An algorithm configuration method and device based on dynamic loading and FPGA reconfiguration

Abstract

The application discloses a kind of algorithm configuration method and device based on dynamic loading and FPGA reconfiguration, comprising the following steps: Linux system algorithm configuration dynamic library is stored to external memory with algorithm file;Algorithm configuration dynamic library in external memory is cached by hardware connection interface call, for parsing the processing logic of algorithm file, read and cache operation to algorithm file is executed;According to the bit stream of algorithm file, execute partial reconfiguration configuration operation to FPGA, and the FPGA after reconfiguration is used to realize the encryption operation to service data;After configuration, unload algorithm configuration dynamic library, and clear cached algorithm file.The application uses more flexible technical scheme to realize the dynamic configuration and update of encryption algorithm, also enhances the security of data, ensures the confidentiality and integrity of algorithm.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and in particular to an algorithm configuration method and apparatus based on dynamic loading and FPGA reconstruction. Background Technology

[0002] With the rapid development of information technology, cybersecurity issues have become increasingly prominent, and the forms and complexity of cyberattacks are constantly increasing. Against this backdrop, deploying encryption modules at critical locations in network devices has become a crucial means of protecting data security. Encryption modules encrypt data transmitted over the network, ensuring that even if data is intercepted, attackers cannot easily decipher its content, thus effectively safeguarding the security and integrity of information.

[0003] However, the traditional method of directly embedding encryption algorithms into cryptographic modules has significant limitations. First, once the algorithm is embedded in the hardware or firmware, it is easily exposed to potential risks. Whether through physical access or software vulnerabilities, these critical algorithms may be at risk of being leaked, leading to reduced security. Second, the update process using this embedded method is particularly inconvenient when it is necessary to change the encryption algorithm according to new security standards or to address new types of attacks. Because the algorithm is statically fixed, any update usually requires reprogramming or replacing the hardware, which not only increases costs but may also lead to extended system downtime and affect business continuity.

[0004] Furthermore, modern application scenarios are demanding greater flexibility and scalability, especially in areas such as cloud computing and the Internet of Things (IoT), where the ability to respond quickly to changes is crucial.

[0005] Therefore, how to provide a method and apparatus that can flexibly and reliably configure algorithm parameters according to different usage requirements of cryptographic modules is a technical problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0006] In response to the aforementioned research status, this invention provides an algorithm configuration method and apparatus based on dynamic loading and FPGA reconstruction. It adopts a more flexible technical solution to realize the dynamic configuration and updating of encryption algorithms, and also enhances data security, ensuring the confidentiality and integrity of the algorithm.

[0007] This invention provides an algorithm configuration method based on dynamic loading and FPGA reconfiguration, comprising the following steps:

[0008] S1: Store the Linux system algorithm configuration dynamic library and algorithm files to external storage;

[0009] S2: The algorithm configuration dynamic library in the external memory is retrieved and cached through the hardware connection interface, which is used to parse the processing logic of the algorithm file and perform reading and caching operations on the algorithm file;

[0010] S3: Perform a partial reconstruction configuration operation on the FPGA based on the bit stream of the algorithm file. The reconstructed FPGA is used to implement encryption operations on business data.

[0011] S4: After configuration, uninstall the algorithm configuration dynamic library and clear the cached algorithm files.

[0012] Preferably, the algorithm configuration dynamic library includes logic for reading, decrypting, and configuring algorithm files.

[0013] Preferably, step S2 includes the following steps:

[0014] S211: Read the algorithm configuration dynamic library from external storage, and store it in RAM cache after passing CRC verification;

[0015] S212: Call the algorithm read function in the algorithm configuration dynamic library to read the algorithm file in the external storage;

[0016] S213: Call the algorithm decryption interface in the algorithm configuration dynamic library to verify and decrypt the algorithm file. If the verification and decryption pass, store the decrypted algorithm file in the RAM cache.

[0017] Preferably, step S1 further includes: storing the memory configuration file to an external memory for checking whether the external memory environment meets the requirements for accessing the algorithm configuration dynamic library.

[0018] Preferably, step S2 further includes the following steps:

[0019] S221: Read the memory configuration file and parse its contents; obtain the device information of the FPGA;

[0020] S222: Based on the configuration file content and the device information, check whether the memory type of the external storage is correct and / or whether the stored target configuration information matches; if the check passes, execute the algorithm configuration dynamic library retrieval operation; if the check fails, output an alarm signal and return to S221.

[0021] Preferably, before retrieving the algorithm configuration dynamic library from external memory via the hardware connection interface in step S2, the following steps are also included:

[0022] S201: Hot-plug monitoring is performed on the hardware connection interface. If the external memory is detected to be connected, proceed to S202.

[0023] S202: Determine whether the external memory is a valid memory. If valid, proceed to S2; if invalid, output an alarm signal and return to S201.

[0024] Preferably, step S3 includes the following steps:

[0025] S31: Send an algorithm configuration request to the FPGA, and proceed to S32 after receiving the algorithm configuration request response from the FPGA;

[0026] S32: Transmit the bit stream of the algorithm file to the FPGA in segments, and after each bit stream is transmitted, receive and judge the transmission response result fed back by the FPGA;

[0027] S33: If the transmission response result is abnormal, retransmit the bit stream of the current segment of the algorithm file to the FPGA, receive and judge the transmission response result fed back by the FPGA, and return to S33; if the transmission response result is normal, transmit the bit stream of the next segment of the algorithm file to the FPGA until the transmission of the algorithm file is completed.

[0028] This invention also provides an encryption device based on the algorithm configuration method of dynamic loading and FPGA reconstruction, comprising a dedicated algorithm memory and an encryption module; wherein,

[0029] The dedicated algorithm storage is used as external storage to store the Linux system algorithm configuration dynamic library and algorithm files;

[0030] The encryption module includes an ARM processor and an FPGA algorithm processing module;

[0031] The ARM processor retrieves and caches the algorithm configuration dynamic library in the external memory to RAM through the hardware connection interface, uses the algorithm configuration dynamic library to parse the processing logic of the algorithm file, reads the algorithm file and caches it to RAM; and after the configuration is completed, it unloads the algorithm configuration dynamic library and clears the cached algorithm file.

[0032] The FPGA algorithm processing module performs a partial reconstruction configuration operation on the FPGA based on the bit stream of the algorithm file. The reconstructed FPGA is used to implement the encryption operation of business data in the business system.

[0033] Preferably, the external interfaces of the ARM processor include a USB interface and a QSPI interface; the USB interface is used to connect to the algorithm-dedicated memory; and the QSPI interface is used to connect to the FPGA algorithm processing module.

[0034] Preferably, the encryption module further includes an interaction module for indicating the status of the algorithm configuration process and outputting external interface connection information of the ARM processor.

[0035] The present invention has the following advantages over the prior art:

[0036] This invention stores the algorithm and its configuration information in a dedicated memory and employs an ARM architecture microprocessor based on an embedded Linux system to monitor the storage device's connection status, parse the configuration file, and read and dynamically load the algorithm configuration dynamic library. Then, the decrypted algorithm bitstream is sent to the FPGA algorithm processing module via the QSPI interface. The FPGA performs partial reconstruction based on the received bitstream, thereby implementing specific encryption functions. This invention separates the algorithm from the cryptographic module and uses dynamically configured algorithms, allowing for flexible changes to the algorithm and configuration logic according to the usage scenario while achieving secure protection of critical data such as the algorithm. Attached Figure Description

[0037] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are merely embodiments of the present invention, and those skilled in the art can obtain other drawings based on the provided drawings without creative effort.

[0038] Figure 1 A flowchart of an algorithm configuration method based on dynamic loading and FPGA reconfiguration provided in an embodiment of the present invention;

[0039] Figure 2 This is a flowchart of the FPGA injection algorithm provided in an embodiment of the present invention;

[0040] Figure 3 This is an interaction diagram of the FPGA receiving algorithm file bitstream provided in an embodiment of the present invention;

[0041] Figure 4 This is a structural diagram of an encryption device provided in an embodiment of the present invention. Detailed Implementation

[0042] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0043] The first aspect of this invention discloses an algorithm configuration method based on dynamic loading and FPGA reconfiguration, such as... Figure 1 As shown, it includes the following steps:

[0044] S1: Store the Linux system algorithm configuration dynamic library and algorithm files to external storage;

[0045] S2: The algorithm configuration dynamic library in the external memory is retrieved and cached through the hardware connection interface. It is used to parse the processing logic of the algorithm file and perform reading and caching operations on the algorithm file.

[0046] S3: Perform a partial reconstruction configuration operation on the FPGA based on the bit stream of the algorithm file. The reconstructed FPGA is used to implement encryption operations on business data.

[0047] S4: After configuration, uninstall the algorithm configuration dynamic library and clear the cached algorithm files.

[0048] It should be noted that Linux system dynamic loading is a mechanism in which programs dynamically load .so shared libraries (Shared Objects, shared dynamic link libraries) on demand at runtime, load them into memory, extend their original functions, and can unload them from memory in a timely manner when they are no longer needed.

[0049] FPGA partial reconfiguration is the process of reconfiguring some logic resources of an FPGA without affecting its normal operation, thereby enabling encryption of business data.

[0050] In one embodiment, the algorithm configuration dynamic library includes logic for reading algorithm files, decrypting them, and processing algorithm configuration.

[0051] In one embodiment, S2 includes the following steps:

[0052] S211: Use the dlopen function to load the algorithm configuration dynamic library from external storage, and store it in RAM cache after passing CRC verification;

[0053] S212: Use the dlsym function to call the algorithm read function in the algorithm configuration dynamic library to read the algorithm file from external storage;

[0054] S213: Call the algorithm decryption interface in the algorithm configuration dynamic library to verify and decrypt the algorithm file. If the verification and decryption pass, store the decrypted algorithm file in the RAM cache. The algorithm file needs to be decrypted and restored before configuring the FPGA.

[0055] In one embodiment, the `dlclose` function is used to unload the algorithm configuration dynamic library and overwrite the RAM cache during the algorithm configuration process. The cryptographic module is in a non-operating state and does not save algorithm-related files; the algorithm is only dynamically injected at runtime. After injection, all algorithm-related programs in the MCU are cleared.

[0056] In one embodiment, S1 further includes: storing a memory configuration file to an external memory for checking whether the external memory environment meets the requirements for retrieving the algorithm configuration dynamic library. The memory configuration file describes information such as the dedicated memory vendor ID, memory type, disk creation time, target device type, etc.

[0057] In this embodiment, as Figure 2 As shown, S2 also includes the following steps:

[0058] S221: Read the memory configuration file, parse its contents, and obtain FPGA device information;

[0059] S222: Based on the configuration file content and device information, check whether the memory type of the external storage is correct and / or whether the stored target configuration information matches; if the check passes, execute the algorithm configuration dynamic library retrieval operation; if the check fails, control the status indicator to output an alarm signal and return to S221.

[0060] It should be noted that the target configuration information can be configured according to the usage scenario, such as configuration batch, algorithm, key activation time, external storage number, etc.

[0061] In one embodiment, such as Figure 2 As shown, before S2 retrieves the algorithm configuration dynamic library from external memory via the hardware connection interface, the following steps are also included:

[0062] S201: The algorithm configuration dynamic library in the external storage is retrieved through the USB interface. Netlink is used to monitor the hot-plugging of the USB interface. If the external storage is detected to be connected, proceed to S202.

[0063] S202: Determine whether the external memory is a valid memory by reading the PID and VID. If valid, proceed to S2; if invalid, control the status indicator to output an alarm signal and return to S201.

[0064] In one embodiment, the injection software and the FPGA algorithm processing module communicate via QSPI. The communication interaction process is as follows: Figure 3 As shown. S3 includes the following steps:

[0065] S31: Send a query FPGA number request to the FPGA. After receiving the response number from the FPGA, determine its validity. If valid, send an algorithm configuration request to the FPGA. After receiving the response to the algorithm configuration request from the FPGA, proceed to S32.

[0066] S32: Transmit the bit stream of the algorithm file to the FPGA in segments, and after each bit stream is transmitted, receive and judge the transmission response result fed back by the FPGA;

[0067] S33: If the transmission response result is abnormal, the bit stream of the current algorithm file is retransmitted to the FPGA, the transmission response result fed back by the FPGA is received and judged, and the process returns to S33; if the transmission response result is normal, the bit stream of the next algorithm file is transmitted to the FPGA until the algorithm file transmission is complete. During the transmission process, the status is indicated by the configured status control indicator lights.

[0068] As shown in Table 1, the algorithm configuration command request protocol format is as follows:

[0069] command word Data length Data content 1 byte 4 bytes N bytes

[0070] Table 2 shows the descriptions of the command words in the algorithm configuration command request protocol format:

[0071] command word illustrate 0x05 Configure the middle segment of the algorithm bitstream 0x85 Configure the first segment of the algorithm bitstream 0x45 Configure the end segment of the algorithm bitstream 0x06 Algorithm information file

[0072] In the algorithm configuration command request protocol format, the data length represents the number of bytes in the data content segment; the data content represents the actual data sent; the response data length is 1 byte, and the response value of 0x01 indicates that the FPGA has successfully received the data.

[0073] A second aspect of this invention provides an encryption device based on an algorithm configuration method using dynamic loading and FPGA reconstruction, according to a first aspect of this invention. Figure 4 As shown, it includes a dedicated memory for the algorithm and an encryption module; wherein,

[0074] A dedicated algorithm storage unit serves as external storage for Linux system algorithm configuration dynamic libraries and algorithm files.

[0075] The encryption module includes an ARM processor and an FPGA algorithm processing module;

[0076] The ARM processor retrieves and caches the algorithm configuration dynamic library in external memory to RAM through the hardware connection interface, uses the algorithm configuration dynamic library to parse the processing logic of the algorithm file, reads the algorithm file and caches it to RAM; and after the configuration is completed, it unloads the algorithm configuration dynamic library and clears the cached algorithm file.

[0077] The FPGA algorithm processing module performs a partial reconstruction configuration operation on the FPGA based on the bit stream of the algorithm file. The reconstructed FPGA is used to implement encryption operations on business data in the business system.

[0078] It should be noted that the ARM processor, based on the embedded Linux system, implements the injection software, which is used to monitor the connection status of dedicated storage devices, parse configuration files, read and load algorithm configuration dynamic libraries, dynamically load algorithm configuration dynamic libraries to complete a series of processes such as algorithm verification, decryption, and distribution, provide status indication during the injection process, and unload dynamic libraries and clean up data caches after configuration is completed.

[0079] Both the external memory and the ARM processor store a configuration file containing the target configuration information for the cryptographic module. When the ARM processor's main program detects the insertion of external memory, it first reads the memory's configuration information and compares it to the cryptographic module's configuration.

[0080] Among them, the ARM processor can be an MCU.

[0081] In one embodiment, the external interfaces of the ARM processor include a USB interface and a QSPI interface; the USB interface is used to connect to a dedicated algorithm memory; the QSPI interface is used to connect to an FPGA algorithm processing module and send the algorithm bit stream to the FPGA algorithm processing module through the QSPI interface.

[0082] In one embodiment, the encryption module further includes an interaction module for providing status indications during the algorithm configuration process and outputting external interface connection information for the ARM processor.

[0083] The above provides a detailed description of the algorithm configuration method and apparatus based on dynamic loading and FPGA reconstruction provided by the present invention. Specific examples have been used to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only for the purpose of helping to understand the method and core ideas of the present invention. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of the present invention. Therefore, the content of this specification should not be construed as a limitation of the present invention.

[0084] In this document, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, without necessarily requiring or implying any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

Claims

1. An algorithm configuration method based on dynamic loading and FPGA reconfiguration, characterized in that, Includes the following steps: S1: Store the Linux system algorithm configuration dynamic library and algorithm files to external storage; S2: Retrieve and cache the algorithm configuration dynamic library in external memory through the hardware connection interface, which is used to parse the processing logic of the algorithm file and perform reading and caching operations on the algorithm file; including the following steps: S211: Read the algorithm configuration dynamic library from external memory, and store it in RAM cache after passing CRC verification; S212: Call the algorithm read function in the algorithm configuration dynamic library to read the algorithm file in the external storage; S213: Call the algorithm decryption interface in the algorithm configuration dynamic library to verify and decrypt the algorithm file. If the verification and decryption pass, store the decrypted algorithm file in the RAM cache. S3: Perform a partial reconstruction configuration operation on the FPGA based on the bit stream of the algorithm file. The reconstructed FPGA is used to implement encryption operations on business data. S4: After configuration, uninstall the algorithm configuration dynamic library and clear the cached algorithm files.

2. The algorithm configuration method based on dynamic loading and FPGA reconfiguration according to claim 1, characterized in that, The algorithm configuration dynamic library includes logic for reading algorithm files, decrypting them, and configuring the algorithm.

3. The algorithm configuration method based on dynamic loading and FPGA reconfiguration according to claim 1, characterized in that, S1 further includes: storing the memory configuration file to an external memory for checking whether the external memory environment meets the requirements for calling the algorithm configuration dynamic library.

4. The algorithm configuration method based on dynamic loading and FPGA reconfiguration according to claim 3, characterized in that, S2 further includes the following steps: S221: Read the memory configuration file and parse its contents; obtain the device information of the FPGA; S222: Based on the configuration file content and the device information, check whether the memory type of the external storage is correct and / or whether the stored target configuration information matches; if the check passes, execute the algorithm configuration dynamic library retrieval operation; If the check fails, an alarm signal is output and the process returns to S221.

5. The algorithm configuration method based on dynamic loading and FPGA reconfiguration according to claim 1, characterized in that, Before retrieving the algorithm configuration dynamic library from external memory via the hardware connection interface in step S2, the following steps are also included: S201: Hot-plug monitoring is performed on the hardware connection interface. If the external memory is detected to be connected, proceed to S202. S202: Determine whether the external memory is a valid memory. If valid, proceed to S2; if invalid, output an alarm signal and return to S201.

6. The algorithm configuration method based on dynamic loading and FPGA reconfiguration according to claim 1, characterized in that, S3 includes the following steps: S31: Send an algorithm configuration request to the FPGA, and proceed to S32 after receiving the algorithm configuration request response from the FPGA; S32: Transmit the bit stream of the algorithm file to the FPGA in segments, and after each bit stream is transmitted, receive and judge the transmission response result fed back by the FPGA; S33: If the transmission response result is abnormal, retransmit the bit stream of the current segment algorithm file to the FPGA, receive and judge the transmission response result fed back by the FPGA, and return to S33. If the transmission response is normal, the next segment of the algorithm file's bitstream is transmitted to the FPGA until the algorithm file transmission is complete.

7. An encryption device for an algorithm configuration method based on dynamic loading and FPGA reconfiguration according to any one of claims 1-6, characterized in that, Includes dedicated algorithm storage and encryption modules; among which, The dedicated algorithm storage is used as external storage to store the Linux system algorithm configuration dynamic library and algorithm files; The encryption module includes an ARM processor and an FPGA algorithm processing module; The ARM processor retrieves and caches the algorithm configuration dynamic library in the external memory to RAM through the hardware connection interface, uses the algorithm configuration dynamic library to parse the processing logic of the algorithm file, reads the algorithm file and caches it to RAM; and after the configuration is completed, it unloads the algorithm configuration dynamic library and clears the cached algorithm file. The FPGA algorithm processing module performs a partial reconstruction configuration operation on the FPGA based on the bit stream of the algorithm file. The reconstructed FPGA is used to implement the encryption operation of business data in the business system.

8. The encryption device according to claim 7, characterized in that, The external interfaces of the ARM processor include a USB interface and a QSPI interface; the USB interface is used to connect to the dedicated memory for the algorithm; the QSPI interface is used to connect to the FPGA algorithm processing module.

9. The encryption device according to claim 7, characterized in that, The encryption module also includes an interaction module, which is used to indicate the status of the algorithm configuration process and output the external interface connection information of the ARM processor.

Images