Method, device and electronic equipment for integrating hardware encryption and decryption of DPU centralized sinking service mesh

Abstract

The application provides a DPU centralized sinking type service grid integrated hardware encryption and decryption method, device and electronic equipment, in the method, a first integrated hardware encryption unit is integrated in a first DPU chip, forming a more compact and efficient unit, which is externally embodied as a chip, and the internal logic communication of the chip is used instead of the pcie hardware interface communication, the high integration reduces the delay in the data transmission process, the first DPU chip is a programmable platform, specific acceleration algorithms or security strategies can be loaded according to business requirements, higher flexibility is provided, as the complexity and security requirements of the service grid increase, the first DPU chip can quickly adapt to new encryption standards and security threats (i.e., encryption strategies) through software updates, without replacing hardware (i.e., the first integrated hardware encryption unit), thereby reducing long-term operating costs, enhancing scalability and flexibility, and being more adaptable.

Description

Technical Field

[0001] This invention relates to the technical field of data encryption and decryption, and in particular to a method, apparatus, and electronic device for DPU-centralized sinking service mesh integrated hardware encryption and decryption. Background Technology

[0002] Traditional Sidecar service mesh deployment uses a sidecar model, requiring the startup of a sidecar container for each service. In large clusters with thousands of services, this necessitates creating thousands of sidecar containers. Each sidecar container startup consumes significant system resources such as CPU and memory, reducing the available resources for business services. Therefore, centralized DPU service mesh deployment has emerged, offloading the services from the service mesh to the DPU, thereby saving resources for the business system and increasing the amount of available resources (CPU, memory, etc.) for business services, ultimately improving their efficiency.

[0003] With the widespread adoption of cloud computing and microservice architectures, the security of data interaction in service meshes, as a critical infrastructure for connecting, managing, and protecting inter-service communication, has become paramount. Service meshes provide authentication and data encryption / decryption mechanisms between microservices. However, authentication and encryption / decryption require significant CPU computing resources (statistics show that CPU resource consumption accounts for over 60% in the encryption and decryption of large, intensive data), increasing the proxy load and degrading the performance of the service mesh. This contradicts the original intention of DPU-centric service mesh offloading CPU-intensive resources. Therefore, improving the speed of authentication and data encryption / decryption has become an urgent problem to solve.

[0004] Currently, the industry has traditional hardware encryption / decryption card solutions that need to be plugged into the server motherboard via the PCIe bus. PCI-Express (Peripheral Component Interconnect Express) is a high-speed serial computer expansion bus standard. Its original name was "3GIO". It was proposed by Intel in 2001 and was intended to replace the old PCI, PCI-X and AGP bus standards.

[0005] The hardware encryption / decryption card connects to the DPU via a PCIe interface, as shown in the following structure. Figure 1 As shown, a separate hardware encryption / decryption card is plugged into the DPU via a PCIe interface. This allows the network software encryption / decryption services on the DPU card to be offloaded to the hardware encryption / decryption card. Similarly, the CPU consumption is also offloaded to the hardware encryption / decryption card, thus saving CPU resources and accelerating the performance of data encryption / decryption.

[0006] The traditional hardware encryption and decryption cards mentioned above have poor scalability and adaptability because they are highly customized and not programmable. As the cryptographic complexity and security requirements of the service mesh increase, it may be necessary to frequently replace traditional hardware encryption and decryption cards, which will result in higher costs. In addition, although traditional hardware encryption and decryption cards have powerful encryption and decryption capabilities, they will generate additional latency because they need to communicate and exchange data through the PCIe system bus.

[0007] In summary, the traditional solution of connecting a hardware encryption / decryption card to the DPU via a PCIe interface has technical problems such as poor scalability and adaptability, and high data latency. Summary of the Invention

[0008] In view of this, the purpose of the present invention is to provide a method, apparatus and electronic device for DPU centralized sinking service mesh integrated hardware encryption and decryption, so as to alleviate the technical problems of poor scalability and adaptability and large data latency of the traditional solution of plugging hardware encryption and decryption cards into the DPU through the PCIe interface.

[0009] In a first aspect, embodiments of the present invention provide a method for integrating hardware encryption and decryption in a centralized, recessed service mesh (DPU) architecture, applied to a first DPU chip. The first DPU chip includes: a first centralized, recessed service mesh unit and a first integrated hardware encryption unit. The first centralized, recessed service mesh unit includes: a first mesh data processing module, a first mesh encryption / decryption interface module, and a first data forwarding module. The method includes:

[0010] The first grid data processing module listens to the data stream transmitted by the first container through the PCIe interface, performs grid data processing on the data stream, and obtains the processed data. The grid data processing includes: decoding, routing service, encoding, and circuit breaking.

[0011] When the first grid data processing module calls the target encryption logic interface of the first grid encryption / decryption interface module, the data after grid data processing is encrypted in the first integrated hardware encryption unit according to the target encryption strategy of the target encryption logic interface to obtain encrypted data.

[0012] The first integrated hardware encryption unit transmits the encrypted data to the first data forwarding module;

[0013] The first data forwarding module forwards the encrypted data.

[0014] Furthermore, before the first grid data processing module listens to the data stream transmitted by the first container through the PCIe interface, the method further includes:

[0015] Configure the communication channel between the first centralized sinking service mesh unit and the first integrated hardware encryption unit;

[0016] Service mesh management software and encryption acceleration driver are installed on the first DPU chip, wherein the encryption acceleration driver provides the encryption logic interface;

[0017] Register the first container to the first DPU chip and configure the target encryption policy of the first container;

[0018] A key management module is configured on the first DPU chip to generate, distribute and manage the keys required for encryption.

[0019] Furthermore, the first data forwarding module forwards the encrypted data, including:

[0020] The first data forwarding module forwards the encrypted data to the data receiving cluster determined by the routing service.

[0021] Furthermore, if the data receiving cluster is a second container, and the second container's PCIe interface is connected to a second DPU chip, the second DPU chip includes: a second centralized sinking service mesh unit and a second integrated hardware decryption unit. The second centralized sinking service mesh unit includes: a second mesh data processing module, a second mesh encryption / decryption interface module, and a second data forwarding module. The method further includes:

[0022] The second data forwarding module receives the encrypted data;

[0023] When the second grid data processing module calls the target decryption logic interface of the second grid encryption / decryption interface module, the encrypted data is decrypted in the second integrated hardware decryption unit according to the target decryption strategy of the target decryption logic interface to obtain the decrypted data.

[0024] The second integrated hardware decryption unit transmits the decrypted data to the second grid data processing module through the second grid encryption / decryption interface module;

[0025] The second grid data processing module performs grid data processing on the decrypted data to obtain grid data-processed data, and then transmits the grid data-processed data to the second container through the PCIe interface.

[0026] Furthermore, the encrypted acceleration driver is editable and updatable.

[0027] Secondly, embodiments of the present invention also provide a device for integrating hardware encryption and decryption in a centralized sinking service mesh for a DPU, applied to a first DPU chip. The first DPU chip includes: a first centralized sinking service mesh unit and a first integrated hardware encryption unit. The first centralized sinking service mesh unit includes: a first mesh data processing module, a first mesh encryption and decryption interface module, and a first data forwarding module. The device includes:

[0028] The first grid data processing module listens to the data stream transmitted by the first container through the PCIe interface, performs grid data processing on the data stream, and obtains the processed data. The grid data processing includes: decoding, routing service, encoding, and circuit breaking.

[0029] When the first grid data processing module calls the target encryption logic interface of the first grid encryption / decryption interface module, the data after grid data processing is encrypted in the first integrated hardware encryption unit according to the target encryption strategy of the target encryption logic interface to obtain encrypted data.

[0030] The first integrated hardware encryption unit transmits the encrypted data to the first data forwarding module;

[0031] The first data forwarding module forwards the encrypted data.

[0032] Furthermore, the device is also used for:

[0033] Configure the communication channel between the first centralized sinking service mesh unit and the first integrated hardware encryption unit;

[0034] Service mesh management software and encryption acceleration driver are installed on the first DPU chip, wherein the encryption acceleration driver provides the encryption logic interface;

[0035] Register the first container to the first DPU chip and configure the target encryption policy of the first container;

[0036] A key management module is configured on the first DPU chip to generate, distribute and manage the keys required for encryption.

[0037] Furthermore, the first data forwarding module forwards the encrypted data to the data receiving cluster determined by the routing service.

[0038] Thirdly, embodiments of the present invention also provide an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the method described in any of the first aspects above.

[0039] Fourthly, embodiments of the present invention also provide a computer-readable storage medium storing machine-executable instructions, which, when invoked and executed by a processor, cause the processor to perform the method described in any of the first aspects above.

[0040] In this embodiment of the invention, a method for integrating hardware encryption and decryption in a centralized, recessed service mesh (DPU) is provided, applied to a first DPU chip. The first DPU chip includes a first centralized, recessed service mesh unit and a first integrated hardware encryption unit. The first centralized, recessed service mesh unit includes a first mesh data processing module, a first mesh encryption / decryption interface module, and a first data forwarding module. The method includes: the first mesh data processing module monitoring the data stream transmitted by a first container through a PCIe interface, performing mesh data processing on the data stream to obtain processed data, wherein the mesh data processing includes decoding, routing, encoding, and circuit breaking; when the first mesh data processing module calls the target encryption logic interface of the first mesh encryption / decryption interface module, it encrypts the processed data in the first integrated hardware encryption unit according to the target encryption strategy of the target encryption logic interface to obtain encrypted data; the first integrated hardware encryption unit transmits the encrypted data to the first data forwarding module; and the first data forwarding module forwards the encrypted data. As described above, in the DPU centralized sinking service mesh integrated hardware encryption and decryption method of the present invention, the first DPU chip integrates a first integrated hardware encryption unit, forming a more compact and efficient unit. Externally, it appears as a single chip, using internal chip logic communication instead of PCIe hardware interface communication. This high integration reduces latency during data transmission because the first DPU chip and the first integrated hardware encryption unit no longer need to interact via PCIe. In addition, the first DPU chip is a programmable platform, which can load specific acceleration algorithms or security strategies according to business needs, providing greater flexibility. As the complexity and security requirements of the service mesh increase, the first DPU chip can quickly adapt to new encryption standards and security threats (i.e., encryption strategies) through software updates without replacing the hardware (i.e., the first integrated hardware encryption unit), reducing long-term operating costs, enhancing scalability and flexibility, and improving adaptability. This alleviates the technical problems of poor scalability and adaptability, and high data latency associated with traditional solutions that connect hardware encryption and decryption cards to the DPU via a PCIe interface. Attached Figure Description

[0041] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0042] Figure 1 A schematic diagram showing the hardware encryption / decryption card connected to the DPU via a PCIe interface, as provided in an embodiment of the present invention;

[0043] Figure 2 A flowchart illustrating the hardware encryption / decryption method for centralized DPU-based sinking service mesh integration provided in this embodiment of the invention;

[0044] Figure 3 A schematic diagram of a DPU integrated hardware encryption / decryption card provided in an embodiment of the present invention;

[0045] Figure 4 This is a schematic diagram of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0046] The technical solution of the present invention will be clearly and completely described below with reference to the embodiments. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0047] Traditional solutions that connect hardware encryption / decryption cards to the DPU via a PCIe interface have poor scalability and adaptability, and suffer from high data latency.

[0048] Based on this, in the DPU centralized sinking service mesh integrated hardware encryption and decryption method of the present invention, the first DPU chip integrates a first integrated hardware encryption unit, forming a more compact and efficient unit, which is presented externally as a single chip. The internal logic communication of the chip replaces the PCIe hardware interface communication. This high degree of integration reduces the latency in the data transmission process because the first DPU chip and the first integrated hardware encryption unit no longer need to interact with each other through PCIe. In addition, the first DPU chip is a programmable platform, which can load specific acceleration algorithms or security strategies according to business needs, providing greater flexibility. As the complexity and security requirements of the service mesh increase, the first DPU chip can quickly adapt to new encryption standards and security threats (i.e., encryption strategies) through software updates without replacing the hardware (i.e., the first integrated hardware encryption unit), reducing long-term operating costs, enhancing scalability and flexibility, and improving adaptability.

[0049] To facilitate understanding of this embodiment, a detailed description of a DPU-centralized sinking service mesh integrated hardware encryption and decryption method disclosed in this embodiment of the invention will be provided first.

[0050] Example 1:

[0051] According to an embodiment of the present invention, an embodiment of a method for integrating hardware encryption and decryption in a DPU-centralized sinking service mesh is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0052] Figure 2 This is a flowchart of a method for integrating hardware encryption and decryption in a DPU-centralized sinking service mesh according to an embodiment of the present invention, such as... Figure 2 As shown, the method includes the following steps:

[0053] Step S202: The first grid data processing module listens to the data stream transmitted by the first container through the PCIe interface, performs grid data processing on the data stream, and obtains the processed data. The grid data processing includes: decoding, routing service, encoding and circuit breaking.

[0054] In this embodiment of the invention, the above-described method for centralized, sinking service mesh integrated hardware encryption and decryption of the DPU can be applied to the first DPU chip, such as... Figure 3As shown, the first DPU chip includes: a first centralized sinking service mesh unit and a first integrated hardware encryption unit. The first centralized sinking service mesh unit includes: a first mesh data processing module, a first mesh encryption / decryption interface module, and a first data forwarding module. In other words, this invention provides a service mesh encryption / decryption scheme based on a DPU (i.e., DPU chip) integrated encryption card (i.e., integrated hardware encryption unit), such as... Figure 3 As shown, by integrating a self-developed encryption card with a DPU, hardware offloading of encryption and decryption operations is achieved, improving the encryption and decryption performance and security of the service mesh while reducing latency. The data traffic flow follows a hardware-encrypted data processing procedure, such as... Figure 3 As shown, the specific process can be found in the image. Figure 2 The description.

[0055] The above-described grid data processing is the native data processing flow of the service mesh. When the data stream transmitted by the first container through the PCIe interface is detected, the data stream is decoded to obtain decoded data. The decoded data is then processed by routing services to determine the target address contained therein, and then the data receiving cluster corresponding to the data stream is determined. Before sending the decrypted data to the data receiving cluster, the decrypted data may be modified to obtain modified data. The modified data is then encoded and circuit-breaking processed to finally obtain the processed grid data.

[0056] First, let me briefly introduce some of the concepts involved in this invention:

[0057] DPU (Data Processing Unit): A new generation of computing chips that are data-centric, I / O-intensive, and use software-defined technology to support infrastructure resource layer virtualization. They are capable of improving computing system efficiency, reducing the total cost of ownership of the overall system, improving data processing performance, and reducing the performance loss of other computing chips.

[0058] Service mesh is a platform used to manage communication between services in a microservices architecture. It typically consists of two components: a control plane and a data plane. The control plane is responsible for tasks such as service discovery, load balancing, and traffic management, while the data plane is responsible for the actual request forwarding and processing. The industry commonly uses Isito as the control plane component and Envoy as the data plane component for service meshes.

[0059] Envoy is an open-source, high-performance proxy typically used as the data plane in service meshes, responsible for actual request forwarding and processing. Envoy's architecture consists of a data plane, a management plane, and a control plane. The control plane manages traffic routing and forwarding policies and configurations; the management plane obtains the latest traffic configuration information through standard APIs; and the data plane forwards traffic based on the configuration rules issued by the control plane.

[0060] Service mesh encryption and decryption operations: Communication between microservices involves a large number of authentication and data encryption / decryption operations. For data security reasons...

[0061] Hardware encryption / decryption card: Replacing traditional software encryption / decryption with hardware encryption / decryption, the encryption / decryption module and PCI interface module are integrated into a single FPGA chip, which can reduce the CPU load.

[0062] Step S204: When the first grid data processing module calls the target encryption logic interface of the first grid encryption / decryption interface module, the first integrated hardware encryption unit encrypts the data after grid data processing according to the target encryption strategy of the target encryption logic interface to obtain the encrypted data.

[0063] Step S206: The first integrated hardware encryption unit transmits the encrypted data to the first data forwarding module;

[0064] In step S208, the first data forwarding module forwards the encrypted data.

[0065] The following is a comparative description of the solutions in the conventional technology and the solution in this application:

[0066] like Figure 1 As shown, in the traditional structure, the DPU and the independent encryption card are two hardware chips, requiring two PCIe slots on the server motherboard (i.e., the host) to accommodate the DPU and the independent encryption card. In this invention, there is only one DPU chip (see reference). Figure 3In this invention, only one PCIe slot is needed on the server motherboard (i.e., the host), saving PCIe slot resources on the host. All processing steps in this invention are completed inside the DPU chip. In traditional solutions, the mesh processing is first completed on the DPU chip (specifically, the mesh data processing unit within it). After completion, it is transmitted to the independent encryption card through the external PCIe interface between the chip (DPU) and the chip (independent encryption card). After encryption by the independent encryption card, it is transmitted to the DPU's data forwarding module through the PCIe interface. The above process involves external communication, resulting in long latency. In this invention, the DPU chip simultaneously includes a first centralized sinking service mesh unit and a first integrated hardware encryption unit. The communication between the two is internal communication within the DPU chip, which is faster than traditional external communication because it avoids inter-board communication, thus resulting in shorter latency.

[0067] Service mesh provides logical services, which the DPU can offload. In the case of two cards (traditional solution), the DPU processes its logic, then sends the processed data to another encryption / decryption card for encryption / decryption, and then returns it to the DPU for forwarding. This process is less efficient than completing it within a single DPU chip, where the DPU processes the data internally before sending it out. This results in shorter latency, and the DPU chip is programmable, allowing software control of any unit / module, leading to better scalability and adaptability.

[0068] In this embodiment of the invention, a method for integrating hardware encryption and decryption in a centralized, recessed service mesh (DPU) is provided, applied to a first DPU chip. The first DPU chip includes a first centralized, recessed service mesh unit and a first integrated hardware encryption unit. The first centralized, recessed service mesh unit includes a first mesh data processing module, a first mesh encryption / decryption interface module, and a first data forwarding module. The method includes: the first mesh data processing module monitoring the data stream transmitted by a first container through a PCIe interface, performing mesh data processing on the data stream to obtain processed data, wherein the mesh data processing includes decoding, routing, encoding, and circuit breaking; when the first mesh data processing module calls the target encryption logic interface of the first mesh encryption / decryption interface module, it encrypts the processed data in the first integrated hardware encryption unit according to the target encryption strategy of the target encryption logic interface to obtain encrypted data; the first integrated hardware encryption unit transmits the encrypted data to the first data forwarding module; and the first data forwarding module forwards the encrypted data. As described above, in the DPU centralized sinking service mesh integrated hardware encryption and decryption method of the present invention, the first DPU chip integrates a first integrated hardware encryption unit, forming a more compact and efficient unit. Externally, it appears as a single chip, using internal chip logic communication instead of PCIe hardware interface communication. This high integration reduces latency during data transmission because the first DPU chip and the first integrated hardware encryption unit no longer need to interact via PCIe. In addition, the first DPU chip is a programmable platform, which can load specific acceleration algorithms or security strategies according to business needs, providing greater flexibility. As the complexity and security requirements of the service mesh increase, the first DPU chip can quickly adapt to new encryption standards and security threats (i.e., encryption strategies) through software updates without replacing the hardware (i.e., the first integrated hardware encryption unit), reducing long-term operating costs, enhancing scalability and flexibility, and improving adaptability. This alleviates the technical problems of poor scalability and adaptability, and high data latency associated with traditional solutions that connect hardware encryption and decryption cards to the DPU via a PCIe interface.

[0069] The above provides a brief overview of the DPU-centralized sinking service mesh integrated hardware encryption and decryption method of the present invention. The specific details involved are described in detail below.

[0070] In an optional embodiment of the present invention, before the first grid data processing module listens to the data stream transmitted by the first container through the PCIe interface, the method further includes the following steps:

[0071] (1) Configure the communication channel between the first centralized sinking service mesh unit and the first integrated hardware encryption unit;

[0072] Specifically, a first integrated hardware encryption unit is integrated on the first DPU chip, and a communication channel is configured between the first centralized sinking service mesh unit (i.e., the first DPU chip) and the first integrated hardware encryption unit.

[0073] (2) Install service mesh management software and encryption acceleration driver on the first DPU chip, wherein the encryption acceleration driver provides encryption logic interface;

[0074] Specifically, the encryption acceleration driver ensures that the first grid data processing module calls the hardware encryption / decryption logic in the first integrated hardware encryption unit. The encryption acceleration driver provides encryption strategies for each interface in the grid encryption / decryption interface module, which the first grid data processing module can then call to process data encryption.

[0075] (3) Register the first container to the first DPU chip and configure the target encryption policy of the first container;

[0076] Specifically, each container in the service mesh is registered with the first DPU chip, and a target encryption policy is configured for the first container. The target encryption policy corresponds to the target encryption logic interface. Subsequently, when the first container starts, it notifies the first DPU chip that the data stream sent from the first container needs to be encrypted according to the target encryption policy. In this way, the first DPU chip knows the specific target encryption logic interface to be called.

[0077] The aforementioned target encryption strategy can specifically be a mathematical operation strategy between encryption units in the first integrated hardware encryption unit, such as adding first, then multiplying, and then multiplying again.

[0078] (4) Configure a key management module on the first DPU chip to generate, distribute and manage the keys required for encryption.

[0079] In an optional embodiment of the present invention, the first data forwarding module forwards the encrypted data, including:

[0080] The first data forwarding module forwards the encrypted data to the data receiving cluster determined by the routing service.

[0081] In an optional embodiment of the present invention, if the data receiving cluster is a second container, and the second container's PCIe interface is connected to a second DPU chip, the second DPU chip includes: a second centralized sinking service mesh unit and a second integrated hardware decryption unit. The second centralized sinking service mesh unit includes: a second mesh data processing module, a second mesh encryption / decryption interface module, and a second data forwarding module. The method further includes the following steps:

[0082] (1) The second data forwarding module receives the encrypted data;

[0083] (2) When the second grid data processing module calls the target decryption logic interface of the second grid encryption and decryption interface module, the encrypted data is decrypted in the second integrated hardware decryption unit according to the target decryption strategy of the target decryption logic interface to obtain the decrypted data.

[0084] (3) The second integrated hardware decryption unit transmits the decrypted data to the second grid data processing module through the second grid encryption / decryption interface module;

[0085] (4) The second grid data processing module performs grid data processing on the decrypted data to obtain the grid data processed data, and transmits the grid data processed data to the second container through the PCIe interface.

[0086] For details, please refer to Figure 3 The decryption process is similar to the encryption process described above and will not be repeated here. In addition, before decryption, system initialization and service registration are required, which also involves configuring the communication channel, installing the service mesh management software and decryption acceleration driver, and registering the second container to the second DPU chip. These processes will not be detailed here; please refer to the descriptions of the encryption process above, simply replacing "encryption" with "decryption." It should be noted that the same DPU chip can perform both encryption and decryption. This description simply separates the encryption and decryption processes for different DPU chips.

[0087] In an optional embodiment of the present invention, the encryption acceleration driver is editable and updatable. Correspondingly, there is also a decryption acceleration driver, which is also editable and updatable.

[0088] This invention provides a technology based on a DPU-integrated hardware encryption card to accelerate inter-microservice authentication, improve encryption / decryption performance, and reduce CPU resource consumption. The method of this invention has the following advantages:

[0089] (1) The present invention utilizes the operation of the DPU integrated hardware encryption card, so that the DPU and the encryption card are in the same chip package, which reduces the complexity of the DPU connecting to a separate encryption card through PCIe and reduces the complexity of maintenance.

[0090] (2) The present invention utilizes the operation of the DPU integrated hardware encryption card to reduce the CPU resource consumption of encryption and decryption data and improve the performance of the service mesh. Although traditional hardware encryption cards have powerful encryption and decryption capabilities, they generate additional latency and overhead because they need to transmit data through the system bus.

[0091] (3) This invention utilizes the operation of the DPU highly integrated encryption card to reduce the latency caused by the interaction between a separate encryption card and a separate DPU card, thereby improving the performance of the DPU service mesh centralized sinking service mesh and reducing latency;

[0092] (4) This invention utilizes the programmable logic of the DPU, enabling the DPU to be integrated into the encryption card and its functions to be expanded through software logic. It can cope with complex encryption and decryption scenarios in the future without changing the hardware logic, thus improving scalability. The scalability of traditional hardware encryption cards is limited by the hardware design, requiring the replacement or addition of hardware devices to achieve functional expansion, resulting in poor flexibility.

[0093] Example 2:

[0094] This invention also provides a device for DPU centralized sinking service mesh integrated hardware encryption and decryption. This device is mainly used to execute the DPU centralized sinking service mesh integrated hardware encryption and decryption method provided in Embodiment 1 of this invention. The following is a detailed description of the device for DPU centralized sinking service mesh integrated hardware encryption and decryption provided in this invention.

[0095] The device for integrating hardware encryption and decryption in the centralized sinking service mesh of the DPU is applied to a first DPU chip. The first DPU chip includes: a first centralized sinking service mesh unit and a first integrated hardware encryption unit. The first centralized sinking service mesh unit includes: a first mesh data processing module, a first mesh encryption and decryption interface module, and a first data forwarding module. The device includes:

[0096] The first grid data processing module listens to the data stream transmitted by the first container through the PCIe interface, performs grid data processing on the data stream, and obtains the processed data. The grid data processing includes: decoding, routing service, encoding, and circuit breaking.

[0097] When the first grid data processing module calls the target encryption logic interface of the first grid encryption / decryption interface module, the first integrated hardware encryption unit encrypts the data after grid data processing according to the target encryption strategy of the target encryption logic interface to obtain the encrypted data.

[0098] The first integrated hardware encryption unit transmits the encrypted data to the first data forwarding module;

[0099] The first data forwarding module forwards the encrypted data.

[0100] In this embodiment of the invention, a device for integrated hardware encryption and decryption of a DPU centralized sinking service mesh is provided, applied to a first DPU chip. The first DPU chip includes: a first centralized sinking service mesh unit and a first integrated hardware encryption unit. The first centralized sinking service mesh unit includes: a first mesh data processing module, a first mesh encryption / decryption interface module, and a first data forwarding module. The device includes: the first mesh data processing module listening to the data stream transmitted by the first container through the PCIe interface, performing mesh data processing on the data stream to obtain processed mesh data, wherein the mesh data processing includes: decoding processing, routing service, encoding processing, and circuit breaking processing; when the first mesh data processing module calls the target encryption logic interface of the first mesh encryption / decryption interface module, it encrypts the processed mesh data in the first integrated hardware encryption unit according to the target encryption strategy of the target encryption logic interface to obtain encrypted data; the first integrated hardware encryption unit transmits the encrypted data to the first data forwarding module; the first data forwarding module forwards the encrypted data. As described above, in the DPU centralized sinking service mesh integrated hardware encryption and decryption device of the present invention, the first DPU chip integrates a first integrated hardware encryption unit, forming a more compact and efficient unit. Externally, it appears as a single chip, using internal chip logic communication instead of PCIe hardware interface communication. This high integration reduces latency during data transmission because the first DPU chip and the first integrated hardware encryption unit no longer need to interact via PCIe. In addition, the first DPU chip is a programmable platform, which can load specific acceleration algorithms or security strategies according to business needs, providing greater flexibility. As the complexity and security requirements of the service mesh increase, the first DPU chip can quickly adapt to new encryption standards and security threats (i.e., encryption strategies) through software updates without replacing the hardware (i.e., the first integrated hardware encryption unit), reducing long-term operating costs, enhancing scalability and flexibility, and improving adaptability. This alleviates the technical problems of poor scalability and adaptability, and high data latency associated with traditional solutions that connect hardware encryption and decryption cards to the DPU via a PCIe interface.

[0101] Optionally, the device is also used to: configure a communication channel between the first centralized sinking service mesh unit and the first integrated hardware encryption unit; install service mesh management software and encryption acceleration driver on the first DPU chip, wherein the encryption acceleration driver provides an encryption logic interface; register the first container to the first DPU chip and configure the target encryption policy of the first container; configure a key management module on the first DPU chip to generate, distribute and manage the keys required for encryption through the key management module.

[0102] Optionally, the first data forwarding module forwards the encrypted data to the data receiving cluster determined by the routing service.

[0103] Optionally, if the data receiving cluster is a second container, and the second container's PCIe interface is connected to a second DPU chip, the second DPU chip includes: a second centralized sinking service mesh unit and a second integrated hardware decryption unit. The second centralized sinking service mesh unit includes: a second mesh data processing module, a second mesh encryption / decryption interface module, and a second data forwarding module. This device is further used for: the second data forwarding module receiving encrypted data; when the second mesh data processing module calls the target decryption logic interface of the second mesh encryption / decryption interface module, the second integrated hardware decryption unit decrypts the encrypted data according to the target decryption strategy of the target decryption logic interface to obtain decrypted data; the second integrated hardware decryption unit transmits the decrypted data to the second mesh data processing module through the second mesh encryption / decryption interface module; the second mesh data processing module performs mesh data processing on the decrypted data to obtain mesh data-processed data, and transmits the mesh data-processed data to the second container through the PCIe interface.

[0104] Optionally, the encrypted acceleration driver can be edited and updated.

[0105] The device provided in this embodiment of the invention has the same implementation principle and technical effect as the aforementioned method embodiment. For the sake of brevity, any parts not mentioned in the device embodiment can be referred to the corresponding content in the aforementioned method embodiment.

[0106] like Figure 4 As shown in the embodiment of this application, an electronic device 600 includes a processor 601, a memory 602, and a bus. The memory 602 stores machine-readable instructions executable by the processor 601. When the electronic device is running, the processor 601 communicates with the memory 602 via the bus. The processor 601 executes the machine-readable instructions to perform the steps of the DPU centralized sinking service mesh integrated hardware encryption and decryption method described above.

[0107] Specifically, the memory 602 and processor 601 mentioned above can be general-purpose memory and processor, without any specific limitations. When the processor 601 runs the computer program stored in the memory 602, it can execute the above-mentioned DPU centralized sinking service mesh integrated hardware encryption and decryption method.

[0108] The processor 601 may be an integrated circuit chip with signal processing capabilities. In implementation, each step of the above method can be completed by the integrated logic circuitry in the hardware of the processor 601 or by instructions in software form. The processor 601 may be a general-purpose processor, including a Central Processing Unit (CPU), a Network Processor (NP), etc.; it may also be a Digital Signal Processor (DSP), an Application Specific Integrated Circuit (ASIC), a Field-Programmable Gate Array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor may be a microprocessor or any conventional processor. The steps of the methods disclosed in the embodiments of this application can be directly manifested as execution by a hardware decoding processor, or execution by a combination of hardware and software modules in the decoding processor. The software module can reside in a mature storage medium in the art, such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, or registers. This storage medium is located in memory 602, and processor 601 reads the information from memory 602 and, in conjunction with its hardware, completes the steps of the above method.

[0109] Corresponding to the above-described method for DPU-centralized sinking service mesh integrated hardware encryption and decryption, this application embodiment also provides a computer-readable storage medium storing machine-executable instructions. When the machine-executable instructions are invoked and executed by a processor, the machine-executable instructions cause the processor to perform the steps of the above-described method for DPU-centralized sinking service mesh integrated hardware encryption and decryption.

[0110] The DPU centralized sinking service mesh integrated hardware encryption / decryption device provided in this application embodiment can be specific hardware on the device or software or firmware installed on the device. The implementation principle and technical effects of the device provided in this application embodiment are the same as those in the foregoing method embodiments. For the sake of brevity, any parts not mentioned in the device embodiment can be referred to the corresponding content in the foregoing method embodiments. Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can all be referred to the corresponding processes in the above method embodiments, and will not be repeated here.

[0111] In the embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. The apparatus embodiments described above are merely illustrative. For example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. Furthermore, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Additionally, the displayed or discussed mutual couplings, direct couplings, or communication connections may be through some communication interfaces; indirect couplings or communication connections between devices or units may be electrical, mechanical, or other forms.

[0112] For example, the flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of apparatus, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions marked in the blocks may occur in a different order than those marked in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram and / or flowchart, and combinations of blocks in block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or action, or using a combination of dedicated hardware and computer instructions.

[0113] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0114] In addition, the functional units in the embodiments provided in this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0115] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause an electronic device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the DPU centralized sinking service mesh integrated hardware encryption and decryption method described in the various embodiments of this application. The aforementioned storage medium includes: USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, optical disks, and other media capable of storing program code.

[0116] It should be noted that similar labels and letters in the following figures indicate similar items. Therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. In addition, the terms "first", "second", "third", etc. are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0117] Finally, it should be noted that the above-described embodiments are merely specific implementations of this application, used to illustrate the technical solutions of this application, and not to limit them. The protection scope of this application is not limited thereto. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that any person skilled in the art can still modify or easily conceive of changes to the technical solutions described in the foregoing embodiments, or make equivalent substitutions for some of the technical features, within the scope of the technology disclosed in this application; and these modifications, changes, or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of this application. All should be covered within the protection scope of this application. Therefore, the protection scope of this application should be determined by the protection scope of the claims.

Claims

1. A method for integrating hardware encryption and decryption in a DPU-centralized, sinking service mesh, characterized in that, The method is applied to a first DPU chip, the first DPU chip comprising: a first centralized sinking service mesh unit and a first integrated hardware encryption unit, the first centralized sinking service mesh unit comprising: a first mesh data processing module, a first mesh encryption / decryption interface module and a first data forwarding module, the method comprising: The first grid data processing module listens to the data stream transmitted by the first container through the PCIe interface, performs grid data processing on the data stream, and obtains the processed data. The grid data processing includes: decoding, routing service, encoding, and circuit breaking. When the first grid data processing module calls the target encryption logic interface of the first grid encryption / decryption interface module, the data after grid data processing is encrypted in the first integrated hardware encryption unit according to the target encryption strategy of the target encryption logic interface to obtain encrypted data. The first integrated hardware encryption unit transmits the encrypted data to the first data forwarding module; The first data forwarding module forwards the encrypted data.

2. The method according to claim 1, characterized in that, Before the first grid data processing module listens to the data stream transmitted by the first container through the PCIe interface, the method further includes: Configure the communication channel between the first centralized sinking service mesh unit and the first integrated hardware encryption unit; Service mesh management software and encryption acceleration driver are installed on the first DPU chip, wherein the encryption acceleration driver provides the encryption logic interface; Register the first container to the first DPU chip and configure the target encryption policy of the first container; A key management module is configured on the first DPU chip to generate, distribute and manage the keys required for encryption.

3. The method according to claim 1, characterized in that, The first data forwarding module forwards the encrypted data, including: The first data forwarding module forwards the encrypted data to the data receiving cluster determined by the routing service.

4. The method according to claim 3, characterized in that, If the data receiving cluster is a second container, and the second container's PCIe interface is connected to a second DPU chip, the second DPU chip includes: a second centralized sinking service mesh unit and a second integrated hardware decryption unit. The second centralized sinking service mesh unit includes: a second mesh data processing module, a second mesh encryption / decryption interface module, and a second data forwarding module. The method further includes: The second data forwarding module receives the encrypted data; When the second grid data processing module calls the target decryption logic interface of the second grid encryption / decryption interface module, the encrypted data is decrypted in the second integrated hardware decryption unit according to the target decryption strategy of the target decryption logic interface to obtain the decrypted data. The second integrated hardware decryption unit transmits the decrypted data to the second grid data processing module through the second grid encryption / decryption interface module; The second grid data processing module performs grid data processing on the decrypted data to obtain grid data-processed data, and then transmits the grid data-processed data to the second container through the PCIe interface.

5. The method according to claim 2, characterized in that, The encrypted acceleration driver is editable and updatable.

6. A device for integrating hardware encryption and decryption using a DPU-centralized, sinking service mesh, characterized in that, The device is applied to a first DPU chip, which includes: a first centralized sinking service mesh unit and a first integrated hardware encryption unit. The first centralized sinking service mesh unit includes: a first mesh data processing module, a first mesh encryption / decryption interface module, and a first data forwarding module. The device includes: The first grid data processing module listens to the data stream transmitted by the first container through the PCIe interface, performs grid data processing on the data stream, and obtains the processed data. The grid data processing includes: decoding, routing service, encoding, and circuit breaking. When the first grid data processing module calls the target encryption logic interface of the first grid encryption / decryption interface module, the data after grid data processing is encrypted in the first integrated hardware encryption unit according to the target encryption strategy of the target encryption logic interface to obtain encrypted data. The first integrated hardware encryption unit transmits the encrypted data to the first data forwarding module; The first data forwarding module forwards the encrypted data.

7. The apparatus according to claim 6, characterized in that, The device is also used for: Configure the communication channel between the first centralized sinking service mesh unit and the first integrated hardware encryption unit; Service mesh management software and encryption acceleration driver are installed on the first DPU chip, wherein the encryption acceleration driver provides the encryption logic interface; Register the first container to the first DPU chip and configure the target encryption policy of the first container; A key management module is configured on the first DPU chip to generate, distribute and manage the keys required for encryption.

8. The apparatus according to claim 6, characterized in that, The first data forwarding module forwards the encrypted data to the data receiving cluster determined by the routing service.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 5.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores machine-executable instructions that, when invoked and executed by a processor, cause the processor to perform the method according to any one of claims 1 to 5.

Images