A data processing unit (DPU)

Abstract

The application provides a data processing unit (DPU) comprising: a post-quantum cryptography acceleration module for key agreement and identity authentication using a post-quantum algorithm in a TLS handshake phase; a TSL record processing module for splitting encrypted data into TLS records in a data interaction phase and sending the TLS records to a TCP flow control module; decrypting the TLS records extracted by the TCP flow control module so as to send the decrypted data into an operating system protocol stack; the operating system protocol stack supporting the post-quantum algorithm; the TCP flow control module for encapsulating the split TLS records into TCP data packets in the data interaction phase; performing flow control and sequence processing on the data packets; receiving the TCP data packets to extract the TLS records and sending the TLS records to the TSL record processing module. The DPU supports efficient key management and encryption and decryption operations, and provides efficient TLS offloading capability while ensuring quantum security.

Description

Technical Field

[0001] This application relates to the field of information security technology, and more specifically, to a data processing unit (DPU). Background Technology

[0002] With the rapid development of internet technology, network communication security has become a critical issue, especially in high-security fields such as e-commerce, online payment, and cloud computing. Transport Layer Security (TLS), as the cornerstone of network communication security, is widely used for data encryption, authentication, and data integrity protection. However, traditional TLS protocols rely on classical cryptographic algorithms such as RSA and ECDH, which have serious security vulnerabilities when facing the threats of future quantum computing. Quantum computers can break these algorithms in polynomial time using Shor's algorithm, rendering existing TLS protocols unable to resist quantum attacks.

[0003] Meanwhile, with the explosive growth of network traffic, the computational overhead of the TLS protocol is increasingly burdening server CPUs, especially in high-concurrency scenarios such as data centers, where traditional software-implemented TLS protocols have become a performance bottleneck. To improve performance, modern network interface cards (NICs) and data processing units (DPUs) have introduced TLS hardware offloading technology, transferring TLS encryption / decryption, key exchange, and other operations from the CPU to hardware, thereby significantly reducing CPU load and increasing network throughput. However, existing TLS hardware offloading technologies still rely on classical cryptographic algorithms, lack quantum security, and cannot cope with the threats of future quantum computing.

[0004] Against this backdrop, how to combine post-quantum cryptography algorithms with TLS hardware offloading technology to ensure quantum security while fully leveraging the performance advantages of hardware has become an urgent technical problem to be solved. Summary of the Invention

[0005] The purpose of this application is to provide a data processing unit (DPU) to solve the above-mentioned problems in the prior art, and to provide efficient TLS offloading capability while ensuring quantum security.

[0006] In a first aspect, a data processing unit (DPU) is provided, which includes: a TCP flow control module, a TLS record processing module, and a post-quantum cryptography acceleration module;

[0007] The post-quantum cryptography acceleration module is used to integrate the post-quantum algorithm and to perform key negotiation and identity authentication during the TLS handshake phase.

[0008] The TLS record processing module is used to split encrypted data into TLS records during the data interaction phase and send the split TLS records to the TCP flow control module; and to decrypt the TLS records extracted by the TCP flow control module so as to send the decrypted data into the operating system protocol stack; the operating system protocol stack supports post-quantum algorithms.

[0009] The TCP flow control module is used to encapsulate the split TLS records into TCP packets during the data interaction phase; perform flow control and order processing of TCP packets; and receive TCP packets, extract TLS records, and send the extracted TLS records to the TLS record processing module.

[0010] In one possible implementation, the post-quantum cryptography acceleration module is specifically used to implement key negotiation using a post-quantum algorithm through the following steps:

[0011] A first key pair is generated based on the post-quantum algorithm, the first key pair including a first public key and a first private key;

[0012] Receive the second public key from the second key pair generated by the server to determine the shared key.

[0013] The shared key is then encrypted using the second public key and sent to the server, so that the server can decrypt the ciphertext using the second private key in the second key pair to obtain the shared key.

[0014] In one possible implementation, the DPU is applied to a client device;

[0015] The post-quantum cryptography acceleration module is specifically used to implement identity authentication using a post-quantum algorithm through the following steps:

[0016] Based on the server certificate sent by the received server, obtain the post-quantum public key generated by the post-quantum algorithm in the server certificate;

[0017] The server is authenticated based on the post-quantum public key and the server certificate.

[0018] In one possible implementation, the post-quantum cryptography acceleration module is further configured to determine an encryption key based on the shared key and send the encryption key to the TLS record processing module.

[0019] In one possible implementation, the TLS record processing module is specifically used to receive a data stream sent by the operating system protocol stack during the data interaction phase, and encrypt the data stream according to the encryption key and the symmetric encryption algorithm; and split the encrypted data stream into TLS records conforming to the TLS protocol format.

[0020] Furthermore, the TLS records extracted by the TCP flow control module are decrypted according to the encryption key and the symmetric decryption algorithm, wherein the symmetric decryption algorithm corresponds to the symmetric encryption algorithm.

[0021] In one possible implementation, each TLS record includes a record header, encrypted data, and a Message Authentication Code (MAC); the record header includes the version, data type, and data length; the MAC is obtained by signing the corresponding TLS record using a post-quantum algorithm.

[0022] In one possible implementation, the TCP flow control module is specifically used to encapsulate TLS records into TCP packets during the data interaction phase, and then sort the encapsulated TCP packets according to their sequence numbers.

[0023] Furthermore, during the data exchange phase, after receiving TCP packets, the received TCP packets are sorted according to their sequence numbers, and TLS records are extracted sequentially from the sorted TCP packets.

[0024] In one possible implementation, the TCP flow control module is further configured to detect whether a TCP packet is lost using the sequence number and ACK confirmation mechanism of the TCP packet. If the TCP packet is detected to be lost, a retransmission request is triggered to instruct the retransmission of the TCP packet.

[0025] In one possible implementation, the post-quantum algorithm includes:

[0026] Kyber is used to provide an efficient key exchange mechanism;

[0027] LMS-SM3 / HSS-SM3 is used to provide quantum-secure identity authentication and signature verification;

[0028] SM3 is used as a message authentication code algorithm to ensure data integrity.

[0029] In one possible implementation, the DPU is applied to a client device.

[0030] This application provides a Data Processing Unit (DPU) comprising: a TCP flow control module, a TLS record processing module, and a post-quantum cryptography acceleration module. The post-quantum cryptography acceleration module integrates a post-quantum algorithm and uses it for key negotiation and authentication during the TLS handshake phase. The TLS record processing module, during the data interaction phase, splits encrypted data into TLS records and sends the split TLS records to the TCP flow control module; it also decrypts the TLS records extracted by the TCP flow control module to send the decrypted data to the operating system protocol stack. The operating system protocol stack supports the post-quantum algorithm. The TCP flow control module, during the data interaction phase, encapsulates the split TLS records into TCP packets; performs flow control and order processing on the TCP packets; and receives TCP packets, extracts TLS records, and sends the extracted TLS records to the TLS record processing module. This DPU works in conjunction with the operating system protocol stack, completely replacing the kernel network stack, supporting a full TCP NIC offloading mode, while also supporting efficient key management and encryption / decryption operations, and providing efficient TLS offloading capabilities while ensuring quantum security. Attached Figure Description

[0031] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments of this application will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0032] Figure 1 A schematic diagram illustrating the data transmission process involved in a system architecture for implementing DPU-based post-quantum TLS hardware offloading, provided as an embodiment of this application;

[0033] Figure 2 This is a schematic diagram of the structure of a DPU provided in an embodiment of this application. Detailed Implementation

[0034] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of the embodiments. Based on the embodiments of this application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of this application. Unless otherwise defined, the technical or scientific terms used in this application should have the ordinary meaning understood by those skilled in the art. Words such as "comprising" or "including" mean that the element or object preceding the word covers the element or object listed after the word and its equivalents, but does not exclude other elements or objects. Words such as "connection," "coupled," or "linked" are not limited to physical or mechanical connections, but can include electrical connections, whether direct or indirect.

[0035] For ease of understanding, the terms used in the embodiments of this application are explained below:

[0036] Transport Layer Security (TLS) is a protocol that provides security for the entire network of devices.

[0037] Data Processing Unit (DPU)

[0038] PQMagic: Post-Quantum Magic;

[0039] Post-quantum key encapsulation mechanism (KEM): Key Encapsulation Mechanism;

[0040] Existing technology employs a packet-based NIC offload mode. This mode processes TLS encryption and decryption operations packet by packet through the NIC, deeply integrating with the kernel network stack and supporting efficient TLS offload. Packet-based NIC offload is enabled via ethtool flags (such as tls-hw-tx-offload and tls-hw-rx-offload), achieving hardware acceleration of TLS packet processing. However, packet-based NIC offload only partially offloads the TLS stack, failing to completely replace it, and relies on classical cryptographic algorithms such as RSA or ECDH for key exchange and authentication, which are vulnerable to quantum computer attacks. Furthermore, packet-based NIC offload cannot handle the complete TLS record process, still relying on some functions of the kernel network stack, limiting its performance and availability. The aforementioned existing technology suffers from the following drawbacks:

[0041] Lacks quantum security: Existing TLS hardware offloading technologies rely on classical cryptographic algorithms such as RSA or ECDH, which can be quickly cracked in a quantum computing environment, leading to the leakage of TLS session keys and making them unable to resist future quantum attacks.

[0042] Insufficient security of signature algorithms: Existing packet-based NIC offloading modes use RSA or ECDSA signature algorithms for authentication. These algorithms are also vulnerable to attacks by quantum computers, threatening the authentication security of both communicating parties.

[0043] Incomplete uninstallation: The packet-based network card uninstallation mode only partially uninstalls the network card and fails to completely replace the kernel network stack. It still relies on the kernel to handle some TLS record functions, which limits performance and availability.

[0044] Lack of support for post-quantum cryptography algorithms: The existing packet-based NIC offloading mode does not integrate post-quantum cryptography algorithms, and cannot support quantum-safe key exchange, signature authentication and data encryption at the hardware level, thus failing to meet the security requirements of future quantum computing environments.

[0045] Based on this, the inventors propose a system architecture for DPU-based post-quantum TLS hardware offloading to address the aforementioned issues. This architecture leverages post-quantum cryptographic algorithms to enhance the security of traditional TLS protocols while fully utilizing the hardware acceleration advantages of the DPU, reducing CPU computational load, and improving network throughput and security. The scheme implements a full TCP offloading mode and ensures the system can withstand future threats from quantum computing.

[0046] The post-quantum TLS hardware offloading system architecture provided in this application embodiment may include: an application, an operating system, a DPU, and a network interface card (NIC). The DPU can be deployed on a client device, and may include a post-quantum cryptography acceleration module, a TLS record processing module, and a TCP flow control module. This system can establish a communication connection with a server to achieve data transmission.

[0047] Figure 1 This is a schematic diagram illustrating the data transmission process involved in the system architecture provided in this application embodiment. Figure 1 This includes the TLS handshake phase and the data exchange phase.

[0048] A. During the TLS handshake phase, the post-quantum cryptography acceleration module uses a post-quantum algorithm for key negotiation and authentication.

[0049] (1) The post-quantum cryptography acceleration module implements key negotiation using the post-quantum algorithm through the following steps:

[0050] Step 1: Generate the first key pair based on the post-quantum algorithm.

[0051] The first key pair may include a first public key and a first private key.

[0052] Step 2: Receive the second public key from the second key pair generated by the server to determine the shared key;

[0053] The second key pair may also include a second private key; the post-quantum algorithm used to generate the first key pair may be the same as or different from the post-quantum algorithm used to generate the second key pair, and this application does not limit this.

[0054] Step 3: Send the ciphertext, which is encrypted using the second public key, to the server.

[0055] After receiving the ciphertext, the server uses the second private key to decrypt the ciphertext and obtain the shared key.

[0056] (2) The post-quantum cryptography acceleration module implements identity authentication using the post-quantum algorithm through the following steps:

[0057] Step 4: Receive the server certificate sent by the server and obtain the post-quantum public key generated by the post-quantum algorithm from the server certificate;

[0058] Step 5: Authenticate the server based on the post-quantum public key and the server certificate.

[0059] If the server-side authentication is successful, the data interaction phase begins.

[0060] B. During the data interaction phase, the workflow of the TLS record processing module and the TCP flow control module includes two processes: data sending and data receiving.

[0061] (1) The data transmission process includes:

[0062] Step 6: The TLS record processing module receives the data stream sent by the application through the operating system protocol stack;

[0063] Step 7: The TLS record processing module encrypts the data stream;

[0064] Step 8: The TLS record processing module extracts TLS records from the encrypted data stream;

[0065] Step 9: The TLS record processing module sends the split TLS record to the TCP flow control module;

[0066] Step 10: The TCP flow control module encapsulates the TLS record into a TCP packet and sends it out through the network card.

[0067] (2) The data receiving process includes:

[0068] Step 11: The TCP flow control module receives TCP data packets;

[0069] Step 12: The TCP flow control module extracts TLS records from the received TCP packets;

[0070] Step 13: The TCP flow control module sends the extracted TLS records to the TLS record processing module;

[0071] Step 14: The TLS record processing module decrypts the extracted TLS records to obtain the decrypted data;

[0072] Step 15: The TLS record processing module sends the decrypted data into the application through the operating system protocol stack.

[0073] As can be seen from the above process, the data transmission method described above can achieve post-quantum TLS hardware offloading based on the DPU. The DPU works in conjunction with the operating system protocol stack, completely replacing the kernel network stack and supporting a full TCP NIC offloading mode. The operating system's protocol stack needs to support post-quantum algorithms and integrate these algorithms into the TLS protocol stack to ensure seamless collaboration with the DPU hardware, completing data encryption / decryption, authentication, and flow control.

[0074] Furthermore, the execution functions of the post-quantum cryptography acceleration module, TLS record processing module, and TCP flow control module in the DPU will be described in detail below, such as... Figure 2 The diagram shown is a schematic of the structure of a DPU.

[0075] 1) Post-quantum cryptography acceleration module, used to integrate post-quantum algorithms and use post-quantum algorithms for key negotiation and identity authentication during the TLS handshake phase.

[0076] The post-quantum cryptography acceleration module integrates post-quantum algorithms from PQMagic, including Kyber, LMS-SM3, HSS-SM3, and SM3. Kyber's post-quantum algorithm provides an efficient key exchange mechanism resistant to quantum computing attacks. LMS-SM3 / HSS-SM3's post-quantum algorithms provide quantum-secure authentication and signature verification. SM3's post-quantum algorithm can be used as a Message Authentication Code (MAC) algorithm to ensure data integrity. These post-quantum algorithms implement key negotiation and authentication during the TLS handshake phase, providing hardware acceleration support, optimizing the computational performance of post-quantum algorithms, and reducing CPU load.

[0077] Specifically, the post-quantum cryptography acceleration module implements key negotiation using a post-quantum algorithm, including: generating a first key pair based on the post-quantum algorithm, the first key pair including a first public key and a first private key; receiving the second public key from the second key pair generated by the server, determining the shared key, and sending the ciphertext encrypted with the shared key using the second public key to the server, so that the server can decrypt the ciphertext using the second private key from the second key pair to obtain the shared key.

[0078] The post-quantum cryptography acceleration module implements identity authentication using a post-quantum algorithm, including: obtaining the post-quantum public key generated by the post-quantum algorithm from the server certificate sent by the server; and authenticating the server based on the post-quantum public key and the server certificate.

[0079] Furthermore, the post-quantum cryptography acceleration module is also used to determine the encryption key based on the shared key and send the encryption key to the TLS record processing module so that the TLS record processing module can encrypt the data stream or decrypt the extracted TLS records sent by the TCP flow control module.

[0080] 2) The TLS record processing module is used to split the encrypted data into TLS records during the data interaction phase and send the split TLS records to the TCP flow control module; and to decrypt the TLS records extracted by the TCP flow control module so that the decrypted data can be sent to the operating system protocol stack; the operating system protocol stack supports post-quantum algorithms, that is, it supports the post-quantum algorithms involved in the PQMagic library mentioned above.

[0081] Specifically, during the data interaction phase, the system receives the data stream sent by the operating system protocol stack and encrypts it using an encryption key and a symmetric encryption algorithm. The encrypted data stream is then split into TLS records conforming to the TLS protocol format. Furthermore, the TLS records extracted by the TCP flow control module are decrypted using the encryption key and a symmetric decryption algorithm, which corresponds to the symmetric encryption algorithm. Since each TCP packet has a sequence number, the data obtained after decrypting the TLS record can be concatenated based on the sequence number of the corresponding TCP packet to obtain the received data stream.

[0082] A TLS record is the smallest unit of data transmission in the TLS protocol. The data stream is broken down into multiple TLS records, and the processing is entirely handled by the DPU hardware, reducing the CPU load.

[0083] Furthermore, each TLS record may include: a record header, encrypted data, and a Message Authentication Code (MAC); the record header may include information such as version, data type, and data length; the MAC is obtained by signing the corresponding TLS record using a post-quantum algorithm (such as the SM3 algorithm) to ensure data integrity and authentication.

[0084] 3) The TCP flow control module is used to encapsulate the split TLS records into TCP packets during the data exchange phase; perform flow control and order processing of TCP packets; and receive TCP packets, extract TLS records, and send the extracted TLS records to the TLS record processing module.

[0085] TCP packet flow control and ordering can include processes such as flow control, packet sending, packet receiving, packet sorting, and packet retransmission. This ensures that there is no packet loss or ordering errors during data transmission.

[0086] Specifically, during the data exchange phase, after encapsulating TLS records into TCP packets, the encapsulated TCP packets are sorted according to their sequence numbers. Also, during the data exchange phase, after receiving TCP packets, the received TCP packets are sorted according to their sequence numbers, so that TLS records can be extracted from the sorted TCP packets sequentially.

[0087] Furthermore, the TCP flow control module is specifically used to detect whether a TCP packet is lost by using the sequence number and ACK confirmation mechanism of the TCP packet. If the loss of the TCP packet is detected, a retransmission request is triggered to instruct the retransmission of the TCP packet.

[0088] In other words, the packet loss handling of the TCP flow control module includes:

[0089] a. Packet loss detection: Detects whether TCP packets are lost by using the sequence number and ACK confirmation mechanism of TCP packets.

[0090] b. Packet Retransmission: Triggers a retransmission request, demanding that the source host that sent the TCP packets retransmit the lost TCP packets. The TLS record processing module can re-decrypt the retransmitted TCP packets received by the TCP flow control module.

[0091] The TCP packet loss handling in the TCP flow control module includes:

[0092] a. Data packet reception: The received data packets may be out of order.

[0093] b. Packet sorting: Reorder TCP packets according to their sequence numbers.

[0094] In some embodiments, to further enhance security, after obtaining the shared key through the handshake phase, a key update time can be set for the shared key. For example, during communication after obtaining the shared key, the current shared key will be changed to a new shared key every preset key update time period, and the encryption key will be changed accordingly. This change process is performed in both the client's DPU and the server.

[0095] Specifically, during the key exchange in the TLS handshake phase, a configured character update sequence is exchanged simultaneously. This character update sequence includes random strings of different lengths arranged in sequence. According to the order of the random strings, the corresponding random strings are extracted from the character update sequence in turn. Every preset key update time period, the current shared key needs to be changed. The extracted random string can be appended to the end or the beginning of the current shared key to obtain a new shared key, which is stored on both the client and server sides. The acquisition time of the shared key is also recorded (including the shared key initially randomly generated by the client and the corresponding acquisition time).

[0096] It should be noted that, to ensure that the random strings extracted from the character update sequence are not duplicated, the extracted random strings can be deleted from the character update sequence. If all random strings in the character update sequence have been extracted (or all have been deleted), the stored shared keys can be used sequentially according to the time they were acquired.

[0097] In some embodiments, each time a new connection is established or at regular intervals, a new session key is generated by combining the initial shared key and / or the currently modified shared key with current context information (such as random numbers, timestamps, etc.) through a key derivation function.

[0098] In some embodiments, a fixed time period can be set, and the key can be automatically changed at the end of each period, or when certain specific events are detected (such as suspected key leakage, network attack, etc.), that is, at the beginning of each period, the client and server renegotiate and generate a new shared key through a post-quantum KEM (such as Kyber). A key derivation function (such as HKDF) is then used to derive the specific encryption key and MAC key from the newly generated shared key, and the updated key is notified to the other party through a secure channel (e.g., new key information encrypted with the current session key), so that both parties switch to the new encryption key for communication at the same time.

[0099] In another embodiment provided in this application, a computer-readable storage medium is also provided, which stores instructions that, when run on a computer, cause the computer to execute the execution method of any module in the DPU in the above embodiments.

[0100] In another embodiment provided in this application, a computer program product containing instructions is also provided, which, when run on a computer, causes the computer to execute the execution method of any module in the DPU in the above embodiments.

[0101] Those skilled in the art will understand that the embodiments in this application can be provided as methods, systems, or computer program products. Therefore, the embodiments in this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the embodiments in this application can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0102] This application describes embodiments of methods, apparatus (systems), and computer program products according to embodiments of this application with reference to flowchart illustrations and / or block diagrams. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0103] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0104] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0105] Although preferred embodiments have been described in this application, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of the embodiments of this application.

[0106] Obviously, those skilled in the art can make various modifications and variations to the embodiments of this application without departing from the spirit and scope of the embodiments of this application. Therefore, if these modifications and variations to the embodiments of this application fall within the scope of the claims in this application and their equivalents, then this application also intends to include these modifications and variations.

Claims

1. A data processing unit (DPU), characterized in that, The DPU includes: a TCP flow control module, a TLS record processing module, and a post-quantum cryptography acceleration module; The post-quantum cryptography acceleration module is used to integrate the post-quantum algorithm and to perform key negotiation and identity authentication during the TLS handshake phase. The TLS record processing module is used to split encrypted data into TLS records during the data interaction phase and send the split TLS records to the TCP flow control module; and to decrypt the TLS records extracted by the TCP flow control module so as to send the decrypted data into the operating system protocol stack; the operating system protocol stack supports post-quantum algorithms. The TCP flow control module is used to encapsulate the split TLS records into TCP packets during the data interaction phase; perform flow control and order processing of TCP packets; and receive TCP packets, extract TLS records, and send the extracted TLS records to the TLS record processing module.

2. The DPU as described in claim 1, characterized in that, The post-quantum cryptography acceleration module is specifically used to achieve key negotiation using the post-quantum algorithm through the following steps: A first key pair is generated based on the post-quantum algorithm, the first key pair including a first public key and a first private key; The server receives the second public key from the second key pair generated by the server, uses the second public key to generate a shared key, encrypts it into ciphertext, and sends the ciphertext to the server so that the server can decrypt the ciphertext using the second private key from the second key pair. The two parties thus negotiate the same shared key.

3. The DPU as described in claim 1, characterized in that, The DPU is applied to client devices; The post-quantum cryptography acceleration module is specifically used to implement identity authentication using a post-quantum algorithm through the following steps: Based on the server certificate sent by the received server, obtain the post-quantum public key generated by the post-quantum algorithm in the server certificate; The server is authenticated based on the post-quantum public key and the server certificate.

4. The DPU as described in claim 2, characterized in that, The post-quantum cryptography acceleration module is further configured to determine an encryption key based on the shared key and send the encryption key to the TLS record processing module.

5. The DPU as described in claim 4, characterized in that, The TLS record processing module is specifically used to receive the data stream sent by the operating system protocol stack during the data interaction phase, and encrypt the data stream according to the encryption key and symmetric encryption algorithm; and split the encrypted data stream into TLS records that conform to the TLS protocol format. Furthermore, the TLS records extracted by the TCP flow control module are decrypted according to the encryption key and the symmetric decryption algorithm, wherein the symmetric decryption algorithm corresponds to the symmetric encryption algorithm.

6. The DPU as described in claim 5, characterized in that, Each TLS record includes a record header, encrypted data, and a Message Authentication Code (MAC). The record header includes the version, data type, and data length. The MAC is obtained by signing the corresponding TLS record using a post-quantum algorithm.

7. The DPU as described in claim 1, characterized in that, The TCP flow control module is specifically used to encapsulate TLS records into TCP packets during the data interaction phase, and then sort the encapsulated TCP packets according to their sequence numbers. Furthermore, during the data exchange phase, after receiving TCP packets, the received TCP packets are sorted according to their sequence numbers, and TLS records are extracted sequentially from the sorted TCP packets.

8. The DPU as described in claim 1, characterized in that, The TCP flow control module is also specifically used to detect whether a TCP packet is lost by using the sequence number and ACK confirmation mechanism of the TCP packet. If the TCP packet is lost, a retransmission request is triggered to instruct the retransmission of the TCP packet.

9. The DPU according to any one of claims 1-8, characterized in that, The post-quantum algorithm includes: Kyber is used to provide an efficient key exchange mechanism; LMS-SM3 / HSS-SM3 is used to provide quantum-secure identity authentication and signature verification; SM3 is used as a message authentication code algorithm to ensure data integrity.

10. The DPU according to any one of claims 1-8, characterized in that, The DPU is applied to client devices.

Images