Step S1006: The user obtains the query result in the cache. The process ends.

[0163] The data query method provided in this embodiment schedules the hardware functions of the programmable logic device by the host, realizes hardware encryption and decryption, and hardware query simultaneously in a heterogeneous computing environment, and realizes safe and efficient query tasks without occupying the host processing resources. The task block mechanism and the five-level processing line software stack are designed at the kernel layer, and tasks such as reading data, writing data, data decryption, data query, and result processing are called successively to realize efficient collaborative parallel calls of software and hardware, greatly improving the computing throughput of the heterogeneous acceleration system. This method improves the performance and security of data processing, and is particularly suitable for those fields with extremely high requirements for data security, such as government departments, financial institutions, and other industries involving sensitive information processing, thereby helping these institutions improve the work efficiency of related businesses and ensure the security and compliance of data transmission, and has broad application prospects.

[0164] This embodiment also provides a data query system, which includes: a host, a data storage device and a programmable logic device. The host is connected to the data storage device and the programmable logic device. In addition, the host can execute the data query method provided in this embodiment to achieve software and hardware collaborative query. The structural diagram of the data query system can be found in Figure 1 shown.

[0165] Fig.11 The heterogeneous structure diagram of the data query system is shown. Among them, the data storage device (such as a disk) and the programmable logic device (such as an FPGA accelerator board) are connected to the server host through the PCIe bus. The programmable logic device contains multiple key modules, such as DMA-IP, data encryption and decryption IP, data query IP, memory controller, and device memory. Among them: DMA-IP is responsible for DMA read and write data transmission on the PCIe bus. Data encryption and decryption IP is responsible for data encryption and decryption operations. Data query IP is responsible for accelerating the query of data files. The memory controller is used to manage and control device memory, such as implementing temporary storage encryption and decryption, data query results after database filtering, etc.

[0166] The operating system running on the server host can be divided into a kernel layer and an application layer. In the application layer, users can initiate query operations on data files; in the kernel layer, memory resources are managed and allocated through the memory management mechanism, and then DMA data transfer is issued and the software stack workflow is called. In addition, the driver of the kernel layer is responsible for managing various devices, which may include a disk DMA driver for driving the first DMA engine and a device DMA driver for driving the second DMA engine.

[0167] In this embodiment, the device DMA driver not only realizes the DMA data transmission between the host side and the FPGA memory, but also realizes the database acceleration driver. The realization of the database acceleration driver is mainly based on the device DMA driver, which adds the code stream address register configuration, result address register configuration, data source address register, etc. These components work together to ensure the efficient transmission of data between the disk and the FPGA, and complete the decryption, query, result processing and other operations required by the user.

[0168] In the present embodiment, a data query device is also provided, which is used to implement the above-mentioned embodiments and preferred implementation modes, and the descriptions that have been made will not be repeated. As used below, the term "module" can be a combination of software and / or hardware that implements a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceivable.

[0169] This embodiment provides a data query device, which is applied to a host, such as Fig.12 As shown, including: The request module 1201 is used to respond to the data query request initiated by the user and determine the target data to be queried; the target data is the data obtained after encryption processing; The scheduling processing module 1202 is used to obtain the target data from the data storage device, send the target data to the programmable logic device, and instruct the programmable logic device to perform decryption processing and query processing on the target data in sequence to obtain corresponding query results; the programmable logic device includes a data encryption and decryption core for decryption processing and a data query core for query processing; The output module 1203 is used to obtain the query result from the programmable logic device and return the query result to the user side.

[0170] In some optional implementations, after determining the target data to be queried, the scheduling processing module 1202 is further used to: divide the target data into a plurality of data blocks; The scheduling processing module 1202 obtains the target data from the data storage device, sends the target data to the programmable logic device, and instructs the programmable logic device to perform decryption processing and query processing on the target data in sequence, including: taking the data block as a unit, obtaining the data block from the data storage device, sending the data block to the programmable logic device, and instructing the programmable logic device to perform decryption processing and query processing on the data block in sequence until each data block is traversed.

[0171] In some optional embodiments, the scheduling processing module 1202 obtains the data block from the data storage device and sends the data block to the programmable logic device, including: for a target data block among the multiple data blocks, after obtaining the previous data block from the data storage device, obtaining the target data block from the data storage device; after obtaining the target data block, sending the target data block to the programmable logic device, until all the multiple data blocks are sent to the programmable logic device.

[0172] In some optional implementations, the scheduling processing module 1202 obtains the data block from the data storage device in units of the data block, sends the data block to the programmable logic device, and instructs the programmable logic device to perform decryption processing and query processing on the data block in sequence until each of the data blocks is traversed, including: According to the pre-configured M-level processing flow, the M data blocks are processed respectively; Among them, the k-th level processing flow is used for: After the k-1th level processing flow obtains the M×i+k-1th data block from the data storage device, obtains the M×i+kth data block from the data storage device; k=1,2,…,M, i is the number of cycles of the processing flow; Sending the M×i+kth data block to the programmable logic device; wherein, if the M×i+kth data block is not the last data block, instructing the k+1th level processing flow to obtain the M×i+k+1th data block from the data storage device; Instructing the programmable logic device to perform decryption processing on the M×i+kth data block to obtain decrypted sub-data corresponding to the M×i+kth data block; Instruct the programmable logic device to perform query processing on the decrypted sub-data corresponding to the M×i+k-th data block to obtain a query sub-result corresponding to the M×i+k-th data block.

[0173] The further functional description of each of the above modules and units is the same as that of the above corresponding embodiments and will not be repeated here.

[0174] The embodiment of the present invention also provides a computer device. Fig.13 , Fig.13 is a schematic diagram of the structure of a computer device provided by an optional embodiment of the present invention, such as Fig.13 As shown, the computer device includes: one or more processors 10, a memory 20, and interfaces for connecting various components, including high-speed interfaces and low-speed interfaces. Various components are connected to each other using different buses for communication, and can be installed on a common mainboard or installed in other ways as needed. The processor can process instructions executed in the computer device, including instructions stored in or on the memory to display the graphical information of the GUI on an external input / output device (such as a display device coupled to the interface). In some optional embodiments, if necessary, multiple processors and / or multiple buses can be used together with multiple memories. Similarly, multiple computer devices can be connected, and each device provides some necessary operations (for example, as a server array, a group of blade servers, or a multi-processor system). Fig.13 A processor 10 is taken as an example.

[0175] The processor 10 may be a central processing unit, a network processor or a combination thereof. The processor 10 may further include a hardware chip. The hardware chip may be a dedicated integrated circuit, a programmable logic device or a combination thereof. The programmable logic device may be a complex programmable logic device, a field programmable gate array, a general purpose array logic or any combination thereof.

[0176] The memory 20 stores instructions executable by at least one processor 10, so that the at least one processor 10 executes the method shown in the above embodiment.

[0177] The memory 20 may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function; the data storage area may store data created according to the use of the computer device, etc. In addition, the memory 20 may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some optional embodiments, the memory 20 may optionally include a memory remotely arranged relative to the processor 10, and these remote memories may be connected to the computer device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0178] The memory 20 may include a volatile memory, such as a random access memory; the memory may also include a non-volatile memory, such as a flash memory, a hard disk or a solid state drive; the memory 20 may also include a combination of the above types of memory.

[0179] The computer device further comprises a communication interface 30 for the computer device to communicate with other devices or a communication network.

[0180] The embodiment of the present invention also provides a computer-readable storage medium. The method according to the embodiment of the present invention can be implemented in hardware, firmware, or can be implemented as a computer code that can be recorded in a storage medium, or can be implemented as a computer code that is originally stored in a remote storage medium or a non-temporary machine-readable storage medium and will be stored in a local storage medium through a network download, so that the method described herein can be stored in such software processing on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. Among them, the storage medium can be a magnetic disk, an optical disk, a read-only storage memory, a random access memory, a flash memory, a hard disk or a solid-state hard disk, etc.; further, the storage medium can also include a combination of the above types of memories. It can be understood that a computer, a processor, a microprocessor controller, or programmable hardware includes a storage component that can store or receive software or computer code. When the software or computer code is accessed and executed by a computer, a processor, or hardware, the method shown in the above embodiment is implemented.

[0181] A part of the present invention may be applied as a computer program product, such as a computer program instruction, which, when executed by a computer, can call or provide the method and / or technical solution according to the present invention through the operation of the computer. Those skilled in the art should understand that the existence of computer program instructions in computer-readable media includes, but is not limited to, source files, executable files, installation package files, etc., and accordingly, the way in which computer program instructions are executed by a computer includes, but is not limited to: the computer directly executes the instruction, or the computer compiles the instruction and then executes the corresponding compiled program, or the computer reads and executes the instruction, or the computer reads and installs the instruction and then executes the corresponding installed program. Here, the computer-readable medium may be any available computer-readable storage medium or communication medium accessible to the computer.

[0182] Although the embodiments of the present invention have been described in conjunction with the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present invention, and such modifications and variations should all be included in the protection scope of the present invention.

Claims

1. A data query method, characterized in that: Applied to a host, the method comprises: In response to a data query request initiated by a user, determining target data to be queried; the target data is data obtained after encryption processing; Acquire the target data from the data storage device, send the target data to the programmable logic device, and instruct the programmable logic device to perform decryption processing and query processing on the target data in sequence to obtain corresponding query results; the programmable logic device includes a data encryption and decryption core for decryption processing and a data query core for query processing; The query result is obtained from the programmable logic device, and the query result is returned to the user side.

2. The method according to claim 1, characterized in that: After determining the target data to be queried, the method further includes: Dividing the target data into a plurality of data blocks; The step of acquiring the target data from the data storage device, sending the target data to the programmable logic device, and instructing the programmable logic device to sequentially perform decryption processing and query processing on the target data includes: Taking the data block as a unit, the data block is obtained from the data storage device, the data block is sent to the programmable logic device, and the programmable logic device is instructed to perform decryption processing and query processing on the data block in sequence until each data block is traversed.

3. The method according to claim 2, characterized in that The step of acquiring the data block from the data storage device and sending the data block to the programmable logic device comprises: For a target data block among the multiple data blocks, after a previous data block is obtained from a data storage device, obtaining the target data block from the data storage device; After the target data block is acquired, the target data block is sent to the programmable logic device until all the multiple data blocks are sent to the programmable logic device.

4. The method according to claim 3, characterized in that The acquiring the target data block from the data storage device comprises: Initiate a data read request to the data storage device according to first address information of the target data block in the data storage device; the data read request is used to instruct a first direct memory access engine of the data storage device to read the target data block according to the first address information, and write the target data block to the host memory of the host; The sending the target data block to the programmable logic device comprises: A data write request is initiated to the programmable logic device based on the second address information of the target data block in the host memory and the third address information designated for storing the target data block in the device memory of the programmable logic device; the data write request is used to instruct the second direct memory access engine of the programmable logic device to read the target data block according to the second address information and write the target data block to the memory space in the device memory corresponding to the third address information.

5. The method according to claim 2, characterized in that: The instructing the programmable logic device to sequentially perform decryption processing and query processing on the data block includes: For a target data block among the multiple data blocks, after sending the target data block to the programmable logic device, a decryption request corresponding to the target data block is initiated to the programmable logic device; the decryption request is used to instruct the programmable logic device to perform decryption processing on the target data block based on the data encryption and decryption check to obtain decrypted sub-data corresponding to the target data block; After the programmable logic device completes the decryption processing of the target data block, a query request corresponding to the target data block is initiated to the programmable logic device; the query request is used to instruct the programmable logic device to perform query processing on the decrypted sub-data corresponding to the target data block based on the data query to obtain a query sub-result of the target data block; the query result includes the query sub-result.

6. The method according to claim 5, characterized in that Also includes: Converting the query statement corresponding to the data query request into a query code stream, and sending the query code stream to the programmable logic device; The query request is used to instruct the data query core of the programmable logic device to perform query processing on the decrypted sub-data corresponding to the target data block according to the query code stream to obtain the query sub-result of the target data block.

7. The method according to claim 2, characterized in that The obtaining the query result from the programmable logic device includes: For a target data block among the multiple data blocks, after the programmable logic device obtains a query sub-result of the target data block, an acquisition request for obtaining the query sub-result is initiated to the programmable logic device; the acquisition request is used to instruct the second direct memory access engine of the programmable logic device to write the query sub-result to the host memory of the host.

8. The method according to claim 2, characterized in that: The method of obtaining the data block from the data storage device in units of the data block, sending the data block to the programmable logic device, and instructing the programmable logic device to sequentially perform decryption processing and query processing on the data block until each of the data blocks is traversed includes: According to the pre-configured M-level processing flow, the M data blocks are processed respectively; Among them, the k-th level processing flow is used for: After the k-1th level processing flow obtains the M×i+k-1th data block from the data storage device, obtains the M×i+kth data block from the data storage device; k=1,2,…,M, i is the number of cycles of the processing flow; Sending the M×i+kth data block to the programmable logic device; wherein, if the M×i+kth data block is not the last data block, instructing the k+1th level processing flow to obtain the M×i+k+1th data block from the data storage device; Instructing the programmable logic device to perform decryption processing on the M×i+kth data block to obtain decrypted sub-data corresponding to the M×i+kth data block; Instruct the programmable logic device to perform query processing on the decrypted sub-data corresponding to the M×i+k-th data block to obtain a query sub-result corresponding to the M×i+k-th data block.

9. The method according to claim 2, characterized in that: The kernel layer of the host is provided with: a read scheduling function, a write scheduling function, a decryption scheduling function, a query scheduling function and a result processing function; The read scheduling function is used to initiate a data read request to the data storage device to obtain a target data block; the target data block is one of the multiple data blocks; The write scheduling function is used to initiate a data write request to the programmable logic device to write the target data block; The decryption scheduling function is used to initiate a decryption request to the programmable logic device to perform decryption processing on the target data block, so as to obtain the decrypted sub-data corresponding to the target data block; The query scheduling function is used to initiate a query request to the programmable logic device for querying the decrypted sub-data corresponding to the target data block, so as to obtain the query sub-result of the target data block; The result processing function is used to initiate an acquisition request to the programmable logic device to obtain the query sub-result.

10. The method according to claim 1, characterized in that The method further comprises: Storing the query result in a cache of the host; When another data query request for querying the target data is obtained later, the query result is obtained from the cache and returned.

11. The method according to claim 1, characterized in that: The method further comprises: Obtaining raw data to be stored; Sending the original data to the programmable logic device; Initiating an encryption request to the programmable logic device to instruct the programmable logic device to perform encryption processing on the original data based on the data encryption and decryption core, obtain corresponding encrypted data, and return the encrypted data to the host; The encrypted data is stored in the data storage device.

12. A data query system, characterized in that: include: A host, a data storage device and a programmable logic device; the programmable logic device includes a data encryption and decryption core and a data query core; The host is connected to the data storage device and the programmable logic device, and the host is used to execute the data query method described in any one of claims 1 to 11.

13. A computer device, characterized in that: include: A memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the data query method according to any one of claims 1 to 11 by executing the computer instructions.

14. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a computer to execute the data query method according to any one of claims 1 to 11.

15. A computer program product, characterized in that The method comprises computer instructions, wherein the computer instructions are used to enable a computer to execute the data query method according to any one of claims 1 to 11.

Images