A network message encryption device, network message decryption device and method

Abstract

The application provides a network message encryption device, a network message decryption device and a method. The device comprises a data frame analysis module, which is used for splitting message data obtained by analyzing a network message into multiple groups and outputting each group to a PIPELINE module. The PIPELINE module is used for performing encryption processing when the input group needs to be encrypted, and writing the message data into a data cache module. An enqueuing management module is used for scheduling and managing message related information after putting the message related information into a corresponding channel queue. An RTC module is used for reading message data from the data cache module based on the message related information and performing a hash operation. A dequeuing management module is used for putting message related information of received message data into a corresponding channel queue, scheduling message related information corresponding to message data in an activated state, and outputting corresponding message data based on the successfully scheduled message related information.

Description

Technical Field

[0001] This application belongs to the field of network message encryption and decryption technology, and specifically relates to a network message encryption device, a network message decryption device and method. Background Technology

[0002] Cybersecurity has always been a major concern. Whether it's a public network or a private corporate network, it's difficult to defend against cyberattacks and unauthorized intrusions. Password access control alone is insufficient to guarantee data security during network transmission. Therefore, protocols and services such as IPSec (Internet Protocol Security, a collection of protocols and services providing security for IP networks), MACSec (Media Access Control Security, a secure communication method on local area networks based on 802.1AE and 802.1X protocols), and others have emerged to effectively ensure the security of data transmission in insecure network environments. Summary of the Invention

[0003] The purpose of this application is to provide a network message encryption device, a network message decryption device and method, which aims to solve the problems of complex structure and low performance of network message encryption and decryption devices.

[0004] According to a first aspect of this application, a network packet encryption device is provided, comprising: a data frame parsing module, a PIPELINE module, an RTC module, an enqueue management module, a data buffer module, and a dequeue management module;

[0005] The data frame parsing module is used to split the packet data obtained by parsing network packets into multiple groups and output each group to the PIPELINE module;

[0006] The PIPELINE module is used to encrypt the input packet when encryption is required, and to concatenate the encrypted packet with the packet that does not need to be encrypted, write the concatenated message data into the data cache module, and send the message-related information of the network packet to which the written message data belongs to the enqueue management module and the dequeue management module.

[0007] The queuing management module is used to put the message-related information into the corresponding channel queue for scheduling management, wherein the message-related information of the successfully scheduled network message is sent to the RTC module;

[0008] The RTC module is used to read packet data from the data cache module based on the packet-related information, perform a hash operation, and write back the hash value of the complete network packet obtained by the hash operation to the data cache module.

[0009] The dequeue management module is used to put the message-related information of the received network packets into the corresponding channel queue, schedule the message-related information corresponding to the packet data in the activated state, and output the corresponding packet data based on the successfully scheduled message-related information; wherein, the dequeue management module marks the message-related information of the complete network packets whose hash values ​​are successfully written back to the data cache module as activated.

[0010] The network packet encryption device proposed in this application adopts a hybrid processing mode of a PIPELINE module for performing encryption operations and an RTC module for performing hash operations. This simplifies the processing structure and improves overall processing efficiency. It solves the problem that using only the PIPELINE module cannot perform hash operations with iterative requirements. Furthermore, since encryption operations are independent of network transmission performance, using only the RTC module to perform both encryption and hash operations would require increasing both hash and encryption capabilities to adapt to network transmission performance, thus increasing the hardware manufacturing area. This application solves this problem by using a hybrid approach, employing the PIPELINE and RTC modules to perform encryption and hash operations respectively. In addition, the data buffer module, PIPELINE module, and RTC module of this application's network packet encryption device can be shared by multiple network packet transmission channels, reducing complexity and improving channel scalability. Finally, this application's network packet encryption device is not limited to specific encryption algorithms and network security protocols. By replacing the encryption and hash operation hardware logic in the PIPELINE and RTC modules, it can be used in scenarios applying different encryption algorithms and network security protocols.

[0011] In an optional implementation, the PIPELINE module includes multiple encryption engine units, each of which processes one of the packets received from the data frame parsing module; the number of encryption engine units is set based on the data transmission bit width and the size of the packets.

[0012] In this approach, if the data transmission bit width increases, the number of encryption engine units can be increased adaptively, and the overall framework of the network packet encryption device does not need to be modified.

[0013] In an optional implementation, the RTC module includes multiple hash calculation engine units; the number of hash calculation engine units is set based on network transmission performance and the computing performance of a single hash calculation engine unit.

[0014] In this approach, hash calculation engine units can be adaptively added or removed as network transmission performance changes, thereby improving the performance scalability of the network packet encryption device. Furthermore, since the encryption engine units and hash calculation engine units, which perform encryption and hash calculations respectively, are separate, changes in their numbers do not affect each other. Therefore, increasing the number of encryption engine units to improve network transmission performance does not increase the hardware footprint of the RTC module.

[0015] According to a second aspect of this application, a network packet decryption device is provided, comprising: a data frame parsing module, a data buffer module, an enqueue management module, an RTC module, a dequeue management module, and a PIPELINE module;

[0016] The data frame parsing module is used to write the packet data obtained from parsing network packets into the data cache module, and to send the packet-related information of the network packet to which the written packet data belongs to the enqueue management module and the dequeue management module.

[0017] The queuing management module is used to put the message-related information into the corresponding channel queue for scheduling management, wherein the message-related information of the successfully scheduled network message is sent to the RTC module;

[0018] The RTC module is used to read packet data from the data cache module based on the packet-related information and perform hash operation, perform integrity verification based on the hash value of the complete network packet obtained by hash operation, and output the integrity verification result to the dequeue management module.

[0019] The dequeue management module is used to put the message-related information of the received network packets into the corresponding channel queue, schedule the message-related information corresponding to the packet data in the activated state, read the packet data from the data cache module based on the successfully scheduled message-related information, split the packet data into multiple groups, and output each group to the PIPELINE module; wherein, the dequeue management module marks the message-related information of the complete network packet after integrity verification as the activated state;

[0020] The PIPELINE module is used to decrypt the packet when it needs to be decrypted, and then concatenate the decrypted packet with the packet that does not need to be decrypted before outputting it.

[0021] In an optional implementation, the PIPELINE module includes multiple decryption engine units, each of which processes one of the packets received from the dequeue management module; the number of decryption engine units is determined based on the data transmission bit width and the size of the packet.

[0022] In an optional implementation, the RTC module includes multiple hash calculation engine units; the number of hash calculation engine units is set based on network transmission performance and the computing performance of a single hash calculation engine unit.

[0023] According to a third aspect of this application, a network message encryption method is provided, comprising:

[0024] The data frame parsing module splits the packet data obtained from parsing network packets into multiple packets and outputs each packet to the PIPELINE module;

[0025] The PIPELINE module encrypts the input packets when encryption is required, and concatenates the encrypted packets with packets that do not require encryption. The concatenated message data is written to the data cache module, and the message-related information of the network message to which the written message data belongs is sent to the enqueue management module and the dequeue management module.

[0026] The queuing management module places the message-related information into the corresponding channel queue and then performs scheduling management.

[0027] The outbound management module places the message-related information of the received network packets into the corresponding channel queue;

[0028] The queuing management module sends the packet-related information of the successfully scheduled network packets to the RTC module;

[0029] The RTC module reads packet data from the data cache module based on the packet-related information and performs a hash operation, and writes back the hash value of the complete network packet obtained by the hash operation to the data cache module;

[0030] The dequeue management module marks the message-related information of the complete network packet that has been successfully written back to the data cache module with the hash value as an activated state.

[0031] After the outbound management module successfully schedules the packet-related information of network packets in the activated state, it outputs the corresponding packet data based on the successfully scheduled packet-related information.

[0032] In an optional implementation, the PIPELINE module includes multiple encryption engine units, each of which processes one of the packets received from the data frame parsing module; the number of encryption engine units is set based on the data transmission bit width and the size of the packet.

[0033] The RTC module includes multiple hash calculation engine units; the number of hash calculation engine units is set based on network transmission performance and the computing performance of a single hash calculation engine unit.

[0034] According to a fourth aspect of this application, a method for decrypting network messages is provided, comprising:

[0035] The data frame parsing module writes the packet data obtained from parsing network packets into the data cache module, and sends the packet-related information of the network packets to the enqueue management module and the dequeue management module;

[0036] The queuing management module places the message-related information into the corresponding channel queue and then performs scheduling management.

[0037] The outbound management module places the message-related information of the received network packets into the corresponding channel queue;

[0038] The queuing management module sends the packet-related information of the successfully scheduled network packets to the RTC module;

[0039] The RTC module reads packet data from the data cache module based on the packet-related information and performs a hash operation. It then performs an integrity check based on the hash value of the complete network packet obtained from the hash operation and outputs the integrity check result to the dequeue management module.

[0040] The outbound management module marks the message-related information of the complete network message after integrity verification as activated.

[0041] After the outbound management module successfully schedules the message-related information corresponding to the message data in the activated state, it reads the message data corresponding to the successfully scheduled message-related information from the data cache module, splits the message data into multiple groups, and outputs each group to the PIPELINE module.

[0042] The PIPELINE module decrypts the packets when they need to be decrypted, and then concatenates the decrypted packets with the packets that do not need to be decrypted before outputting them.

[0043] In an optional implementation, the PIPELINE module includes multiple decryption engine units, each of which processes one of the packets received from the dequeue management module; the number of decryption engine units is determined based on the data transmission bit width and the size of the packet.

[0044] The RTC module includes multiple hash calculation engine units; the number of hash calculation engine units is set based on network transmission performance and the computing performance of a single hash calculation engine unit.

[0045] Other features and advantages of this application will be set forth in the description which follows, and will be apparent in part from the description, or may be learned by practicing the application. The objectives and other advantages of this application may be realized and obtained by means of the structures and processes shown in the description and the accompanying drawings. Attached Figure Description

[0046] To more clearly illustrate the technical solutions in the embodiments or related technologies of this application, the accompanying drawings used in the description of the embodiments or related technologies will be briefly introduced below. Obviously, the accompanying drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0047] Figure 1 This is a structural block diagram of a network message encryption device according to an exemplary embodiment of this application.

[0048] Figure 2 This is a structural block diagram of a network message decryption apparatus according to an exemplary embodiment of this application.

[0049] Figure 3 This is a flowchart illustrating a network message encryption method according to an exemplary embodiment of this application.

[0050] Figure 4 This is a schematic flowchart of a network message decryption apparatus according to an exemplary embodiment of this application. Detailed Implementation

[0051] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0052] Multi-channel high-performance secure network interface cards (NICs) have become the mainstream for future network applications. Achieving data transmission security on these NICs is of paramount importance for network development. While hardware-based secure packet offloading can significantly reduce CPU computational demands, current secure offloading hardware designs suffer from several problems:

[0053] 1) The encryption and decryption algorithms are complex, and a single acceleration engine cannot meet the ever-increasing network bandwidth demand. In the case of multiple channels, each channel corresponds to its own acceleration engine and cannot be shared.

[0054] 2) Using multiple boards to work together to divert incoming packets and offload security packets in parallel. This method has a complex hardware structure, is cumbersome to coordinate, and is costly.

[0055] Based on the above analysis, this application proposes a network packet encryption and decryption device. This device employs a hybrid processing mode of RTC (Run To Complete) and PIPELINE to achieve high-performance network security offloading. RTC is a single-threaded / engine processing mode that completes all business operations for a single packet, while PIPELINE is a systematic process processing mode that decomposes complex tasks into multiple stages and executes them sequentially.

[0056] See Figure 1 As shown, this application provides an exemplary network packet encryption device, including: a data frame parsing module, a PIPELINE module, an RTC module, an enqueue management module, a data cache module, and a dequeue management module.

[0057] The data frame parsing module splits the parsed network packet data into multiple packets and outputs each packet to the PIPELINE module. The PIPELINE module encrypts input packets when encryption is required, concatenates the encrypted packets with packets that do not require encryption, writes the concatenated packet data to the data buffer module, and sends the packet information of the network packet to which the written packet data belongs to the enqueue management module and the dequeue management module. The enqueue management module places packet information into the corresponding channel queue for scheduling management, and sends the packet information of successfully scheduled network packets to the RTC module. The RTC module reads packet data from the data buffer module based on the packet information, performs a hash operation, and writes back the hash value of the complete network packet obtained from the hash operation to the data buffer module. The dequeue management module is used to put the message-related information of the received network packets into the corresponding channel queue, schedule the message-related information of the packets in the activated state, and output the corresponding packet data based on the message-related information of the successfully scheduled packets. Among them, the dequeue management module marks the message-related information of the complete network packets whose hash values ​​are successfully written back to the data cache module as activated.

[0058] For example, network packets can be either packets requiring encryption or packets that do not require encryption. Network packets requiring encryption may include multiple fields, some of which require encryption and others do not. For network packets requiring encryption, the data frame parsing module parses them and splits them into multiple packets. The splitting principle is to separate the fields requiring encryption and the fields that do not require encryption into different packets, and each packet has a fixed length. If the packet length is less than the fixed length, zeros can be added to the end. Each resulting packet can carry an identifier indicating whether it requires encryption. Whether a network packet needs encryption depends on the accompanying information transmitted with it, and which fields in the network packet need encryption depends on the packet type and the security protocol applicable to the hardware. The network packet encryption device proposed in this application is applicable to network security protocols such as IPSec and MACSec.

[0059] For example, the PIPELINE module processes multiple received packets in parallel. If the identifier carried by the current packet indicates that encryption is required, the packet is encrypted; otherwise, no processing is performed. The specific encryption process of the PIPELINE module can vary depending on the encryption algorithm used. For instance, when using the Counter-mode-based symmetric encryption algorithm AES_GCM, n rounds of pipelined encryption engine units can be used to encrypt a single packet. The PIPELINE module also concatenates the parallel processing results of multiple packets—that is, the encryption results of the packets requiring encryption—with the packets that do not require encryption. After the concatenated packet data is collected to the size of one storage cell in the data buffer module, the packet data of that storage cell is written to the data buffer module. It can be understood that if a network packet does not require encryption, the data frame parsing module groups it and outputs it to the PIPELINE module, but the PIPELINE module does not encrypt it. Instead, it pipelines the output data according to the data input order and writes it to the data buffer module, sending the corresponding packet-related information to the enqueue management module and the dequeue management module.

[0060] For example, each storage unit in the data caching module uses a linked list structure for storage, and network packets belonging to the same channel are stored in the same linked list structure. Meanwhile, the packet-related information of the network packet in the data caching module is sent to the enqueue management module and the dequeue management module. This packet-related information may include the network packet's storage information and hash calculation information, such as the network packet's starting address in the data caching module, the hash start offset, and the hash calculation mode. The starting address allows the network packet to be read from the data caching module; the hash start offset is the offset of the starting position of the hash calculation from the starting address; and the hash calculation mode is the calculation mode used when performing hash calculations on the packet data. It should be noted that the packet-related information sent to the enqueue management module and the dequeue management module can be the same or different. For example, the packet-related information sent to the dequeue management module may not include information other than the network packet's storage information; that is, it may only be a part of the packet-related information sent to the enqueue management module.

[0061] For example, the queuing management module includes a multi-channel queuing management unit and a channel frame scheduling unit. The multi-channel queuing management unit can put the packet-related information into the corresponding channel queue. The queuing management module sets up a separate channel queue for each of the multiple transmission channels, and the packet-related information corresponding to the network packet belonging to that transmission channel is put into the corresponding channel queue. The channel frame scheduling unit can schedule the packet-related information in multiple channel queues on a channel-by-channel basis. For example, it can schedule each channel queue in a round-robin manner. The packet-related information of the successfully scheduled queue is transmitted to the RTC module.

[0062] For example, after receiving packet-related information, the RTC module uses the stored information to read the packet data from the storage unit corresponding to the network packet in the data cache module, and uses the hash starting offset to determine the data to start the hash operation, and then performs the hash operation according to the hash calculation mode. It should be noted that since the packet data read from a storage unit is not the complete network packet, but a part of the complete network packet, during the hash operation, the current packet data in the complete network packet can be combined with the hash result previously calculated for that packet data for hash operation, until all packet data of the complete network packet has participated in the hash operation to obtain the hash value of the complete network packet, and then the hash value is written back to the data cache module, for example, by writing the hash value to the end of the last piece of packet data of the network packet. At the same time, after the hash value of the complete network packet is calculated, the enqueue management module also sends a message to the dequeue management module to notify the dequeue management module to mark the packet data corresponding to the network packet as active.

[0063] For example, the dequeue management module may include a multi-channel dequeue management unit and a channel slice data scheduling unit. After receiving packet-related information of a network packet from the PIPELINE module, the multi-channel dequeue management unit places this information into the channel queue of that network packet. Similar to the inqueue management module, the dequeue management module sets up a corresponding channel queue for each of the multiple transmission channels. The packet-related information of the network packet is placed into the channel queue of the corresponding channel by the dequeue management module. The channel slice data scheduling unit schedules the packet-related information in these channel queues on a channel-by-channel basis, for example, by polling each channel queue, and only schedules packet-related information that is in an active state. Based on the successfully scheduled packet-related information, the channel slice data scheduling unit reads the corresponding storage unit from the data cache module to obtain the corresponding network packet slice output. It is understandable that, since the dequeue management module only needs to use message-related information to read storage units from the data cache module, the message-related information sent by the PIPELINE module to the dequeue management module may not include information other than storage information. In other words, the message-related information sent by the PIPELINE module to the dequeue management module and the message-related information sent to the enqueue management module may be different, and the message-related information sent to the dequeue management module is a part of the message-related information sent to the enqueue management module.

[0064] The network packet encryption device proposed in this application adopts a hybrid processing mode of a PIPELINE module for performing encryption operations and an RTC module for performing hash operations. This simplifies the processing structure and improves overall processing efficiency. It solves the problem that using only the PIPELINE module cannot perform hash operations with iterative requirements. Furthermore, since encryption operations are independent of network transmission performance, using only the RTC module to perform both encryption and hash operations would require increasing encryption capabilities to accommodate network transmission performance, thus increasing the hardware manufacturing area. This application solves this problem by using a hybrid approach, employing the PIPELINE and RTC modules to perform encryption and hash operations respectively. In addition, the data buffer module, PIPELINE module, and RTC module of this application's network packet encryption device can be shared by multiple network packet transmission channels, reducing complexity and improving channel scalability. Finally, this application's network packet encryption device is not limited to specific encryption algorithms and network security protocols. By replacing the encryption and hash operation hardware logic in the PIPELINE and RTC modules, it can be used in scenarios applying different encryption algorithms and network security protocols.

[0065] In some optional embodiments, the PIPELINE module includes multiple encryption engine units, each of which processes one of the packets received from the data frame parsing module; the number of encryption engine units is set based on the data transmission bit width and the packet size.

[0066] For example, the PIPELINE module can be configured with multiple encryption engine units. The number of encryption engine units can be parameterized according to actual needs, that is, the number of encryption engine units can be dynamically adjusted based on the data transmission width and packet size. The purpose of setting multiple encryption engine units is to divide the transmitted message data into multiple packets and assign one encryption engine unit to each packet for parallel processing. Therefore, the number of encryption engine units is related to the interface data size and the size of the divided packets. Taking a packet size of 128 bits as an example, the interface data size is equal to the data transmission width, and the number of encryption engine units is equal to the data transmission width divided by 128 bits and rounded up. Therefore, with a fixed packet size, the wider the current data transmission width, the more encryption engine units are required.

[0067] In this approach, if the data transmission bit width increases, the number of encryption engine units can be increased adaptively, and the overall framework of the network packet encryption device does not need to be modified.

[0068] In some optional embodiments, the RTC module includes multiple hash calculation engine units. The number of hash calculation engine units is set based on network transmission performance and the computational performance of a single hash calculation engine unit.

[0069] For example, the number of hash calculation engine units in the RTC module can also be parameterized based on actual needs. This number is related to network transmission performance; when network transmission performance needs to be improved, the number of hash calculation engine units can be adaptively increased. Therefore, the number of hash calculation engine units can be the network transmission performance divided by the processing performance of a single hash calculation engine unit. Network transmission performance depends on the transmission rate of the transmission channel.

[0070] In this approach, hash calculation engine units can be adaptively added or removed as network transmission performance changes, thereby improving the performance scalability of the network packet encryption device. Furthermore, since the encryption engine units and hash calculation engine units, which perform encryption and hash calculations respectively, are separate, changes in their numbers do not affect each other. Therefore, increasing the number of encryption engine units to improve network transmission performance does not increase the hardware footprint of the RTC module.

[0071] Accordingly, see Figure 2As shown, this application also provides an exemplary network packet decryption device, including: a data frame parsing module, a data buffer module, an enqueue management module, an RTC module, a dequeue management module, and a PIPELINE module.

[0072] The data frame parsing module writes the parsed network packet data to the data cache module and sends the packet-related information of the network packet to the enqueue management module and dequeue management module. The enqueue management module places the packet-related information into the corresponding channel queue for scheduling management, and sends the packet-related information of successfully scheduled network packets to the RTC module. The RTC module reads packet data from the data cache module based on the packet-related information, performs a hash operation, performs integrity verification based on the hash value of the complete network packet obtained from the hash operation, and outputs the integrity verification result to the enqueue management module. The dequeue management module places the packet-related information of received network packets into the corresponding channel queue, schedules the packet-related information of packets in the active state, reads packet data from the data cache module based on the successfully scheduled packet-related information, splits the packet data into multiple packets, and outputs each packet to the PIPELINE module; the dequeue management module marks the packet-related information of the complete network packet after integrity verification as active. The PIPELINE module is used to decrypt packets when they need to be decrypted, and then concatenates the decrypted packets with the packets that do not need to be decrypted before outputting them.

[0073] For example, the network packet decryption device is similar to the network packet encryption device, but its processing flow for input packets is the reverse of that of the network packet encryption device. First, after receiving the input network packet, the data frame parsing module of the network packet decryption device parses the network packet and writes the parsed packet data into the data buffer module. It should be noted that due to data transmission width limitations, the input packet data at one time is not a complete network packet, but rather a portion of a complete network packet. After the parsed packet data is collected to fill one storage unit of the data buffer module, the data frame parsing module writes this one storage unit of packet data into the data buffer module. Simultaneously, the packet-related information of the network packet to which this packet data belongs is also sent to the enqueue management module and the dequeue management module.

[0074] The queuing management module and RTC module of the network packet decryption device are basically the same as those of the queuing management module of the network packet encryption device. The specific processing flow can be found in the description of the queuing management module of the network packet encryption device above, and will not be repeated here. Furthermore, after calculating the hash value of the complete network packet, the RTC module of the network packet decryption device uses this hash value and the hash value carried at the end of the network packet to perform integrity verification of the network packet. The packet data of network packets that successfully pass verification are ultimately sent to the PIPELINE module for decryption, while the packet data of network packets that fail verification can be discarded or subjected to other error handling.

[0075] For example, the dequeue management module of the network packet decryption device, similar to that of the network packet encryption device, also places packet-related information into the corresponding channel queue, schedules the packet-related information corresponding to the network packets in the active state, and reads the packet data corresponding to the network packet from the data cache unit based on the packet-related information. The difference is that the dequeue management module of the network packet decryption device groups the read packet data according to whether it needs to be decrypted. As mentioned above, the PIPELINE module of the network packet encryption device encrypts the groups that need encryption, and the final output packet data includes both encrypted data and data that does not need encryption. Therefore, the dequeue management module of the network packet decryption device groups the encrypted data (i.e., the data that needs to be decrypted) and the data that does not need to be decrypted into groups. The grouping process is consistent with the grouping process of the data frame parsing module in the network packet encryption device, which can be found in the description of the data frame parsing module in the network packet encryption device above, and will not be repeated here. After each packet is output to the PIPELINE module, the PIPELINE module processes each packet in parallel. It performs decryption operations on packets that need to be decrypted, while doing nothing on packets that do not need to be decrypted. This is similar to the processing process of the PIPELINE module in a network packet encryption device. The difference is that the PIPELINE module in a network packet encryption device performs encryption operations on packets that need to be encrypted. For details, please refer to the description of the PIPELINE module in a network packet encryption device above, which will not be repeated here.

[0076] In some optional embodiments, the PIPELINE module includes multiple decryption engine units, each of which processes one of the packets received from the dequeue management module; the number of decryption engine units is determined based on the data transmission bit width and the packet size.

[0077] In some optional embodiments, the RTC module includes multiple hash calculation engine units; the number of hash calculation engine units is set based on network transmission performance and the computing performance of a single hash calculation engine unit.

[0078] For details regarding the above embodiments, please refer to the description of the network packet encryption device above, which will not be repeated here.

[0079] See Figure 3 As shown, this application also provides an exemplary method for encrypting network packets, comprising:

[0080] Step S301: The data frame parsing module splits the packet data obtained from parsing the network packets into multiple packets and outputs each packet to the PIPELINE module;

[0081] Step S302: When the input packet needs to be encrypted, the PIPELINE module encrypts it and concatenates the encrypted packet with the packet that does not need to be encrypted. The concatenated packet data is written to the data cache module, and the packet-related information of the network packet to which the written packet data belongs is sent to the enqueue management module and the dequeue management module.

[0082] Step S303: The queuing management module puts the message-related information into the corresponding channel queue and then performs scheduling management;

[0083] Step S304: The outbound management module puts the packet-related information of the received network packets into the corresponding channel queue;

[0084] Step S305: The queuing management module sends the packet-related information of the successfully scheduled network packets to the RTC module;

[0085] Step S306: The RTC module reads the packet data from the data cache module based on the packet-related information, performs a hash operation, and writes back the hash value of the complete network packet obtained from the hash operation to the data cache module;

[0086] Step S307: The dequeue management module successfully writes the hash value back to the data cache module and marks the packet-related information of the complete network packet as activated.

[0087] Step S308: After the outbound management module successfully schedules the packet-related information of network packets in the activated state, it outputs the corresponding packet data based on the successfully scheduled packet-related information.

[0088] In some optional embodiments, the PIPELINE module includes multiple encryption engine units, each of which processes one of the packets received from the data frame parsing module; the number of encryption engine units is set based on the data transmission bit width and the packet size.

[0089] The RTC module includes multiple hash calculation engine units; the number of hash calculation engine units is based on network transmission performance and the computing performance of a single hash calculation engine unit.

[0090] The above method can be implemented using the network packet encryption device provided in the above embodiments. For specific implementation details, please refer to the description of the network packet encryption device in the above embodiments, which will not be repeated here.

[0091] See Figure 4 As shown, this application also provides an exemplary method for network message decryption, comprising:

[0092] Step S401: The data frame parsing module writes the packet data obtained from parsing the network packet into the data cache module, and sends the packet-related information of the network packet to which the written packet data belongs to the enqueue management module and the dequeue management module.

[0093] Step S402: The queuing management module puts the message-related information into the corresponding channel queue and then performs scheduling management;

[0094] Step S403: The dequeue management module puts the packet-related information of the received network packets into the corresponding channel queue;

[0095] Step S404: The queuing management module sends the packet-related information of the successfully scheduled network packets to the RTC module;

[0096] Step S405: The RTC module reads packet data from the data cache module based on packet-related information and performs hash operation. Based on the hash value of the complete network packet obtained by hash operation, it performs integrity verification and outputs the integrity verification result to the queue management module.

[0097] Step S406: The outbound management module marks the packet-related information of the complete network packet after integrity verification as activated.

[0098] Step S407: After the outbound management module successfully schedules the message information corresponding to the message data in the activated state, it reads the message data corresponding to the successfully scheduled message information from the data cache module, splits the message data into multiple groups, and outputs each group to the PIPELINE module.

[0099] Step S408: The PIPELINE module performs decryption processing when a group needs to be decrypted, and then concatenates the decrypted group with the group that does not need to be decrypted before outputting it.

[0100] In some optional embodiments, the PIPELINE module includes multiple decryption engine units, each of which processes one of the packets received from the dequeue management module; the number of decryption engine units is determined based on the data transmission bit width and the packet size.

[0101] The RTC module includes multiple hash calculation engine units; the number of hash calculation engine units is based on network transmission performance and the computing performance of a single hash calculation engine unit.

[0102] The above method can be implemented by the network packet decryption device provided in the above embodiments. For the specific implementation method, please refer to the description of the network packet decryption device in the above embodiments, which will not be repeated here.

[0103] It is understood that the circuit structures, names, and parameters described in the above embodiments are merely examples. Those skilled in the art can also make readily conceived combinations and adjustments to the structural features of the above embodiments according to their needs, and the concept of this application should not be limited to the specific details of the above examples.

[0104] Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application.

Claims

1. A network message encryption device, characterized in that, include: Data frame parsing module, PIPELINE module, RTC module, enqueue management module, data caching module, and dequeue management module; The data frame parsing module is used to split the packet data obtained by parsing network packets into multiple groups and output each group to the PIPELINE module; The PIPELINE module is used to encrypt the input packet when encryption is required, and to concatenate the encrypted packet with the packet that does not need to be encrypted, write the concatenated message data into the data cache module, and send the message-related information of the network packet to which the written message data belongs to the enqueue management module and the dequeue management module. The queuing management module is used to put the message-related information into the corresponding channel queue for scheduling management, wherein the message-related information of the successfully scheduled network message is sent to the RTC module; The RTC module is used to read packet data from the data cache module based on the packet-related information, perform a hash operation, and write back the hash value of the complete network packet obtained by the hash operation to the data cache module. The dequeue management module is used to put the message-related information of the received network packets into the corresponding channel queue, schedule the message-related information corresponding to the packet data in the activated state, and output the corresponding packet data based on the successfully scheduled message-related information; wherein, the dequeue management module marks the message-related information of the complete network packets whose hash values ​​are successfully written back to the data cache module as activated.

2. The network message encryption device according to claim 1, characterized in that, The PIPELINE module includes multiple encryption engine units, each of which processes one of the packets received from the data frame parsing module; the number of encryption engine units is set based on the data transmission bit width and the size of the packet.

3. The network message encryption device according to claim 1 or 2, characterized in that, The RTC module includes multiple hash calculation engine units; the number of hash calculation engine units is set based on network transmission performance and the computing performance of a single hash calculation engine unit.

4. A network message decryption device, characterized in that, include: The module includes a data frame parsing module, a data caching module, an enqueue management module, an RTC module, a dequeue management module, and a PIPELINE module. The data frame parsing module is used to write the packet data obtained from parsing network packets into the data cache module, and to send the packet-related information of the network packet to which the written packet data belongs to the enqueue management module and the dequeue management module. The queuing management module is used to put the message-related information into the corresponding channel queue for scheduling management, wherein the message-related information of the successfully scheduled network message is sent to the RTC module; The RTC module is used to read packet data from the data cache module based on the packet-related information and perform hash operation, perform integrity verification based on the hash value of the complete network packet obtained by hash operation, and output the integrity verification result to the dequeue management module. The dequeue management module is used to put the message-related information of the received network packets into the corresponding channel queue, schedule the message-related information corresponding to the packet data in the activated state, read the packet data from the data cache module based on the successfully scheduled message-related information, split the packet data into multiple groups, and output each group to the PIPELINE module; wherein, the dequeue management module marks the message-related information of the complete network packet after integrity verification as the activated state; The PIPELINE module is used to decrypt the packet when it needs to be decrypted, and then concatenate the decrypted packet with the packet that does not need to be decrypted before outputting it.

5. The network message decryption device according to claim 4, characterized in that, The PIPELINE module includes multiple decryption engine units, each of which processes one of the packets received from the dequeue management module; the number of decryption engine units is determined based on the data transmission bit width and the size of the packet.

6. The network message decryption device according to claim 4 or 5, characterized in that, The RTC module includes multiple hash calculation engine units; the number of hash calculation engine units is set based on network transmission performance and the computing performance of a single hash calculation engine unit.

7. A method for encrypting network packets, characterized in that, include: The data frame parsing module splits the packet data obtained from parsing network packets into multiple packets and outputs each packet to the PIPELINE module; The PIPELINE module encrypts the input packets when encryption is required, and concatenates the encrypted packets with packets that do not require encryption. The concatenated message data is written to the data cache module, and the message-related information of the network message to which the written message data belongs is sent to the enqueue management module and the dequeue management module. The queuing management module places the message-related information into the corresponding channel queue and then performs scheduling management. The outbound management module places the message-related information of the received network packets into the corresponding channel queue; The queuing management module sends the packet-related information of the successfully scheduled network packets to the RTC module; The RTC module reads packet data from the data cache module based on the packet-related information and performs a hash operation, and writes back the hash value of the complete network packet obtained by the hash operation to the data cache module; The dequeue management module marks the message-related information of the complete network packet in the data cache module as activated when the hash value is successfully written back to the data cache module. After the outbound management module successfully schedules the packet-related information of network packets in the activated state, it outputs the corresponding packet data based on the successfully scheduled packet-related information.

8. The network message encryption method according to claim 7, characterized in that, The PIPELINE module includes multiple encryption engine units, each of which processes one of the packets received from the data frame parsing module; the number of encryption engine units is set based on the data transmission bit width and the size of the packet. The RTC module includes multiple hash calculation engine units; The number of hash calculation engine units is set based on network transmission performance and the computing performance of a single hash calculation engine unit.

9. A method for decrypting network packets, characterized in that, include: The data frame parsing module writes the packet data obtained from parsing network packets into the data cache module, and sends the packet-related information of the network packet to which the written packet data belongs to the enqueue management module and the dequeue management module. The queuing management module places the message-related information into the corresponding channel queue and then performs scheduling management. The outbound management module places the message-related information of the received network packets into the corresponding channel queue; The queuing management module sends the packet-related information of the successfully scheduled network packets to the RTC module; The RTC module reads packet data from the data cache module based on the packet-related information and performs a hash operation. It then performs an integrity check based on the hash value of the complete network packet obtained from the hash operation and outputs the integrity check result to the dequeue management module. The outbound management module marks the message-related information of the complete network message after integrity verification as activated. After the outbound management module successfully schedules the message-related information corresponding to the message data in the activated state, it reads the message data corresponding to the successfully scheduled message-related information from the data cache module, splits the message data into multiple groups, and outputs each group to the PIPELINE module. The PIPELINE module decrypts the packets when they need to be decrypted, and then concatenates the decrypted packets with the packets that do not need to be decrypted before outputting them.

10. The network message decryption method according to claim 9, characterized in that, The PIPELINE module includes multiple decryption engine units, each of which processes one of the packets received from the dequeue management module. The number of decryption engine units is determined based on the data transmission bit width and the size of the packet; The RTC module includes multiple hash calculation engine units; The number of hash calculation engine units is set based on network transmission performance and the computing performance of a single hash calculation engine unit.

Images