Intelligent network card system realized based on domestic FPGA and data transmission method
By designing a UDP protocol stack offload engine and security engine based on domestic FPGA in the intelligent network card system, the challenges of domesticization and security control are solved, efficient data surface processing and real-time iteration of security policies are achieved, and the needs of deep adaptation and independent control of domestic FPGA platforms are met.
Patent Information
- Application Number
- CN202510350854.0
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-03-24
- Publication Date
- 2025-06-24
AI Technical Summary
Existing smart network cards have challenges in domestic production and security control. Domestic FPGA chips have generation differences with imported chips in terms of logic unit density and high-speed interface bandwidth. Traditional hardware acceleration architectures are difficult to directly transplant, and there is a lack of a unified resource scheduling mechanism, resulting in low hardware resource utilization, making it difficult to achieve closed-loop response from threat perception to adaptive protection.
An intelligent network card system based on domestic FPGA was designed, including a UDP protocol stack offload engine and security engine designed based on domestic FPGA. The UDP protocol stack offload engine processes packets through a five-tuple matching table, and the security engine adopts a multi-core parallel pipeline architecture, integrates the SM4 national secret algorithm engine, and supports protocol analysis → national secret algorithm processing to streamline execution.
It has achieved a deep combination of domestic production and security and control. Through full hardware-level data processing, it breaks the dependence on imported chips and software password databases, reduces the host load, improves the throughput and delay performance of encrypted forwarding, and meets the independent and controllable requirements for key information infrastructure.
Smart Images
Figure CN120200806A_ABST
Abstract
Description
Technical Field
[0001] The present invention belongs to the technical field of FPGA applications, and particularly relates to an intelligent network card system and a data transmission method implemented based on domestic FPGA. Background Art
[0002] At present, as a core component of a network communication system, an intelligent security network card undertakes the dual tasks of high-speed data transmission and security protection. In high-concurrency scenarios such as data centers and industrial Internet, traditional network interface cards mostly rely on general-purpose processors (CPUs) or application-specific integrated circuits (ASICs) to implement security functions. The software solutions based on CPUs (such as IPSec protocol stacks, SSL encryption and decryption) need to frequently interrupt host resources, resulting in a large fluctuation in system throughput at network traffic peaks and being difficult to meet the microsecond-level latency requirements; while ASIC chips, although having hardware acceleration performance, their fixed functional architectures cannot adapt to the upgrade of national cryptography algorithms (such as SM3 / SM4) or the requirements of new threat detections (such as the identification of APT attacks in encrypted traffic), leading to the dilemmas of lagging function iteration and shortened life cycle for the devices. In addition, high-end FPGA chips (such as Xilinx UltraScale+) dominated by international manufacturers have long occupied the market, and their potential supply chain risks and data sovereignty hidden dangers have become important concerns in the field of critical infrastructure.
[0003] To balance performance and flexibility, the intelligent network card technology based on FPGA has gradually become the mainstream. Due to its reconfigurable characteristics, FPGA can parallelly process security functions such as encryption engines and deep packet inspection (DPI) in a pipeline form, significantly reducing the host load. However, existing solutions face severe challenges in domestic implementation: There is a generation gap between domestic FPGA chips (such as Unisoc Pango, Fudan Microelectronics FMQL series) and imported chips in terms of indicators such as logic unit density and high-speed interface bandwidth, and traditional hardware acceleration architectures are difficult to directly transplant, and it is necessary to reconstruct the data path and storage controller according to the characteristics of domestic platforms. At the same time, existing designs mostly adopt static stacking of security function modules (such as independently deploying AES-GCM encryption and regular expression matching units), lacking a unified resource scheduling mechanism, resulting in low utilization rate of hardware resources and insufficient energy efficiency ratio in mixed load scenarios. More critically, in the face of new threats such as zero-day vulnerabilities and covert channels, traditional FPGA solutions rely on the fixed strategy of offline programming and cannot dynamically reconstruct the protection logic based on real-time traffic characteristics, making it difficult to achieve a closed-loop response from threat perception to adaptive protection.
[0004] In addition, existing intelligent network cards generally adopt an architecture in which the security module and the protocol processing module are separated, and the data stream needs to be repeatedly migrated between multiple processing engines, which not only increases the complexity of board-level interconnection, but also causes additional power consumption due to frequent context switching. The above problems are particularly prominent in scenarios with strict real-time requirements such as edge computing.
[0005] Therefore, there is an urgent need for an intelligent security network card architecture that deeply integrates security processing and network protocol offloading and adapts to the characteristics of domestic FPGA platforms to break through the multi-dimensional technical bottlenecks of performance, flexibility, and self-control. Summary of the Invention
[0006] To solve the above problems existing in the prior art, the present invention provides an intelligent network card system and a data transmission method implemented based on domestic FPGA.
[0007] The technical problems to be solved by the present invention are achieved through the following technical solutions:
[0008] The present invention provides an intelligent network card system implemented based on domestic FPGA, including: a UDP protocol stack offloading engine designed based on domestic FPGA and a security engine designed based on domestic FPGA;
[0009] The UDP protocol stack offloading engine is used to perform UDP protocol stack processing on the packets from the host based on the configured five-tuple matching table of Ethernet to obtain the packets to be encrypted, and is also used to perform UDP protocol stack processing on the packets from the network interface to obtain the packets to be decrypted. Among them, for the packets from the host, the UDP protocol stack processing includes packet fragmentation-related processing;
[0010] The security engine has a multi-core parallel pipeline architecture and is used to perform parallel encryption processing on the packets to be encrypted based on the configured encryption and decryption keys by using the multi-core parallel pipeline architecture to obtain the encrypted packet data, and is also used to perform parallel decryption processing on the packets to be decrypted based on the configured encryption and decryption keys by using the multi-core parallel pipeline architecture to obtain the decrypted packet data.
[0011] The present invention also provides a data transmission method applied to the above intelligent network card system implemented based on domestic FPGA, including:
[0012] Configuring network card information, where the network card information includes: the five-tuple matching table of Ethernet and the encryption and decryption keys;
[0013] Receiving packets, and when the packets are from the host, performing UDP protocol stack processing on the packets from the host based on the five-tuple matching table of Ethernet to obtain the packets to be encrypted, and when the packets are from the network interface, performing UDP protocol stack processing on the packets from the network interface to obtain the packets to be decrypted;
[0014] Using a multi-core parallel pipeline architecture, based on the encryption and decryption key, perform parallel encryption processing on the message to be encrypted to obtain encrypted message data, and send the encrypted message data to the network interface. Or, using a multi-core parallel pipeline architecture, based on the encryption and decryption key, perform parallel decryption processing on the message to be decrypted to obtain decrypted message data, and send the decrypted message data to the host.
[0015] Compared with the prior art, the beneficial effects of the present invention are as follows:
[0016] The present invention designs a secure intelligent network card implemented based on a domestic FPGA, achieving a deep combination of localization and security and controllability. Through the domestic FPGA platform, full-hardware-level data plane processing is realized, integrating the SM4 national cryptography algorithm engine and the independently designed UDP protocol offloading engine, breaking the dependence on imported chips and software cryptographic libraries, eliminating potential supply chain backdoor risks from the hardware architecture level, and meeting the requirements of autonomy and controllability for critical information infrastructure. In addition, the pipeline coupling architecture of the UDP protocol offloading engine and the SM4 encryption engine designed by the present invention supports the pipelined execution of protocol parsing → national cryptography algorithm processing, realizing a deep combination of security processing and network protocol offloading. Compared with traditional software solutions, the throughput of encrypted forwarding is higher, the latency can be reduced to the nanosecond level, and the occupancy rate of the host (CPU) is lower.
[0017] The following will further elaborate on the present invention in detail in conjunction with the accompanying drawings and specific embodiments. Description of the Drawings
[0018] Figure 1 is a schematic diagram of the architecture of the intelligent network card system implemented based on a domestic FPGA provided by an embodiment of the present invention;
[0019] Figure 2 is a block diagram of the UDP protocol stack offloading engine provided by an embodiment of the present invention;
[0020] Figure 3 is a schematic diagram of the format of the first 16 bytes of a message from the host;
[0021] Figure 4 is a schematic diagram of the architecture of a security engine provided by an embodiment of the present invention;
[0022] Figure 5 is a schematic diagram of the process of the data transmission method provided by an embodiment of the present invention. Detailed Embodiments
[0023] The following further describes the present invention in detail with specific embodiments, but the embodiments of the present invention are not limited thereto.
[0024] The method of the present invention proposes an intelligent network card system implemented based on domestic FPGA. This intelligent network card system is a high-throughput and low-latency hardware co-processing architecture system, which deeply couples the data encapsulation, checksum calculation, jumbo frame fragmentation, and national cryptography SM4 encryption process of the UDP protocol stack at the full hardware level. For UDP protocol stack offloading, a protocol-specific engine designed independently is used to achieve fast five-tuple matching, automatic encapsulation of IP / UDP headers, and hardware generation of checksums, supporting single-cycle processing of 64B - 9KB ultra-long frame data; for national cryptography SM4 encryption, a multi-core parallel pipeline architecture is adopted, combined with a key dynamic injection and side-channel attack prevention mechanism, to achieve zero-copy processing of data fragmentation encryption and integrity verification. Through the hardware-level cooperative scheduling of the protocol offloading and encryption engine, the sending plane (host-network interface) can simultaneously carry the protocol encapsulation and national cryptography encryption tasks of gigabit-level UDP traffic. Compared with traditional CPU software solutions (such as the Linux kernel protocol stack + OpenSSL), the throughput is effectively improved, the end-to-end latency can be reduced to the sub-microsecond level, and the key management is completely isolated from the host system, avoiding the risk of security information leakage. In addition, due to the hardware programmability of domestic FPGA, it supports dynamic switching of encryption strategies (such as SM4-CBC / GCM modes) and protocol parameters (such as UDP port mapping rules), and can achieve real-time iteration of security policies without interrupting services, adapting to the requirements of high-dynamic scenarios such as industrial Internet and 5G edge computing.
[0025] Figure 1 is a schematic diagram of the architecture of the intelligent network card system implemented based on domestic FPGA provided by an embodiment of the present invention. As Figure 1 shown, the intelligent network card system includes: a UDP protocol stack offloading engine designed based on domestic FPGA and a security engine designed based on domestic FPGA. Both of these engines are hardware designed based on domestic FPGA. The UDP protocol stack offloading engine is used to perform UDP protocol stack processing on the packets from the host based on the configured five-tuple matching table of the Ethernet to obtain the packets to be encrypted, and is also used to perform UDP protocol stack processing on the packets from the network interface to obtain the packets to be decrypted. Among them, for the packets from the host, the UDP protocol stack processing includes packet fragmentation-related processing. The security engine has a multi-core parallel pipeline architecture. The security engine is used to perform parallel encryption processing on the packets to be encrypted based on the configured encryption and decryption keys by using the multi-core parallel pipeline architecture to obtain the encrypted packet data, and is also used to perform parallel decryption processing on the packets to be decrypted based on the configured encryption and decryption keys by using the multi-core parallel pipeline architecture to obtain the decrypted packet data.
[0026] In the present invention, the host is connected to the intelligent network card system through a PCIe interface.
[0027] Here, before the intelligent network card system works properly, it is necessary to complete the configuration of key information in advance. For example, the host CPU can complete the configuration of key information. The five-tuple matching table of this Ethernet is the five-tuple matching table relied on by the UDP protocol stack. When encapsulating a packet with Ethernet, the Ethernet header information obtained by querying this table needs to be used. At the same time, in order to avoid the risk of security information leakage, the key management needs to be completely isolated from the host system. Therefore, the keys required by the encryption and decryption algorithms need to be configured on the FPGA hardware.
[0028] Exemplarily, Figure 2 is the architecture diagram of the UDP protocol stack offloading engine proposed by the present invention. As Figure 2 shown, the UDP protocol stack offloading engine in the present invention includes: a sending plane data processing module 1 and a receiving plane data processing module 2. The sending plane data processing module 1 is used to perform fragmentation-related processing, framing processing, and encapsulation processing on the packets from the host based on the configured five-tuple matching table of Ethernet to obtain the packets to be encrypted. The receiving plane data processing module 2 is used to perform verification processing and framing-related processing on the packets from the network interface to obtain the packets to be decrypted.
[0029] Specifically, continuing to refer to the above Figure 2 , the sending plane data processing module 1 includes: a sending plane packet information extraction sub-module 10, a sending plane fragmentation offloading sub-module 20, a sending plane framing offloading sub-module 30, and a sending plane Checksum calculation offloading sub-module 40.
[0030] The sending plane packet information extraction sub-module 10 is used to extract the key field information in the packets from the host to obtain the first key field information. Specifically, the packet length and packet ID in the first 16 bytes of the packet from the host can be extracted as the first key field information. Exemplarily, the format of the first 16 bytes of the packet from the host is as Figure 3 shown. The packet length information (Length) is used to determine whether the packet is a jumbo frame, that is, whether it exceeds the MTU frame. The packet ID (port ID) is used to query the five-tuple matching table to obtain the MAC header, IP header, and UDP header necessary for Ethernet frame encapsulation.
[0031] The sending plane fragmentation offloading sub-module 20 adopts the design concept of a state machine. By judging the frame length information carried before the payload, it determines whether the input frame needs to be fragmented currently. After each fragmentation is completed, it returns to the judgment state for repeated states until the input frame is completely fragmented and then output. The sending plane fragmentation offloading sub-module 20 is used to judge whether the length of the packet from the host exceeds the maximum transmission unit of Ethernet according to the first key field information. If so, it fragments the packet from the host to obtain multiple fragmented packets, and takes the multiple fragmented packets as the packets after fragmentation-related processing. If not, it does not fragment the packet from the host and takes the packet from the host as the packet after fragmentation-related processing. The design of this module is implemented based on hardware, thus reducing the burden on the CPU at the network layer. Specifically, when the host CPU issues the original application layer data (i.e., the packet) through the PCIe interface, the UDP protocol stack offloading engine performs a hardware comparison between the extracted packet length field and the preset MTU. This process can be implemented by a parallel length checker and only takes 1 clock cycle to complete the judgment. If the packet length exceeds the MTU, the packet is fragmented with a preset number of fragments. When performing the fragmentation operation on the packet, first, the payload is cut and filled. The packet is cut with a preset fragmentation value as the granularity, and the insufficient part is filled with random data to ensure fragmentation alignment. Then, the fragment header is generated, and the IP header fields after fragmentation are automatically calculated, including the fragmentation flag bit, fragmentation offset value, etc. It should be noted that how to fragment the packet is prior art and will not be elaborated in this invention.
[0032] The sending plane frame assembly offloading sub-module 30 is responsible for converting the raw data packets generated by the upper-layer application layer protocol into an Ethernet standard data frame format. The sending plane frame assembly offloading sub-module 30 is used to find the corresponding Ethernet frame key information from the configured Ethernet five-tuple matching table according to the first key field information, and generate an Ethernet message based on the Ethernet frame key information and the message after fragmentation-related processing. The sending plane Checksum calculation offloading sub-module 40 is used to calculate the IP Checksum and UDP Checksum of the Ethernet message, and add the calculated IP Checksum and UDP Checksum to the Ethernet message to obtain a complete Ethernet message, and use the complete Ethernet message as the message to be encrypted. By designing the sending plane Checksum calculation offloading sub-module 40, the calculation of the address checksum (IP, UDP) can be offloaded to the network card hardware, significantly reducing the CPU load. Specifically, when the host CPU issues a message through the PCIe interface and completes the judgment and fragmentation operation on whether the message needs to be fragmented, first perform a complete Ethernet packet encapsulation operation, that is, encapsulate all fragmented or unfragmented messages into an Ethernet message, query the five-tuple matching table according to the previously extracted message ID, and the corresponding Ethernet frame key information can be obtained from the table. For example, the MAC header, IP header, and UDP header; encapsulate these Ethernet frame key information into an Ethernet header and splice it at the head of the message. After that, calculate the IP Checksum and UDP Checksum of the encapsulated message, and after completing the calculation of the IP Checksum and UDP Checksum, fill the calculation results into the corresponding fields of the Ethernet message. Checksum calculation is a computationally intensive task. It requires mathematical operations on each byte of the data packet, especially for the processing of a large number of data packets. These operations usually involve operations such as addition and modulo, and have high requirements for the CPU's computing power; at the same time, in the operating system, the processing of the network protocol stack usually involves a large number of context switches. Each time the CPU processes the Checksum of a data packet, it needs to switch from the user mode to the kernel mode and then switch back. These context switches not only consume CPU resources but also increase the system overhead. The present invention calculates the Checksum through hardware, so that these context switches can be greatly reduced, further improving the overall performance of the system. It should be noted that the calculation principle of Checksum is prior art and will not be elaborated in the present invention.
[0033] Specifically, continue to refer to the above Figure 2 , the receiving plane data processing module 2 includes: a receiving plane message information extraction sub-module 50, a receiving plane Checksum verification offloading sub-module 60, and a receiving plane fragmentation recombination offloading sub-module 70.
[0034] The receiving plane message information extraction sub-module 50 is used to extract the key field information from the messages received from the network interface to obtain the second key field information. Specifically, for the receiving plane (network interface - CPU), the source address, destination address, flag bits, UDP Checksum, and IP Checksum need to be extracted from the Ethernet header of the message. The Checksum information is used for UDP / IP Checksum verification. When performing the Checksum verification, the hardware will recalculate the UDP Checksum and IP Checksum and compare them with the extracted Checksum field. If they are consistent, the verification is considered passed; otherwise, the message will be discarded, and the host will be notified through an interrupt that a message with a checksum error has been filtered. The flag bits are used for fragmentation and reassembly operations, indicating whether the message is a fragmented message, whether it is the last fragmented message, etc.
[0035] The receiving plane Checksum verification offloading sub-module 60 is used to perform IP Checksum and UDP Checksum verifications on the messages received from the network interface according to the second key field information. The receiving plane Checksum verification offloading sub-module 60 includes a statistical counter. The receiving plane Checksum verification offloading sub-module 60 is also used to determine that there is an error in the message received from the network interface and discard the message received from the network interface when the message received from the network interface fails the IP Checksum verification or UDP Checksum verification. The statistical counter is used to record the error type of the message received from the network interface, and the error statistical information recorded by the statistical counter is reported to the host through an interrupt regularly. Specifically, for the messages input from the physical network interface (such as 10G / 25G Ethernet MAC), first, calculate the IP Checksum according to the previously extracted information. Then, compare the extracted IP Checksum with the calculated IP Checksum. If they are consistent, the IP verification passes, and further verify the checksum value of the UDP pseudo-header (source / destination IP, protocol type, UDP length) and the payload, that is, verify the UDP Checksum. If they are consistent, the UDP verification passes. Once the IP or UDP verification fails, it means that the message verification fails, and the message will be directly discarded. The error type (such as IP / UDP verification error, length anomaly, etc.) will be recorded through the statistical counter (located in the FPGA BRAM), and the error statistical information will be reported to the host CPU through an interrupt regularly.
[0036] The receiving plane fragment reassembly offloading sub-module 70 is used to determine whether the packet from the network interface that passes the Checksum verification is a fragmented packet. If so, it continues to receive subsequent fragmented packets that pass the Checksum verification. After receiving the remaining fragmented packets that belong to the same packet as the fragmented packet, it concatenates all the received fragmented packets into a complete packet and uses it as the packet to be decrypted. If not, it uses the packet from the network interface that passes the Checksum verification as the packet to be decrypted. Specifically, for the packet input from the physical network interface, after passing the Checksum verification, it checks information such as the IP fragmentation flag (flag bit) and offset of the packet to determine whether the packet needs to be fragmented and reassembled. If the packet is a fragmented packet and not the last fragmented packet, it is stored in the Buffer and waits for the subsequent fragmented packets to return. After determining that a certain fragmented packet is the last fragmented packet, all the fragmented packets are concatenated and reassembled before continuing to be sent. Since the output of the fragmented packet after reassembly may occupy the output bus for a long time, this module is designed with two output buses, which are respectively used for the output of the packets that do not need to be reassembled and the output of the packets after fragmented reassembly.
[0037] In the present invention, the encryption or decryption algorithm used by the security engine during encryption or decryption can be determined according to actual needs. Exemplarily, the encryption or decryption algorithm used by the security engine during encryption or decryption is the national cipher SM4 algorithm. The SM4 national cipher algorithm is a symmetric cipher algorithm, also known as the SM4 block cipher algorithm. The length of each block of the SM4 block cipher algorithm is generally 128 bits, and the key length is also 128 bits. Both the encryption algorithm and the cipher expansion algorithm adopt a 32-round non-linear iterative mechanism. Exemplarily, the security engine in the present invention is specifically used to perform parallel encryption processing on the packet to be encrypted based on the configured encryption and decryption key by using a multi-core parallel pipeline architecture and the national cipher SM4 algorithm to obtain the encrypted packet data, and to perform parallel decryption processing on the packet to be decrypted based on the configured encryption and decryption key by using a multi-core parallel pipeline architecture and the national cipher SM4 algorithm to obtain the decrypted packet data.
[0038] Exemplarily, Figure 4 is a schematic diagram of the architecture of the security engine. As Figure 4As shown, when the encryption or decryption algorithm used by the security engine during encryption or decryption is the national standard SM4 algorithm, the security engine includes: a control module 80, an encryption / decryption module 90, M round key expansion modules 100, and M round function calculation modules 110; M is a positive integer greater than or equal to 32. data_in represents the input message to be encrypted / decrypted, vld_in is a validity signal indicating whether the input message to be encrypted / decrypted is valid, rdy_in represents a feedback signal output outward to indicate the start of encrypting / decrypting the message to be encrypted / decrypted, key represents the configured encryption / decryption key, round represents the iteration round signal output by the control module 80 to the round function calculation module 110, vld is a validity signal indicating whether round is valid, data represents the message to be encrypted / decrypted output by the control module 80 to the encryption / decryption module 90, encrypt_key represents the iteratively generated key output by the round key expansion module 100 to the round function calculation module 110, encrypt_key_vld is a validity signal indicating whether encrypt_key is valid, ini_key represents the calculated data returned by the round function calculation module 110 to the round key expansion module 100, ini_key_vld is a validity signal indicating whether ini_key is valid, and rk_0 to rk_31 represent the calculation results output by the round function calculation module 110 to the encryption / decryption module 90.
[0039] Specifically, the control module 80 is used to receive the message to be encrypted or the message to be decrypted, iteratively control the M round function calculation modules 100 according to the message to be encrypted or the message to be decrypted, send the message to be encrypted or the message to be decrypted to the encryption / decryption module 90, and send the configured encryption / decryption key to the M round key expansion modules 100; each round key expansion module 100 is used to perform 32 rounds of key iteration on the configured encryption / decryption key to obtain 32 keys, and send the 32 keys to a corresponding round function calculation module 110; each round function calculation module 100 is used to perform function calculation and transformation processing on the received key according to the control of the control module to obtain the processed data, and send the processed data to the encryption / decryption module 90; the encryption / decryption module 90 is used to encrypt the message to be encrypted according to the processed data to obtain the encrypted message data, and is used to decrypt the message to be decrypted according to the processed data to obtain the decrypted message data.
[0040] Specifically, the main function of the control module 80 is to control the execution of the encryption / decryption algorithm, receive the message to be encrypted / decrypted, integrate the round function calculation module 110 and the round key expansion module 100, and transfer the data to the encryption / decryption module 90. By designing the round function calculation module 100, the round function calculation part of the SM4 algorithm is implemented by hardware. Through M round function calculation modules 100, various XOR and table lookup operations are calculated in parallel, maximizing the calculation and iteration efficiency of the round function. Each round key expansion module 100 is used to perform 32 rounds of key iteration. In each round, the current round serial number and key value are received, and the key expansion results of the four S-box output iterations can be searched in parallel. Among them, the S-box is used to implement the table lookup of the S-Box. By initializing the S-box in the memory in advance, when there is a non-linear transformation input, the value in the S-box to be transformed is returned in the form of table lookup, which only takes one clock cycle to complete, saving a large amount of calculation time. By designing the round function calculation module 110, the round function calculation part of the SM4 algorithm is implemented by hardware. Through parallel calculation of various XOR and table lookup operations, the calculation and iteration efficiency of the round function is maximized. Each round function calculation module 110 improves the security of the encryption / decryption algorithm through a series of complex transformations. Among them, the functions include permutation operation, non-linear transformation, and linear transformation. The encryption / decryption module 90 receives the data to be encrypted / decrypted in the AXIS format, integrates the round function module and the round key expansion module for iteration, and performs pipeline processing when outputting. Specifically, the encryption / decryption module 90 encrypts / decrypts the data based on the pipeline design idea. The 128-bit one-clock-cycle data input given by the control module 80 is used as the input of the round function of round number 0, and the first round of iteration starts. Subsequently, 32 round key expansion modules and the round key expansion module are integrated, and the expanded key output by the round key in this round is used as the key input for the next round of round function calculation, thus realizing the parallel calculation and processing of the round function and the key, and improving the execution efficiency of the algorithm.
[0041] For the packets sent by the CPU to the network interface, encryption operations need to be performed. After receiving the packets to be encrypted, the round function unit and round key expansion unit implemented by hardware are integrated for iteration, and pipelining is performed during output. The encryption operations include input data control, encryption, and output pipelining control. First, the data to be encrypted is received. The interface uses a valid-ready handshake model. When the handshake is valid, one clock cycle of data is input as the input of the round function for round number 0, and the first round of iteration starts. The ready of the encryption module should be pulled high after 32 iterations are completed, indicating that the current encryption is completed and the encryption of the next set of data can start. The encryption process mainly calls 32 round functions and round key expansion units simultaneously according to the algorithm requirements. The expanded key output by the round key in this round is used as the key input for the next round of round function calculation, so as to realize the parallel calculation and processing of the round function and the key, and improve the execution efficiency of the algorithm. Since the input uses a valid-ready handshake model, the ready can only be pulled high after the 32nd round of iteration each time, which will inevitably block the input frame. Therefore, pipeline design is considered, that is, the results of the current rounds 28, 29, and 30 are registered during the first output, and then output after the next 32 iterations are completed, so as to ensure that the input is not blocked and the bandwidth of the encryption process is guaranteed to the greatest extent. For the packets input from the network interface, decryption operations need to be performed. The decryption process of SM4 is exactly the same as the encryption process, and also includes 32 rounds of iteration and an inverse transformation. Only during the round iteration, the round key is used in reverse order, which will not be elaborated here.
[0042] The present invention also provides a data transmission method, which is applied to the intelligent network card system implemented based on the domestic FPGA as described above. As Figure 5 shown, the method includes:
[0043] S101. Configure network card information, where the network card information includes: the five-tuple matching table of the Ethernet and the encryption and decryption keys.
[0044] S102. Receive packets.
[0045] S1031. When the packet is from the host, perform UDP protocol stack processing on the packet from the host based on the five-tuple matching table of the Ethernet to obtain the packet to be encrypted.
[0046] Specifically, based on the five-tuple matching table of the Ethernet, perform fragmentation-related processing, framing processing, and encapsulation processing on the packet from the host to obtain the packet to be encrypted.
[0047] S1032. When the packet is from the network interface, perform UDP protocol stack processing on the packet from the network interface to obtain the packet to be decrypted.
[0048] Specifically, the messages from the network interface are subjected to verification processing and framing-related processing to obtain the messages to be decrypted.
[0049] S1041. Using a multi-core parallel pipeline architecture based on the encryption and decryption keys, perform parallel encryption processing on the message to be encrypted to obtain the encrypted message data, and send the encrypted message data to the network interface.
[0050] Specifically, a multi-core parallel pipeline architecture and the national secret SM4 algorithm can be used to perform parallel encryption processing on the message to be encrypted based on the encryption and decryption keys to obtain the encrypted message data.
[0051] S1042. Using a multi-core parallel pipeline architecture based on the encryption and decryption keys, perform parallel decryption processing on the message to be decrypted to obtain the decrypted message data, and send the decrypted message data to the host.
[0052] Specifically, a multi-core parallel pipeline architecture and the national secret SM4 algorithm can be used to perform parallel decryption processing on the message to be decrypted based on the encryption and decryption keys to obtain the decrypted message data.
[0053] It should be noted that each of the above steps is executed by the corresponding module or sub-module in the above intelligent network card system. Since the specific principles of each module and sub-module have been described above, the specific principles of the above steps will not be elaborated here.
[0054] It should be noted that the terms "first" and "second" are only used for descriptive purposes and cannot be construed as indicating or implying relative importance or implicitly specifying the quantity of the indicated technical features. Thus, the features defined with "first" and "second" may explicitly or implicitly include one or more features. In the description of the present invention, "a plurality" means two or more unless otherwise specifically defined.
[0055] In the description of this specification, the description with reference to terms such as "an embodiment", "some embodiments", "example", "specific example", or "some examples" means that the specific features or characteristics described in connection with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features or characteristics described can be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art can combine and combine the different embodiments or examples described in this specification.
[0056] In the description, the term "comprising" does not exclude other components or steps, and the article "a" or "an" does not exclude a plurality. Certain measures are recited in mutually different embodiments, but this does not mean that these measures cannot be combined to produce good results.
[0057] The above content is a further detailed description of the present invention in combination with specific preferred embodiments. It cannot be determined that the specific implementation of the present invention is only limited to these descriptions. For those of ordinary skill in the technical field to which the present invention pertains, without departing from the concept of the present invention, several simple deductions or substitutions can be made, and all should be regarded as belonging to the protection scope of the present invention.
Claims
1. A smart network card system based on domestic FPGA, characterized in that: include: UDP protocol stack offload engine based on domestic FPGA design, security engine based on domestic FPGA design; The UDP protocol stack unloading engine is used to perform UDP protocol stack processing on the message from the host based on the configured Ethernet five-tuple matching table to obtain the message to be encrypted, and to perform UDP protocol stack processing on the message from the network port to obtain the message to be decrypted, wherein, for the message from the host, the UDP protocol stack processing includes message fragmentation related processing; The security engine has a multi-core parallel pipeline architecture, which is used to use the multi-core parallel pipeline architecture to perform parallel encryption processing on the to-be-encrypted messages based on the configured encryption and decryption keys to obtain encrypted message data, and to use the multi-core parallel pipeline architecture to perform parallel decryption processing on the to-be-decrypted messages based on the configured encryption and decryption keys to obtain decrypted message data.
2. The intelligent network card system based on domestic FPGA according to claim 1 is characterized in that: The security engine is specifically used to utilize the multi-core parallel pipeline architecture and the national secret SM4 algorithm to perform parallel encryption processing on the to-be-encrypted message based on the configured encryption and decryption key to obtain the encrypted message data, and to utilize the multi-core parallel pipeline architecture and the national secret SM4 algorithm to perform parallel decryption processing on the to-be-decrypted message based on the configured encryption and decryption key to obtain the decrypted message data.
3. The intelligent network card system based on domestic FPGA according to claim 2 is characterized in that: The security engine comprises: a control module, an encryption and decryption module, M round key expansion modules and M round function calculation modules; M is a positive integer greater than or equal to 32; The control module is used to receive the message to be encrypted or the message to be decrypted, and iteratively control the M round function calculation modules according to the message to be encrypted or the message to be decrypted, and send the message to be encrypted or the message to be decrypted to the encryption and decryption module, and send the configured encryption and decryption key to the M round key expansion modules; Each round key expansion module is used to perform 32 rounds of key iterations on the configured encryption and decryption keys to obtain 32 keys, and send the 32 keys to a one-to-one corresponding round function calculation module; Each round function calculation module is used to perform function calculation and transformation processing on the received key according to the control of the control module to obtain processed data, and send the processed data to the encryption and decryption module; The encryption and decryption module is used to encrypt the message to be encrypted according to the processed data to obtain encrypted message data, and to decrypt the message to be decrypted according to the processed data to obtain decrypted message data.
4. The intelligent network card system based on domestic FPGA according to claim 1 is characterized in that: The UDP protocol stack unloading engine includes: a sending plane data processing module and a receiving plane data processing module; The sending plane data processing module is used to perform fragmentation-related processing, framing processing and encapsulation processing on the message from the host based on the configured Ethernet five-tuple matching table to obtain the message to be encrypted; The receiving plane data processing module is used to perform verification processing and frame-related processing on the message from the network port to obtain the message to be decrypted.
5. The intelligent network card system based on domestic FPGA according to claim 4 is characterized in that: The sending plane data processing module includes: A sending plane message information extraction submodule is used to extract key field information from the message from the host to obtain first key field information; a sending plane fragmentation unloading submodule, configured to determine whether the length of the message from the host exceeds the maximum transmission unit of the Ethernet according to the first key field information; if so, fragment the message from the host to obtain a plurality of fragmented messages, and use the plurality of fragmented messages as messages after fragmentation-related processing; if not, do not fragment the message from the host, and use the message from the host as a message after fragmentation-related processing; a sending plane framing unloading submodule, configured to find corresponding Ethernet frame key information from the configured Ethernet five-tuple matching table according to the first key field information, and generate an Ethernet message according to the Ethernet frame key information and the message after the fragmentation related processing; The sending plane checksum calculation offloading submodule is used to calculate the IP checksum and UDP checksum of the Ethernet message, and add the calculated IP checksum and UDP checksum to the Ethernet message to obtain a complete Ethernet message, and use the complete Ethernet message as the message to be encrypted.
6. The intelligent network card system based on domestic FPGA according to claim 4 is characterized in that: The receiving plane data processing module includes: A receiving plane message information extraction submodule is used to extract key field information from the message from the network port to obtain second key field information; A receiving plane checksum check unloading submodule, used for performing IP checksum and UDP checksum checks on the message from the network port according to the second key field information; The receiving plane fragmentation reassembly and unloading submodule is used to determine whether the message from the network port that has passed the Checksum check is a fragmented message. If so, continue to receive subsequent fragmented messages that have passed the Checksum check, and after receiving the remaining fragmented messages that belong to the same message as the fragmented message, splice all the received fragmented messages into a complete message as the message to be decrypted. If not, use the message from the network port that has passed the Checksum check as the message to be decrypted.
7. The intelligent network card system based on domestic FPGA according to claim 6 is characterized in that: The receiving plane Checksum check unloading submodule includes a statistical counter, and the receiving plane Checksum check unloading submodule is also used to determine that there is an error in the message from the network port when the message from the network port fails to pass the IP Checksum check or the UDP Checksum check, and discard the message from the network port, use the statistical counter to record the error type of the message from the network port, and regularly report the error statistical information recorded by the statistical counter to the host through an interrupt.
8. A data transmission method, applied to the smart network card system based on domestic FPGA as described in any one of claims 1 to 7, characterized in that: include: Configure network card information, the network card information includes: Ethernet five-tuple matching table and encryption and decryption keys; Receive a message, and when the message is a message from a host, perform UDP protocol stack processing on the message from the host based on the five-tuple matching table of the Ethernet to obtain a message to be encrypted, and when the message is a message from a network port, perform UDP protocol stack processing on the message from the network port to obtain a message to be decrypted; The encrypted message is encrypted in parallel using a multi-core parallel pipeline architecture based on the encryption / decryption key to obtain encrypted message data, and the encrypted message data is sent to the network port; or, the encrypted message is decrypted in parallel using a multi-core parallel pipeline architecture based on the encryption / decryption key to obtain decrypted message data, and the decrypted message data is sent to the host.
9. The data transmission method according to claim 8, characterized in that: The method of using a multi-core parallel pipeline architecture to perform parallel encryption processing on the message to be encrypted based on the encryption and decryption key to obtain encrypted message data includes: Using a multi-core parallel pipeline architecture and the national secret SM4 algorithm, the message to be encrypted is encrypted in parallel based on the encryption and decryption key to obtain encrypted message data; The method of using a multi-core parallel pipeline architecture to perform parallel decryption processing on the message to be decrypted based on the encryption and decryption key to obtain decrypted message data includes: By using a multi-core parallel pipeline architecture and the national encryption SM4 algorithm, the to-be-decrypted message is decrypted in parallel based on the encryption and decryption key to obtain the decrypted message data.
10. The data transmission method according to claim 8, characterized in that: The five-tuple matching table based on the Ethernet performs UDP protocol stack processing on the message from the host to obtain the message to be encrypted, including: Based on the five-tuple matching table of the Ethernet, the message from the host is subjected to fragmentation-related processing, framing processing and encapsulation processing to obtain a message to be encrypted; The performing UDP protocol stack processing on the message from the network port to obtain the message to be decrypted includes: The message from the network port is subjected to verification processing and frame-related processing to obtain a message to be decrypted.