Video encryption and decryption parallel acceleration processing method and system based on national secret algorithm

Abstract

This invention relates to the field of parallel data processing technology, and in particular to a method and system for parallel acceleration of video encryption and decryption based on Chinese national cryptographic algorithms. The method includes: acquiring data packets to be processed; packaging each message according to the working mode of the Chinese national cryptographic algorithm; setting input pointers, output pointers, and structure pointers for the packaged messages; selecting Q messages from the M packaged messages; mapping the Q structure pointers one-to-one with the selected Q messages; encrypting the selected messages using the SM4 algorithm and hashing the selected messages using the SM3 algorithm; determining whether all bytes in the selected messages have been processed; if not, processing the remaining bytes in the selected messages; otherwise, processing the remaining messages; and obtaining encrypted video data and hash data. This invention supports SM4 multi-mode parallel encryption of data of arbitrary length.

Description

Technical Field

[0001] This invention relates to the field of parallel data processing technology, and in particular to a method and system for parallel acceleration of video encryption and decryption based on Chinese cryptographic algorithms. Background Technology

[0002] IPsec, a widely used data security protocol at the network layer, provides a core foundation for building virtual private networks and ensuring the security of enterprise cloud communications through functions such as data encryption, integrity verification, and authentication. Its encapsulated security payload module uses symmetric encryption algorithms such as SM4 for data encryption and integrates hash algorithms such as SM3 to ensure data integrity and authentication, thereby comprehensively protecting the confidentiality and authenticity of data. However, in high-concurrency application scenarios, such as real-time transmission of multiple high-definition video streams, intelligent security monitoring, and cloud video conferencing, higher demands are placed on processing latency, throughput, and encryption mode adaptability. Existing implementations often face challenges such as limited parallel processing capabilities. Summary of the Invention

[0003] To address the shortcomings of existing technologies, this invention provides a parallel acceleration method and system for video encryption and decryption based on national cryptographic algorithms; it can support SM4 multi-mode parallel encryption of data of arbitrary length.

[0004] On the one hand, a parallel acceleration method for video encryption and decryption based on national cryptographic algorithms is provided, including:

[0005] Obtain the data packet to be processed, which includes: M messages; M is a positive integer greater than zero; the data packet to be processed is video data collected by M surveillance cameras;

[0006] Each message is packaged and processed according to the working mode of the national cryptographic algorithm;

[0007] For the packaged message, set input and output pointers; preset Q structure pointers, which are used to manage the processing status of the message to be processed;

[0008] Select Q messages from the packaged M messages; map Q structure pointers to the selected Q messages one-to-one; encrypt the selected messages using the SM4 algorithm and hash them using the SM3 algorithm; the SM4 algorithm encryption process specifically includes: extracting the first N bytes of each selected message; dividing the extracted first N bytes of each selected message into V groups of R bytes each, each group being called a data block; storing each of the V data blocks of each selected message one by one in a column-major order into a designated matrix; after the column-major order storage is completed, treating each row of the matrix as a vector register, resulting in V vector registers; and performing parallel encryption on the V vector registers to obtain the encryption result.

[0009] On the other hand, a parallel acceleration processing system for video encryption and decryption based on national cryptographic algorithms is provided, including:

[0010] The acquisition module is configured to acquire data packets to be processed, wherein the data packets to be processed include: M messages; M is a positive integer greater than zero; the data packets to be processed are video data collected by M surveillance cameras;

[0011] The packaging module is configured to package each message according to the working mode of the national cryptographic algorithm.

[0012] The settings module is configured to: set input and output pointers for the packaged message; and pre-set Q structure pointers, which are used to manage the processing status of the message to be processed.

[0013] The processing module is configured to: select Q messages from the packaged M messages; map Q structure pointers to the selected Q messages one-to-one; encrypt the selected messages using the SM4 algorithm and hash them using the SM3 algorithm; specifically, the SM4 algorithm for encrypting the selected messages includes: extracting the first N bytes of each selected message; dividing the extracted first N bytes of each selected message into V groups of R bytes each, with each group called a data block; storing each of the V data blocks of each selected message one by one in a column-major order into a designated matrix; after the column-major order storage is completed, treating each row of the matrix as a vector register to obtain V vector registers; and performing parallel encryption on the V vector registers to obtain the encryption result.

[0014] The above technical solution has the following advantages or beneficial effects:

[0015] This invention proposes a data processing method that supports parallel processing of multiple modes using the national cryptographic SM3 hash algorithm and the SM4 encryption algorithm. It is applicable to encryption, decryption, and hash calculation tasks for data blocks of arbitrary length, enabling efficient and unified data processing workflows on the terminal side. By setting independent structure pointers and state variables for each parallel-processed data block, effective tracking and scheduling control of different processing task states are achieved, adapting to the encapsulation requirements of the ESP module in the IPsec protocol. Compared with existing technologies, this invention possesses good versatility and scalability, is compatible with the multi-mode processing requirements of SM3 and SM4, improves processing efficiency and resource utilization, enhances the parallelism and automation level of the data processing process, and effectively ensures the integrity and security of transmitted data. Attached Figure Description

[0016] The accompanying drawings, which form part of this invention, are used to provide a further understanding of the invention. The illustrative embodiments of the invention and their descriptions are used to explain the invention and do not constitute an improper limitation of the invention.

[0017] Figure 1 This is a flowchart of the method in Example 1. Detailed Implementation

[0018] It should be noted that the following detailed descriptions are exemplary and intended to provide further illustration of the invention. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains.

[0019] Example 1

[0020] This embodiment provides a parallel accelerated video encryption and decryption processing method based on national cryptographic algorithms;

[0021] like Figure 1 As shown, the parallel acceleration method for video encryption and decryption based on the national cryptographic algorithm includes:

[0022] S101: Obtain the data packet to be processed, which includes: M messages; M is a positive integer greater than zero; the data packet to be processed is video data collected by M surveillance cameras;

[0023] S102: Package each message according to the working mode of the national cryptographic algorithm;

[0024] S103: Set input and output pointers for the packaged message; preset Q structure pointers, which are used to manage the processing status of the message to be processed;

[0025] S104: Select Q messages from the packaged M messages; map the Q structure pointers to the selected Q messages one-to-one, encrypt the selected messages using the SM4 algorithm, and hash the selected messages using the SM3 algorithm; the SM4 algorithm for encrypting the selected messages specifically includes: extracting the first N bytes of each selected message; dividing the extracted first N bytes of each selected message into V groups of R bytes each, each group being called a data block; storing each of the V data blocks of each selected message one by one in a column-major order into a set matrix; after the column-major order storage is completed, treating each row of the matrix as a vector register, resulting in V vector registers; and performing parallel encryption on the V vector registers to obtain the encryption result.

[0026] Furthermore, the method also includes: S105: determining whether all bytes in the selected message have been processed; if not, processing the remaining bytes in the selected message; if all bytes have been processed, processing the remaining message; finally, obtaining the video encryption data and hash data.

[0027] Furthermore, the method also includes: transmitting encrypted data to a backend server, whereby the backend server decrypts the encrypted data using the SM4 algorithm.

[0028] Furthermore, in the data packets to be processed, each message corresponds to video data collected by each camera.

[0029] Furthermore, S102: Based on the working mode of the national cryptographic algorithm, each message is packaged and processed, including:

[0030] If it is the first working mode, the corresponding message will be packaged and processed according to the first set format;

[0031] If it is the second working mode, the corresponding message will be packaged and processed according to the second set format.

[0032] Furthermore, if it is the first working mode, then the corresponding message is packaged according to the first preset format, including:

[0033] If the SM4 algorithm is in ECB mode, then each message in the data packet to be processed is packaged according to the first set format; the first set format is: first data block header + corresponding message; wherein, the first data block header is 8 bytes; the first data block header is used to store the length of the corresponding message.

[0034] Furthermore, if it is the second working mode, the corresponding message is packaged according to the second set format, including:

[0035] If the SM4 algorithm is operating in CBC, CFB, OFB, or CTR mode, then each message in the data packet to be processed will be packaged according to the second set format. The second set format is: second data block header + initialization vector IV + corresponding message. The second data block header is 8 bytes and the initialization vector IV is 16 bytes. The second data block header is used to store the length of the corresponding message.

[0036] The effect of the above technical solution is that by completing the format division during the data packaging stage, it is possible to avoid dynamically determining whether each message needs an IV during unpacking and execution. If a data format containing IV is uniformly adopted, there will be an invalid 16-byte redundant field for ECB mode that does not require IV, which will increase the data packet size and waste memory resources and transmission bandwidth.

[0037] It should be understood that the ECB mode specifically refers to Electronic Codebook Mode. In this mode, each data block is encrypted and decrypted independently, and there is no connection between data blocks.

[0038] The CBC mode specifically refers to Cipher Block Chaining Mode. In this mode, each plaintext block is XORed with the previous ciphertext block before encryption, and the first plaintext block is XORed with the initialization vector.

[0039] The CFB mode specifically refers to Cipher Feedback Mode. This mode generates ciphertext by encrypting the previous ciphertext block and XORing the result with the current plaintext block. Initialization vectors are used as input in the initial stage.

[0040] The OFB mode specifically refers to Output Feedback Mode. This mode uses the encrypted output from the previous round as input, which, after passing through an encryption function, generates a keystream. This keystream is then XORed with the plaintext to obtain the ciphertext.

[0041] The CTR mode specifically refers to Counter Mode. In this mode, the initialization vector is combined with an incrementing counter value to form the encrypted input. The generated keystream is then XORed with the plaintext to obtain the ciphertext.

[0042] Furthermore, if the task type is the SM4 algorithm working mode ECB or SM3 hash, then the allocated memory space size = the total length of the data packets to be processed + 8 × the number of messages; where the total length of the data packets to be processed is calculated by the strlen function; and where 8 is the message header information reserved for each message.

[0043] Furthermore, if the task type is the CBC mode, CFB mode, OFB mode or CTR mode of the SM4 algorithm, then the allocated memory space size = the total length of the data packets to be processed + (8+16) × the number of messages; where 8 is the message header information reserved for each message and 16 is the initial vector IV space reserved for each message.

[0044] To store the processed data results, memory space is allocated as an output buffer; the allocated memory space size = total length of the data packets to be processed + (8 + 16 + 32) × number of messages; where: 8 is the message header information reserved for each message, 16 is the initial vector IV space reserved for each message, and 32 is the hash value storage space reserved for each message.

[0045] The beneficial effects of the above technical solution are: by dynamically adjusting the memory space allocation strategy according to different working modes of the SM4 algorithm, structural conflicts and data confusion during processing are avoided, ensuring that each message is correctly executed according to its specified mode during encryption, decryption, or hashing. Without classified packaging, a series of problems such as memory waste and structural misalignment may be encountered. The unified structural design of the output cache facilitates direct encapsulation into network security protocol formats such as IPsec ESP.

[0046] Furthermore, if the SM4 algorithm is operating in ECB mode, the PackMsgs function is used to pack the data.

[0047] If the SM4 algorithm is in CBC, CFB, OFB, or CTR mode, the PackMsgsIV function is used to pack the data.

[0048] It should be understood that the PackMsgs function is used to package multiple messages into a contiguous storage area in a uniform format, specifically including reserving an 8-byte header for each message to store its length information, and then storing the original data of the message.

[0049] The PackMsgsIV function is used to package multiple messages and their corresponding initialization vectors into a contiguous storage area in a unified format. Specifically, it includes reserving an 8-byte header for each message to store its length information, then storing a 16-byte initialization vector IV, and finally storing the original data of the message.

[0050] The mathematical expression for the PackMsgs function is:

[0051] ;

[0052] Here, MSG represents the output buffer; msg represents the message pointer array, with each element pointing to the starting address of a message to be processed; msglen represents the message length array, storing the length of each message in msg; and cnt represents the number of messages.

[0053] The mathematical expression for the PackMsgsIV function is:

[0054] ;

[0055] Here, MSG represents the output buffer; msg represents the message pointer array, with each element pointing to the starting address of a message to be processed; msglen represents the message length array, storing the length of each message in msg; piv represents the IV pointer array, with each element pointing to a 16-byte initialization vector; and cnt represents the number of messages.

[0056] The beneficial effects of the above technical solution are: this classification and packaging method ensures the integrity and correct correspondence of data and initialization vectors, which facilitates subsequent batch parallel encryption and decryption processing, while avoiding encryption and decryption errors caused by data format confusion.

[0057] Furthermore, S103: Sets the input and output pointers for the packaged message, including:

[0058] The input pointer is used to point to the starting address of the current message to be processed; the output pointer is used to point to the corresponding output buffer.

[0059] Further, in S103: Q structure pointers are preset, and the structure pointers are used to manage the processing status of messages to be processed; wherein, the structure pointers include:

[0060] Assuming the structure pointer is Each structure pointer includes: total message length len, processed length currentpos, current message pointer pos, data block status sts, data block number msgindex, and output buffer outv; variables This represents the index number of the structure pointer array bctx.

[0061] The current message pointer points to the memory location of the data to be processed next. Initially, it points to the starting address of the message, and the pointer moves forward as processing progresses.

[0062] The beneficial effects of the above technical solution are: by pointing the memory location of the message to the structure pointer, the data can be read quickly without changing the location of the data in memory, and only the pointer needs to be changed when processing the data, thereby improving the overall efficiency of the system.

[0063] Further, in S103: Q structure pointers are preset, and the structure pointers are used to manage the processing status of messages to be processed, including:

[0064] S103-a1: The terminal allocates a structure pointer for each message currently being processed in parallel. and will Initialized to 0; each structure pointer includes the following six attributes: total message length len, processed length currentpos, current message pointer pos, data block status sts, data block number msgindex, and output buffer outv; among them, variables Represents an array of structure pointers index number, Representing the A pointer to a structure.

[0065] S103-a2: During initialization, the terminal iterates through the structure array in a loop. When satisfied When the time comes, retrieve unassigned messages from the input task pool and write the relevant parameters into the structure field;

[0066] S103-a3: After successful message binding, the terminal will... Mark it as 1, and continue extracting the next message until the parallelism is reached or the last message is extracted.

[0067] Further, S104: Select Q messages from the packaged M messages; map Q structure pointers to the selected Q messages one by one. In the initial state, the structure pointers point to the first data block of the message.

[0068] The beneficial effects of the above technical solution are: the structure pointer points to the first data block of the message in the initial state, and the message header stores the length of each message, which makes it convenient for the system to process each message from the header in a uniform way.

[0069] Furthermore, S104: The selected message is hashed using the SM3 algorithm, including:

[0070] Extract the first N bytes of each selected message; divide the extracted first N bytes of each selected message into V groups of R bytes each, each group being called a data block; store each of the V data blocks of each selected message one by one in a set matrix using column-major storage; after column-major storage, treat each row of the matrix as a vector register, resulting in V vector registers; perform parallel hashing on the V vector registers to obtain the hashing result.

[0071] Further, S104: Extract the first N bytes of each selected message; divide the extracted first N bytes of each selected message into V groups of R bytes each, each group being called a data block; for each of the V data blocks of a selected message, store the data blocks one by one in a column-major order into a designated matrix; after the column-major order storage is completed, treat each row of the matrix as a vector register, obtaining V vector registers; perform parallel encryption processing on the V vector registers to obtain the encryption result, including:

[0072] The first 16 bytes of each selected message are extracted. These extracted bytes are then divided into four groups of four bytes each, each group being called a data block. For each selected message, the four data blocks are stored one by one in a column-major order into a designated matrix. After column-major storage, each row of the matrix is ​​treated as a vector register, resulting in four vector registers. These four vector registers are then encrypted in parallel to obtain the encryption result. The designated matrix is ​​a V-row, Q-column matrix.

[0073] Furthermore, the parallel encryption processing of the four vector registers to obtain the encryption result includes:

[0074] The SM4 algorithm is used as parallel encryption to process four vector registers as input. After encryption, the encryption results in the vector registers are written to the output buffer (outv) of their respective messages in their original column order, ensuring that the encryption result of each message corresponds to the position of its original data block.

[0075] During decryption, the ciphertext is input into four vector registers as input, and the parallel decryption operation of the SM4 algorithm is executed. The data in the four vector registers after decryption are output to the output buffer outv of the corresponding message in the original column priority order, so that the original plaintext can be restored.

[0076] Furthermore, S104: The selected message is encrypted using the SM4 algorithm. The specific process includes:

[0077] S104-a1: The terminal selects different encryption functions based on the SM4 mode determined by the oprcode during encryption;

[0078] S104-a2: During the terminal initialization process, an intermediate input buffer indata

[16] and a 4-way parallel vector buffer pl[4][BPCNT] are prepared for the data blocks to be processed to carry the plaintext input of the current batch;

[0079] S104-a3: Copy the complete 16 bytes of data from the input pointer to indata;

[0080] S104-a4: For data less than 16 bytes, in order to align the data to 16 bytes, calculate the remaining number of bytes leftlen = len – currentpos, and copy the remaining plaintext data from the input pointer pos + currentpos to indata;

[0081] S104-a5: Pad the data to 16 bytes using PKCS#7 and mark the message status as 2, indicating that the data block is the last data block;

[0082] S104-a6: Convert the 16-byte data indata into four 32-bit integer values ​​and write them into the parallel buffer pl[0~3][i] respectively. Then, input the data of the four vector buffers pl[0~3][i] into four vector registers and call the parallel encryption function to perform SM4 vector encryption on each group of data blocks in the four vector registers.

[0083] S104-a7: Write the output result of each data block to its corresponding output buffer ctx[i].outv +currentpos, and update currentpos += 16. If the current data block state sts = 2, update the actual length of the output data: outlenarray[msgindex] = currentpos; reset the data block state to sts = 0.

[0084] It should be understood that PKCS#7 is an encryption standard used to pad data into a fixed number of bytes according to rules. PKCS#7, also known as the syntax standard for encrypted messages, is an encryption standard developed by the RSA security system for exchanging digital certificates in public-key cryptography systems.

[0085] Furthermore, in S104-a6, the process of calling the parallel encryption function to perform SM4 vector encryption on each data block is as follows:

[0086] To accommodate the different processing modes of the SM4 algorithm, some modes require an XOR operation before or after encryption. Specifically, ECB and CTR modes do not require an additional XOR operation when calling the parallel encryption function; CBC mode performs an XOR operation on the IV vector and plaintext block pl[i] before encryption; CFB mode performs an XOR operation on the encrypted result IV[i] and pl[i] after encryption as the input for the next round; and OFB mode performs an XOR operation on the encrypted result IV[i] and pl[i] after encryption as the output.

[0087] The advantages of the above technical solution are: it can support data encryption and authentication processing of messages of arbitrary length; through the unified management of structure pointers and block-level scheduling mechanism, it can achieve efficient parallel processing of multiple messages of different lengths; at the same time, the solution is compatible with multiple working modes of the SM4 algorithm and has good versatility.

[0088] Further, in S105: it is determined whether all the bytes in the selected message have been processed. If they have not been processed, the remaining bytes in the selected message are processed. The processing of the remaining bytes in the selected message is also performed in the same way as in S104. Before processing the remaining bytes in the selected message, the process further includes updating the state information of the structure pointer.

[0089] Furthermore, in S105: if all messages have been processed, then the remaining messages are processed; wherein, the processing of the remaining messages is performed in the same way as in S104; wherein, before processing the remaining messages, the process further includes: updating the structure fields corresponding to the input pointer, output pointer, and structure pointer.

[0090] After receiving a data packet to be processed from an upper-layer application or an external interface, the terminal of this invention packages the original data packet into a unified data format according to whether it needs to initialize the vector IV.

[0091] For the packaged data packet, the terminal allocates memory space to store the output result, sets the input pointer to the starting address of the current data to be processed, and sets the output pointer to the corresponding output buffer;

[0092] To achieve parallel processing, the terminal pre-sets multiple structure pointers. Based on the address pointed to by the input pointer of the data packet, each structure pointer points to a message to be processed, and records and manages the overall processing status of the message through the corresponding structure.

[0093] After the structure is prepared, the terminal reads a fixed-length data segment from the corresponding address and inputs it into the buffer according to the input pointer in each structure. Then the terminal splits and groups the input data in the buffer and loads it into the registers required for parallel processing, and performs parallel computing according to the task type.

[0094] After each round of processing, the status information in the structure of the message is updated, and the structure pointer is set to the next data block of the message. After any message is processed, the terminal updates the structure pointer to point to the next message to be processed and updates the input and output pointers and related structure fields.

[0095] After processing all messages, the terminal extracts the length information and corresponding encryption / decryption data of each message in sequence, and appends the hash result of the message to its encryption / decryption data in a fixed-length format.

[0096] This invention adapts to the encapsulation requirements of the ESP module in the IPsec protocol, supporting collaborative processing of SM4 multi-mode parallel encryption and SM3 parallel hash authentication for data of arbitrary length. It effectively addresses data processing bottlenecks in multi-channel video encryption scenarios. This invention designs a unified SM4 and SM3 task scheduling engine. By constructing a message block management structure, it manages the processing status, current position pointer, total length, output position, and control flags of each message. Each message to be processed is encapsulated as an instance of this structure during the input phase. After a data block is processed, the data block status pointer is set, and then the next message block is processed. Dynamic scheduling is performed based on the status information of each data block, enabling block-level parallel processing and finalization.

[0097] Further, S104: Select Q messages from the packaged M messages, including:

[0098] On the first execution, for data packets of task type SM4, extract the first 16 bytes of each of the selected Q messages;

[0099] The first 16 bytes of each message are saved to the buffer; if there are fewer than 16 bytes, PKCS#7 padding is performed.

[0100] The 16-byte data was then divided into four data words, grouped into four 4-byte sets:

[0101] Bytes 0-3 are word0, bytes 4-7 are word1, bytes 8-11 are word2, and bytes 12-15 are word3;

[0102] Store these Q messages in column-major order:

[0103] Where pl[0][i] stores word0 of the i-th message, pl[1][i] stores word1 of the i-th message, pl[2][i] stores word2 of the i-th message, and pl[3][i] stores word3 of the i-th message;

[0104] These data are then input into the vector registers required for parallel processing;

[0105] During non-first executions, unprocessed messages are extracted from the packaged M messages. The first 16 bytes of data for each message are extracted and saved to a buffer. If the buffer is less than 16 bytes, it is padded with PKCS#7. The 16 bytes of data are then divided into four data words in groups of four bytes each. The Q messages are stored in column-major order. Finally, these data are input into the vector registers required for parallel processing.

[0106] The message pointed to by the structure pointer, along with Q-1 other messages, is input into the vector register required for parallel processing and encrypted according to the working mode of the SM4 algorithm.

[0107] Furthermore, S104: Selecting Q messages from the packaged M messages also includes:

[0108] On the first execution, for data packets of task type SM3, for the selected Q messages, extract the first 64 bytes of each message; save the first 64 bytes of each message to the buffer, and fill messages with less than 64 bytes to 64 bytes;

[0109] Then, the 64 bytes of data for each message in the buffer are divided into 16 4-byte blocks: word0 to word15;

[0110] Store the 16 data words of each of the Q messages in column-major order:

[0111] pl[0][i] stores word0 of the i-th message, pl[1][i] stores word1, and so on;

[0112] The stored data is then input into the vector registers required for parallel processing.

[0113] When not executing for the first time, extract the unprocessed message from the packaged M messages, extract the first 64 bytes of data of the message and save it to the buffer, divide the 16 bytes of data into 16 4-byte data, and store them in column-major order; then input these data into the vector register required for parallel processing;

[0114] The message pointed to by the structure pointer, along with Q-1 other messages, is input into the vector register required for parallel processing and hashed.

[0115] After each round of data processing is completed, update the state of each structure pointer; if all the messages pointed to by the pointer have been processed, set its state to 2; if there is still data remaining to be processed, set its state to 1.

[0116] Further, S105: Determine whether all bytes in the selected message have been processed, including:

[0117] After each round of data processing is completed, the terminal performs the following operations based on the status field of the structure pointer:

[0118] For SM4 encryption / decryption tasks, if the status field is not 0, write the 16-byte processing result corresponding to the current processing position of the message to the position pointed to by the output pointer, and shift the output pointer position 16 bytes backward.

[0119] For SM3 hash tasks, if the status field is not 0, the 64-byte processing result corresponding to the current processing position of the message is written to the position pointed to by the structure output pointer and then filled.

[0120] If the status field of a structure pointer is 2, it means that all data of the message has been processed. Record the final output length of the message and reset the status of the message pointer to 0.

[0121] Furthermore, the method also includes: S106: After completing the processing flow of all pending messages, the terminal sequentially performs an output operation on each message, specifically including: firstly outputting the header information of the first message and its corresponding SM4 encryption processing result to the target storage location; then, reading the SM3 hash digest of the first message and appending it to the encryption result to form a data encapsulation format; after the terminal completes the encapsulation of the current message, it continues to process the next message until all messages have been output.

[0122] The data encapsulation format includes: data block header + data body + hash tail; where the data block header is 8 bytes and the hash tail is 32 bytes.

[0123] As a specific embodiment, in S105, after the message pointed to by any structure pointer is processed, the terminal updates the structure pointer to point to the next data block to be processed and updates the input and output pointers and related structure fields as follows:

[0124] The terminal continuously checks the status field sts of each structure pointer bctx[i] to determine whether it is currently in an idle state. When it detects that a structure pointer bctx[i].sts=0 and there are still unprocessed messages, that is, when the current global message index msgindex is less than the total number of messages msgcnt, the current structure pointer is pointed to the next message of the remaining unprocessed data packets.

[0125] Set the structure pointer for the message, including: total message length len, processed length currentpos, current message pointer pos, data block number msgindex, and output buffer outv. At the same time, set the data block status sts to 1 to indicate that the structure pointer is being processed. Exit the loop after all data blocks have been processed.

[0126] Example 2

[0127] This embodiment provides a parallel acceleration processing system for video encryption and decryption based on national cryptographic algorithms, including:

[0128] The acquisition module is configured to acquire data packets to be processed, wherein the data packets to be processed include: M messages; M is a positive integer greater than zero; the data packets to be processed are video data collected by M surveillance cameras;

[0129] The packaging module is configured to package each message according to the working mode of the national cryptographic algorithm.

[0130] The settings module is configured to: set input and output pointers for the packaged message; and pre-set Q structure pointers, which are used to manage the processing status of the message to be processed.

[0131] The processing module is configured to: select Q messages from the packaged M messages; map Q structure pointers to the selected Q messages one-to-one; encrypt the selected messages using the SM4 algorithm and hash them using the SM3 algorithm; specifically, the SM4 algorithm for encrypting the selected messages includes: extracting the first N bytes of each selected message; dividing the extracted first N bytes of each selected message into V groups of R bytes each, with each group called a data block; storing each of the V data blocks of each selected message one by one in a column-major order into a designated matrix; after the column-major order storage is completed, treating each row of the matrix as a vector register to obtain V vector registers; and performing parallel encryption on the V vector registers to obtain the encryption result.

[0132] Furthermore, the system also includes a judgment module, which is configured to: determine whether all bytes in the selected message have been processed; if not, process the remaining bytes in the selected message; if all bytes have been processed, process the remaining message; and finally, obtain the video encrypted data and hash data.

[0133] Furthermore, the system also includes: transmitting encrypted data to a backend server, whereby the backend server decrypts the encrypted data using the SM4 algorithm.

[0134] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A parallel acceleration method for video encryption and decryption based on national cryptographic algorithms, characterized by: include: Obtain the data packet to be processed, which includes: M messages; M is a positive integer greater than zero; the data packet to be processed is video data collected by M surveillance cameras; Each message is packaged and processed according to the working mode of the national cryptographic algorithm; For the packaged message, set input and output pointers; preset Q structure pointers, which are used to manage the processing status of the message to be processed; Select Q messages from the packaged M messages; map Q structure pointers to the selected Q messages one-to-one; encrypt the selected messages using the SM4 algorithm and hash them using the SM3 algorithm; the SM4 algorithm encryption process specifically includes: extracting the first N bytes of each selected message; dividing the extracted first N bytes of each selected message into V groups of R bytes each, each group being called a data block; storing each of the V data blocks of each selected message one by one in a column-major order into a designated matrix; after the column-major order storage is completed, treating each row of the matrix as a vector register, resulting in V vector registers; and performing parallel encryption on the V vector registers to obtain the encryption result. The selected message is encrypted using the SM4 algorithm. The specific process includes: S104-a1: The terminal selects different encryption functions according to the SM4 mode determined by the oprcode during encryption; S104-a2: During the terminal initialization process, an intermediate input buffer indata[16] and a 4-way parallel vector buffer pl[4][BPCNT] are prepared for the data block to be processed to carry the input plaintext of the current batch; S104-a3: The complete 16-byte data is copied from the input pointer to indata; S104-a4: For data less than 16 bytes, in order to align the data to 16 bytes, the remaining number of bytes leftlen = len – currentpos is calculated, and the data is copied from the input pointer pos + S104-a5: Copy the remaining plaintext data to indata using currentpos; padding to 16 bytes using PKCS#7 and mark the message status as 2, indicating that the data block is the last data block; S104-a6: convert the 16-byte data indata into four 32-bit integer values ​​and write them to the parallel buffer pl[0~3][i] respectively. Then, input the data from the four vector buffers pl[0~3][i] into four vector registers and call the parallel encryption function to perform SM4 vector encryption on each group of data blocks in the four vector registers; S104-a7: write the output result of each data block to its corresponding output buffer ctx[i].outv + currentpos and update currentpos += 16. If the current data block status sts = 2, update the actual length of the output data: outlenarray[msgindex] = currentpos; reset the data block status to sts = 0.

2. The video encryption and decryption parallel acceleration processing method based on the national cryptographic algorithm as described in claim 1, characterized in that, The method further includes: determining whether all bytes in the selected message have been processed; if not, processing the remaining bytes in the selected message; if all bytes have been processed, processing the remaining message; and finally, obtaining the encrypted video data and hash data. The encrypted data is transmitted to the backend server, where it is then decrypted using the SM4 algorithm.

3. The video encryption and decryption parallel acceleration processing method based on the national cryptographic algorithm as described in claim 1, characterized in that, Based on the working mode of the national cryptographic algorithm, each message is packaged and processed, including: If it is the first working mode, the corresponding message will be packaged and processed according to the first set format; If it is the second working mode, the corresponding message will be packaged and processed according to the second set format; If it is the first working mode, then the corresponding message is packaged and processed according to the first set format, including: If the SM4 algorithm is in ECB mode, then each message in the data packet to be processed is packaged according to the first set format; the first set format is: first data block header + corresponding message; wherein, the first data block header is 8 bytes; the first data block header is used to store the length of the corresponding message; If it is the second working mode, then the corresponding message is packaged and processed according to the second set format, including: If the SM4 algorithm is operating in CBC, CFB, OFB, or CTR mode, then each message in the data packet to be processed will be packaged according to the second set format. The second set format is: second data block header + initialization vector IV + corresponding message. The second data block header is 8 bytes and the initialization vector IV is 16 bytes. The second data block header is used to store the length of the corresponding message.

4. The parallel acceleration processing method for video encryption and decryption based on national cryptographic algorithms as described in claim 1, characterized in that, For the packaged message, set the input and output pointers, including: The input pointer points to the starting address of the current message to be processed; the output pointer points to the corresponding output buffer; Q structure pointers are preset, which are used to manage the processing status of the messages to be processed; wherein, the structure pointers include: Assuming the structure pointer is Each structure pointer includes: total message length len, processed length currentpos, current message pointer pos, data block status sts, data block number msgindex, and output buffer outv; variables This represents the index number of the structure pointer array bctx.

5. The parallel acceleration processing method for video encryption and decryption based on the national cryptographic algorithm as described in claim 4, characterized in that, Q pre-defined structure pointers are used to manage the processing status of messages to be processed, including: S103-a1: The terminal allocates a structure pointer for each message currently being processed in parallel. and will Initialized to 0; each structure pointer includes the following six attributes: total message length len, processed length currentpos, current message pointer pos, data block status sts, data block number msgindex, and output buffer outv; among them, variables Represents an array of structure pointers index number, Representing the A pointer to a structure; S103-a2: During initialization, the terminal iterates through the structure array in a loop. When satisfied When the time comes, retrieve unassigned messages from the input task pool and write the relevant parameters into the structure field; S103-a3: After successful message binding, the terminal will... Mark it as 1, and continue extracting the next message until the parallelism is reached or the last message is extracted.

6. The video encryption and decryption parallel acceleration processing method based on national cryptographic algorithms as described in claim 1, characterized in that, The selected message is hashed using the SM3 algorithm, including: Extract the first N bytes of each selected message; divide the extracted first N bytes of each selected message into V groups of R bytes each, each group being called a data block; store each of the V data blocks of each selected message one by one in a set matrix using column-major storage; after column-major storage, treat each row of the matrix as a vector register, resulting in V vector registers; perform parallel hashing on the V vector registers to obtain the hashing result.

7. The parallel acceleration processing method for video encryption and decryption based on national cryptographic algorithms as described in claim 1, characterized in that, Select Q messages from the packaged M messages, including: On the first execution, for data packets of task type SM4, extract the first 16 bytes of each of the selected Q messages; The first 16 bytes of each message are saved to the buffer; if there are fewer than 16 bytes, PKCS#7 padding is performed. The 16-byte data was then divided into four data words, grouped into four 4-byte sets: Bytes 0-3 are word0, bytes 4-7 are word1, bytes 8-11 are word2, and bytes 12-15 are word3; Store these Q messages in column-major order: Where pl[0][i] stores word0 of the i-th message, pl[1][i] stores word1 of the i-th message, pl[2][i] stores word2 of the i-th message, and pl[3][i] stores word3 of the i-th message; These data are then input into the vector registers required for parallel processing; During non-first executions, unprocessed messages are extracted from the packaged M messages. The first 16 bytes of data for each message are extracted and saved to a buffer. If the buffer is less than 16 bytes, it is padded with PKCS#7. The 16 bytes of data are then divided into four data words in groups of four bytes each. The Q messages are stored in column-major order. Finally, these data are input into the vector registers required for parallel processing. The message pointed to by the structure pointer, along with Q-1 other messages, is input into the vector register required for parallel processing, and encryption and decryption are performed according to the working mode of the SM4 algorithm.

8. The parallel acceleration processing method for video encryption and decryption based on national cryptographic algorithms as described in claim 1, characterized in that, The method further includes the following process: after the message pointed to by any structure pointer is processed, the terminal updates the structure pointer to point to the next data block to be processed and updates the input and output pointers and related structure fields as follows: The terminal continuously checks the status field sts of each structure pointer bctx[i] to determine whether it is currently in an idle state. When it detects that a structure pointer bctx[i].sts=0 and there are still unprocessed messages, and the current global message index msgindex is less than the total number of messages msgcnt, the current structure pointer is pointed to the next message of the remaining unprocessed data packets. Set the message structure pointer, including: total message length len, processed length currentpos, current message pointer pos, data block number msgindex, and output buffer outv. At the same time, set the data block status sts to 1 to indicate that the structure pointer is being processed. Exit the loop after all data blocks have been processed.

9. A parallel acceleration processing system for video encryption and decryption based on national cryptographic algorithms, characterized in that: include: The acquisition module is configured to acquire data packets to be processed, wherein the data packets to be processed include: M messages; M is a positive integer greater than zero; the data packets to be processed are video data collected by M surveillance cameras; The packaging module is configured to package each message according to the working mode of the national cryptographic algorithm. The settings module is configured to: set input and output pointers for the packaged message; and pre-set Q structure pointers, which are used to manage the processing status of the message to be processed. The processing module is configured to: select Q messages from the packaged M messages; map Q structure pointers to the selected Q messages one-to-one; encrypt the selected messages using the SM4 algorithm and hash them using the SM3 algorithm; specifically, the SM4 algorithm for encrypting the selected messages includes: extracting the first N bytes of each selected message; dividing the extracted first N bytes of each selected message into V groups of R bytes each, with each group called a data block; storing each of the V data blocks of each selected message one by one in a column-major order into a designated matrix; after the column-major order storage is completed, treating each row of the matrix as a vector register, resulting in V vector registers; and performing parallel encryption on the V vector registers to obtain the encryption result. The selected message is encrypted using the SM4 algorithm. The specific process includes: S104-a1: The terminal selects different encryption functions according to the SM4 mode determined by the oprcode during encryption; S104-a2: During the terminal initialization process, an intermediate input buffer indata[16] and a 4-way parallel vector buffer pl[4][BPCNT] are prepared for the data block to be processed to carry the input plaintext of the current batch; S104-a3: The complete 16-byte data is copied from the input pointer to indata; S104-a4: For data less than 16 bytes, in order to align the data to 16 bytes, the remaining number of bytes leftlen = len – currentpos is calculated, and the data is copied from the input pointer pos + S104-a5: Copy the remaining plaintext data to indata using currentpos; padding to 16 bytes using PKCS#7 and mark the message status as 2, indicating that the data block is the last data block; S104-a6: convert the 16-byte data indata into four 32-bit integer values ​​and write them to the parallel buffer pl[0~3][i] respectively. Then, input the data from the four vector buffers pl[0~3][i] into four vector registers and call the parallel encryption function to perform SM4 vector encryption on each group of data blocks in the four vector registers; S104-a7: write the output result of each data block to its corresponding output buffer ctx[i].outv + currentpos and update currentpos += 16. If the current data block status sts = 2, update the actual length of the output data: outlenarray[msgindex] = currentpos; reset the data block status to sts = 0.

Images